Dental practice IT & security checklist
Print or save as PDF 10 min · Printable · Nothing to sign up for
Work through this with your office manager, check items off as you go, and print it for your compliance binder. Your progress is saved in this browser only.
0 of 36 complete
Clear all Start this week Highest impact Multi-factor authentication is on for every email account Including the shared front desk inbox and the doctor’s personal address if it touches practice business. Multi-factor is on for remote access and the practice management system Remote desktop tools, VPN, cloud records, and your clearinghouse portal. We ran a real restore test and timed it Pick a day’s schedule and some X-rays, bring them back from backup, and write down how long it took. Everyone knows who to call if they click something bad Name and phone number posted at every workstation: stop, tell, disconnect, reset. Accounts & passwords Every staff member has their own login No shared logins at operatory chairs or the front desk. The team uses a password manager No passwords on sticky notes or in a spreadsheet. Former employees’ accounts are removed the day they leave Email, records system, payroll, Wi-Fi, door codes, and alarm codes. We know exactly who has administrator access Keep the list short and review it every quarter. Screens lock automatically when left unattended Especially screens facing the waiting room or the hallway. Systems & equipment Automatic updates are on and checked monthly Windows, browsers, practice software, and firewall firmware. Nothing runs on software the vendor no longer supports Check imaging and sensor PCs. They are often the oldest machines in the building. Remote-access tools are not open to the internet Anything a vendor set up years ago should be reviewed or removed. Guest Wi-Fi is separate from the practice network Patients, imaging devices, and staff phones should not share one network. Intake tablets lock automatically And are stored securely after hours. The server or network closet is locked Not doubling as storage space. Backup & recovery At least one backup copy is kept separate from the office network A backup on the same server or network can be locked by the same attack. Restores are tested on a regular schedule “We hope so” is not a recovery plan. We know our target time to be treating patients again Hours, not days. Write it down. Patient images are not sitting on USB drives or personal phones If they are, move them into the records system and delete the copies. Vendors & partners We keep a list of every vendor that holds patient data Billing, IT, software, labs, imaging, clearinghouse, answering service, and marketing. Each of those vendors has a signed Business Associate Agreement Store copies with your HIPAA paperwork. We asked each vendor about multi-factor and breach notification How would they tell you, and how fast? People & training Five-minute security huddles happen monthly One topic each time: fake invoices, phone scams, texting patient details, and so on. We send practice phishing emails Celebrate reports, and coach rather than punish clicks. Payment or banking changes are verified by phone Using a number you already have, never the one in the email. Staff never reply to online reviews with patient details Even confirming someone is a patient is a disclosure. Patient details are not texted from personal phones Use an approved, secure messaging tool. HIPAA paperwork Annual security risk analysis, documented This is usually the first document regulators ask for. Staff training records Who was trained, on what, and when. A written incident and breach response plan Including who decides, who calls the insurer, and who handles notification. A current Notice of Privacy Practices Posted and offered to patients. Patient records requests answered within 30 days Keep a log of each request and when it was fulfilled. An access list and an offboarding checklist Who can see what, and the steps for when someone leaves. AI tools We have a one-page AI policy What is allowed, what needs approval, and what is never allowed. Any AI tool that touches patient data has a signed BAA Note-takers, scribes, and patient-facing chatbots. Add them to the risk analysis. No patient names, charts, or X-rays go into free chatbots And staff do not install AI add-ons on practice computers on their own. Stuck on an item? The full guide explains why each item matters, with real dental cases.
General information, not legal advice. Talk with your HIPAA counsel or compliance advisor about your specific situation.
