When the HHS Office for Civil Rights investigates a healthcare breach, one of the first documents it asks for is the practice's security risk analysis. For a lot of dental offices, that is where the trouble starts. The risk analysis was never done, was done once years ago and never updated, or was a checklist that did not actually look at the systems holding patient data.
This post explains what a HIPAA risk assessment for a dental office needs to cover, how often it should be done, and where dental practices most often fall short. It is written for practice owners and office managers who know the assessment is required but are not sure whether what they have would hold up.
A Signed Policy Binder Is Not a Risk Analysis
The HIPAA Security Rule requires every covered entity, including every dental practice that bills insurance electronically, to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities" to the electronic protected health information it holds. That requirement has been in the rule since it took effect, and it applies to a two-chair practice the same way it applies to a hospital.
What the rule asks for is an analysis of your actual environment: where patient data lives, what could happen to it, how likely that is, and what the impact would be. A binder of template policies, a vendor's compliance certificate, or a business associate agreement with your IT provider does not meet that requirement on its own. Those documents can support the analysis, but they do not replace it.
Regulators Are Treating Missing Risk Analyses as the Violation
OCR launched its Risk Analysis Initiative in late 2024 to focus enforcement on organizations that skipped or shortchanged this step. By June 2026 it had announced its 14th enforcement action under the initiative, and in April 2026 alone it settled four separate ransomware cases that each involved an inadequate risk analysis.
The pattern in those settlements is consistent. A breach happens, OCR investigates, and the finding is not only that the attack succeeded but that the organization had never identified the risk that allowed it. The corrective action plans that follow typically require a new risk analysis, a risk management plan, and years of monitoring. For a small practice, the time and cost of that process can exceed the cost of doing the assessment properly in the first place.
Where Patient Data Lives in a Dental Office Is the Starting Point
A useful risk assessment starts with an inventory. You cannot evaluate risks to data you have not located, and dental offices tend to have patient information in more places than owners expect:
- The practice management database on a local server or in a cloud platform
- Imaging archives, including CBCT studies stored on servers and acquisition workstations
- Front desk and operatory workstations, including cached files and downloads
- Email, especially attachments sent to specialists, labs, and insurance carriers
- Patient communication, payment, and online scheduling platforms
- Laptops and phones used to check schedules or charts from home
- Backups, both on site and in the cloud
- Remote access tools used by software vendors and IT support
For each location, the assessment should record who has access, how that access is controlled, whether the data is encrypted, and how it is backed up. This inventory is also the foundation for everything else in the assessment, so it is worth getting right.
The Assessment Should Answer Five Specific Questions
Once the inventory is in place, a dental office risk assessment works through the same core questions for each system:
- What threats apply? Ransomware, phishing, stolen laptops, a failed server, a former employee who still has a login, or a vendor whose remote access was never turned off.
- What vulnerabilities exist? Unsupported operating systems, shared logins, missing multi-factor authentication, unencrypted laptops, backups that have never been tested.
- What safeguards are already in place? Firewalls, endpoint protection, encryption, access controls, training, and backup systems, documented as they actually exist rather than as they were meant to be set up.
- How likely is each risk, and how severe would it be? A ransomware attack on the practice management server rates very differently from a lost USB drive with no patient data on it.
- What will you do about each risk, and by when? This is the risk management plan, and it is the part regulators look for when they want to know whether the practice acted on what it found.
The output should be a written document with dates, owners, and decisions. If a risk is accepted rather than fixed, the reasoning should be written down.
Most Dental Practices Fall Short in the Same Four Places
The gaps that show up in dental offices are rarely exotic. They tend to be ordinary shortcuts that build up over time:
- Shared logins. A single front desk login used by three people makes it impossible to show who accessed a patient record, which is one of the things the Security Rule requires you to be able to track.
- Old machines nobody wants to touch. An imaging workstation still running an unsupported operating system because the sensor software has not been updated is a known vulnerability, and it needs to be documented and isolated even if it cannot be replaced yet.
- Vendor access that never closes. Software and equipment vendors often have standing remote access. Each one should have its own credentials, a signed business associate agreement, and access that is enabled only when needed.
- Backups that exist on paper. A backup job that reports success every night is not the same as a backup that has been restored and checked. The assessment should record when a restore was last tested.
None of these are difficult to fix once they are identified. The problem is that without a structured assessment, they usually are not identified until after an incident.
Once Is Not Enough: Update the Assessment Every Year and After Every Major Change
The current Security Rule requires the risk analysis to be reviewed and updated as needed, without setting a fixed schedule. In practice, an annual review is the minimum most compliance advisors recommend, plus an update whenever something significant changes: a new practice management system, a new imaging device, a move to the cloud, a new location, or a security incident.
That expectation may become explicit. In January 2025, HHS proposed an update to the HIPAA Security Rule that would require a written technology asset inventory and network map, a risk analysis reviewed at least every 12 months, and encryption and multi-factor authentication as required rather than addressable safeguards. As of mid-October 2026, the rule has not been finalized. Practices that already maintain an inventory, review their assessment annually, and use encryption and MFA would have little to change if it is adopted.
Free Tools Help, but Someone Still Has to Know the Systems
HHS offers a free Security Risk Assessment Tool designed for small and medium-sized practices, updated to version 3.6 in September 2025. It walks through the required questions and produces a report, and for many dental offices it is a reasonable framework.
The tool's limitation is the same as any questionnaire: the answers are only as accurate as the person filling it out. If the person completing it does not know whether the imaging workstation is encrypted, which vendors have remote access, or whether last month's backup actually restores, the report will look complete while missing the risks that matter. Most practices get the best result by pairing the framework with someone who can check the systems directly.
What a Dental Practice Should Have on File After the Assessment
When the assessment is finished, the practice should be able to produce:
- A current inventory of systems, devices, and locations that hold patient data
- A written risk analysis that rates each identified risk
- A risk management plan with specific actions, owners, and target dates
- Signed business associate agreements for every vendor with access to patient data
- Records of the most recent backup restore test and security awareness training
- The date of the next scheduled review
If an auditor, an insurance carrier, or a breach investigator asks for documentation, this is the set they will want to see. Cyber insurance applications often ask similar questions, so the same work can make renewals easier too.
Getting Help With a Dental HIPAA Risk Assessment
Kota Technology works with dental practices across South Dakota, North Dakota, and the surrounding region, and HIPAA compliance is part of every dental IT services engagement we take on. We assess the systems directly, document what we find, and keep the assessment current as your practice changes. For medical practices and specialty clinics, our healthcare IT services follow the same approach.
If you are not sure whether your last risk assessment would hold up, or you have never had one done, start with our complimentary cybersecurity checkup, schedule a consultation, or call (605) 799-1199.
