A dental practice should include every location where electronic protected health information, or ePHI, enters, moves through, or leaves the business in its HIPAA security risk assessment. That means reviewing practice management software, imaging systems, email, workstations, servers, backups, remote access, vendors, physical safeguards, staff procedures, and patient-data workflows. The practice should document threats and weaknesses, rate each risk by likelihood and impact, and create a realistic correction plan.
A vulnerability scan or checklist can support this work, but neither one replaces a complete assessment.
Why Every Covered Dental Practice Needs a HIPAA Security Risk Assessment
At its core, a HIPAA security risk assessment asks three questions:
- Where does patient information live?
- What could expose, alter, or make that information unavailable?
- What safeguards reduce those risks to a reasonable level?
The HIPAA Security Rule requires covered entities to conduct an accurate and thorough analysis of risks to the confidentiality, integrity, and availability of ePHI. According to the U.S. Department of Health and Human Services, that analysis serves as the first step in selecting appropriate administrative, physical, and technical safeguards.
Does every dental practice fall under HIPAA? HHS identifies dentists as covered providers when they transmit health information electronically in connection with a standard transaction, such as an insurance claim. That describes most modern practices. A dentist who questions the practice’s status should confirm it with qualified counsel.
A HIPAA security risk assessment does not give a practice a one-time stamp of approval. It’s an ongoing effort. Technology, employees, vendors, and attack methods change. A document that sits untouched in a folder cannot protect a patient or keep an operatory running.
AI Adds Another Route for Patient Information
AI makes the HIPAA security risk assessment more important because it gives staff another place to send information. An employee may paste clinical notes into a chatbot, connect an AI assistant to email, or use an automated tool to summarize calls. Each action can create a new data flow.
The HIPAA security risk assessment should identify every AI tool in use, including tools employees adopted without formal approval. Then the practice should determine what data enters the tool, who can access it, how long the provider retains it, whether the provider uses it to train models, and whether the vendor will sign an appropriate business associate agreement when required.
AI also helps criminals combine stolen data with public information. A date of birth, treatment detail, address, or travel post can make phishing feel convincing. Practices need approved tools, access controls, policies, and training that reflect this risk.
A Full Assessment vs. a Scan, Test or Checklist
These security activities provide value, but each answers a narrower question:
- Vulnerability scan: Finds known technical weaknesses, missing patches, and insecure configurations on the systems it can see.
- Penetration test: Tests whether a qualified professional can exploit selected weaknesses from inside or outside the network.
- HIPAA checklist: Prompts a practice to confirm whether policies and safeguards exist. It may not prove that those controls work.
- Complete risk assessment: Maps ePHI, identifies technical and nontechnical threats, evaluates current safeguards, rates likelihood and impact, documents findings, and guides risk management.
A scan may flag an old Windows workstation connected to an imaging device. It may not find two years of patient faxes sitting in a Downloads folder. A checklist may ask whether the practice performs backups. It may not show whether the practice can restore those backups before canceled appointments and idle chairs create serious losses.
I have seen a practice receive patient referrals by digital fax, print each document, and leave the downloaded files on one computer. The routine felt harmless, but that folder held information on hundreds of patients. A complete review looks for these quiet accumulations of data, not only the obvious databases.
What a HIPAA Security Risk Assessment Should Cover
Start by building an inventory of ePHI. Do not begin with assumptions about where it should live. Find where it lives.
During a HIPAA security risk assessment, you can expect the following to be examined:
- Practice management, charting, billing, scheduling, and patient communication systems
- Digital X-ray, intraoral imaging, CBCT, sensor, and image-storage systems
- Servers, cloud services, workstations, laptops, tablets, and removable media
- Email, digital fax, texting, online forms, appointment reminders, and file sharing
- Local, cloud, and off-site backups, including restoration procedures and recovery time
- Remote access tools, virtual private networks, vendor support connections, and home devices
- Firewalls, wireless networks, network segmentation, endpoint protection, patching, and monitoring
- User accounts, administrator access, multifactor authentication, access reviews, and termination procedures
- Physical access to server areas, front-desk screens, operatories, paper output, and retired equipment
- Third-party vendors that create, receive, maintain, or transmit ePHI, along with contracts and business associate agreements
- Staff training, incident response, contingency plans, policies, and documented security decisions
Workflow review belongs in this process, but I approach it in the right order. First, identify the data and systems. Then ask how people move information through them. Formal workflows usually reveal the expected path. Interviews and technical discovery uncover the risky shortcuts, such as forwarding messages to a personal account, saving files locally, sharing passwords, or leaving remote-support access open.
What Can Stay Outside the Scope?
A verified stand-alone device may require limited review if it never handles ePHI and cannot provide a route into systems that do. The practice should document that decision and the reasoning.
Avoid blanket exclusions. A smart television on the clinical network can create risk. A camera system may capture identifiable patient activity or share protected infrastructure. Scope follows the data and access path, not the device label.
How to Prioritize the Findings
Rate each issue by likelihood and impact. Ask whether it could expose data, stop treatment, corrupt images, block schedules, delay insurance work, or trigger patient notification.
Address these risks first:
- Active exposure, unsupported systems, known exploited vulnerabilities, compromised accounts, or unsafe remote access
- Missing, incomplete, or untested backups of critical systems
- Insecure email or file-sharing practices involving patient information
- Excessive administrator privileges, weak authentication, and former-user accounts
- Gaps that could shut down the practice for days rather than hours
Schedule lower risks according to cost, complexity, and timing. A sound plan separates urgent work from improvements the practice can budget across the year. When I call something urgent, I want the owner to understand the business reason and act.
Common Security Weaknesses in Dental Practices
Email remains one of the first places I look. Consumer email accounts (gmail, yahoo, etc.), unencrypted messages, weak passwords, missing multifactor authentication, and automatic forwarding can expose patient information. A business email platform still needs correct security settings, access controls, retention rules, and any required business associate agreement.
Imaging systems create another common gap. A practice may keep an old workstation because a sensor still works on it, leaving an unsupported device on the clinical network. Make sure to coordinate upgrades with the imaging vendor and isolate systems that cannot move immediately.
Workstations collect downloads, scans, reports, and local images long after staff finishes a task. Backups create a different problem. Many practices have one but cannot say when someone last tested a restore or how long recovery would take.
For remote access, identify every vendor tool, personal device, and old account. Require strong authentication, limit privileges, and log access.
Review outside companies that provide software, billing, communications, imaging, hosting, or support. Confirm which vendors handle ePHI, what access they have, and whether required agreements and exit procedures exist.
Why Vulnerability Management Needs Urgency
The Verizon 2026 Data Breach Investigations Report found that exploitation of vulnerabilities became the most common initial access method in its dataset, reaching 31% of breaches. Organizations fully remediated only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog during 2025.
Those numbers matter to dental practices that rely on imaging software, practice management platforms, connected devices, and vendor-supported workstations. An internal vulnerability scan can identify missing patches and obsolete operating systems. The larger assessment then adds business context. It helps the practice patch an exposed server before a lower-risk device and plan around software compatibility, clinical schedules, and vendor requirements.
How Often Should You Update Your Security Risk Assessment?
HHS does not set one universal interval. It calls risk analysis an ongoing process that should reflect changing circumstances. I recommend an annual review for most small practices and reviews every six months for complex, multi-location groups.
Do not wait after a major change. Review risks when the practice adds a location, replaces core software, installs imaging technology, adopts AI, changes remote access, brings on a vendor, experiences an incident, or changes ownership. Add each new system to the asset and data inventories.
Turn the Findings Into a Practical Improvement Plan
An assessment should finish with decisions, owners, deadlines, and evidence. Document the affected asset, threat, current safeguard, likelihood, impact, action, owner, target date, and status.
At JSI Datacom, we connect technical findings to dental operations. We verify backups and recovery expectations, secure communication, patch supported systems, and plan upgrades for older technology. Then we build a phased roadmap around the practice’s priorities and budget.
That approach fits the way Greensboro and the Triad-area dental teams work. Whether a practice serves patients near Friendly Center in Greensboro, operates an office in High Point, or manages locations toward Winston-Salem, it cannot casually take imaging, schedules, or patient records offline. Security must protect the practice without disrupting the chairs that need to stay full.
A HIPAA security risk assessment only creates value when the practice acts on it. If you want a clear view of your current technology risks and a practical place to start, contact JSI Datacom for a complimentary IT assessment. We will help you identify priorities, understand recovery needs, and build a security plan that supports patient care.
Joe Joplin, Founder & President
With 27 years of experience in IT and cybersecurity, Joe Joplin specializes in helping dental practices and small businesses safeguard patient data, meet HIPAA requirements, and reduce cyber risk through proactive, practical security strategies.
