What every dentist needs to know about IT
On October 29 we spoke to the Roanoke Valley Dental Society about protecting patients, the practice, and your reputation. Here are the main points, the real cases we covered, and the 30-day plan we left the room with.
We opened the talk with a show of hands: who has multi-factor authentication turned on for their email? Fewer hands go up than you would expect, and that one setting sits at the center of most of the stories below.
You hold a bank’s worth of data
A dental chart is a complete identity kit: names, birthdates, Social Security numbers, insurance details, payment information, and health records all in one place. Practices also run on a tight schedule, so an hour of downtime means empty chairs and a frozen schedule. Most offices have no full-time IT person. To an attacker, that adds up to a valuable, soft target.
On criminal markets the data is cheap to buy. TrendAI’s 2026 research found a full identity record selling for about $5, and access into an Israeli dental imaging clinic’s network listed for as little as $100 (TrendAI). The largest healthcare breach of 2026 so far came from dentistry: dental insurer DentaQuest reported a May attack affecting 15 million people (HealthExec). Closer to the chair, Absolute Dental’s 2025 breach exposed about 1.22 million patients (Docs Education), and Pecan Tree Dental in Texas reported 13,300 people affected after a group known for ransomware claimed the attack (Becker’s Dental Review, DentalGoodNews). The cost to the practice is far higher than the price of the data. An Indiana dental group paid the state $350,000 after a ransomware attack and late, misleading patient notices (Becker’s Dental Review).
- 23 dental data breaches tracked in 2026 (Becker’s Dental Review)
- 45,853 patients exposed at Hawaii Family Dental through one compromised account
- 32% of healthcare breaches involved a third party (HIPAA Journal)
- $350,000 paid by one dental group after a ransomware attack and late patient notices
A breach costs more than the ransom
When people picture a breach, they picture a ransom note. The bigger costs come afterward:
- Downtime: empty chairs and a frozen schedule.
- Recovery: forensics, rebuilding systems, replacing equipment.
- Legal and regulatory: notification letters, state and federal scrutiny.
- Trust: patients and referral partners remember.
How you respond can cost more than the attack.
The five ways attackers get in
1. Fake emails that look real
An “invoice,” an “insurance update,” or a “shared document.” One click or one password typed into a fake login, and someone is inside the inbox.
Stops it: multi-factor on every email account, email filtering, and staff who pause and report.
2. Stolen or reused passwords
A password leaked from another website gets tried on your email, patient portal, or remote access. No hacking needed, just a login.
Stops it: multi-factor everywhere, a password manager, no shared logins, and removing accounts the day someone leaves.
Real example: Hawaii Family Dental, a 12-office practice, disclosed that an unauthorized person used a compromised account to reach patient information for 45,853 people (Becker’s Dental Review).
3. Out-of-date systems and open doors
An old Windows version on an imaging PC, unpatched software, or a remote-access tool left open to the internet.
Stops it: automatic updates checked monthly, replacing what is no longer supported, and backups kept separate and tested.
Real example: ransomware at Tampa Bay Dental Implants & Periodontics hit the internal server that also held its record backups, affecting 6,400 people (Becker’s Dental Review).
4. Vendors and partners
Your billing company, IT vendor, software provider, or insurer is breached, and your patients’ data goes with it.
Stops it: a signed Business Associate Agreement (BAA) with every vendor, asking about their multi-factor and breach notice, and a list of who holds patient data.
5. Well-meaning people
An email to the wrong patient, a shared login, a chart photo on a personal phone, or a reply to a review that names the patient.
Stops it: simple written do’s and don’ts, short regular training, and a culture where reporting carries no blame.
Real example: a California practice paid $23,000 after responding to online reviews with patient details (HHS Office for Civil Rights).
Anatomy of a ransomware Monday
We walked through how a typical attack plays out. Nothing about it is dramatic until it is too late. This is an illustrative scenario based on common attack patterns.
- Fri 4:45 pm: a staff member opens a “fax” attachment.
- Weekend: attackers quietly copy patient files.
- Mon 7:30 am: the schedule will not open. A ransom note appears.
- Mon 9:00 am: patients arrive. Phones ring. No X-rays.
- Day 3 and on: recovery, forensics, and the notification clock.
The lesson: backup protects your data. Recovery protects your practice. A backup that sits on the same network gets locked up with everything else. A tested recovery copy kept separate can have you treating patients again in hours instead of days.
Your team is your best defense
We spent time on habits rather than tools: pause when a message feels urgent, verify requests by phone using a number you already know, report mistakes without blame, practice with short monthly huddles, and lock screens with unique logins. If someone does click, the order is simple: stop, tell, disconnect, reset. The worst click is the one nobody reports.
Want to test your eye? Our guide includes a sample fake email with the four warning signs marked.
HIPAA does not care how big you are
We heard the usual objections in the room: “We’re a small office,” “our software vendor handles it,” “HIPAA is for hospitals.” Regulators disagree. A Pennsylvania practice paid $140,000 for failing to give a patient their records on time (HHS). Others paid for sharing too much: an Alabama practice paid $62,500 after giving patient information to a political campaign (HHS), and a Dallas practice paid $10,000 for replying to Yelp reviews with patient details (HHS). The first thing an investigator usually asks for is simple:
“Show me your risk analysis.”
Our checklist lists the paperwork you should be able to produce, from Business Associate Agreements to records-request logs.
AI: useful, with guardrails
AI tools can save real time on newsletters, social posts, and plain-language explanations. The rule we shared: anything that sees, hears, or stores patient information needs a signed BAA and a spot in your risk analysis. Patient names, charts, or X-rays should never go into free chatbots, and add-ons that staff install on their own should be off limits. Treat an AI assistant with access to your inbox like a new employee: decide what it can see, and keep a log of what it does.
Your 30-day game plan
- Turn on multi-factor for email, remote access, and your records system
- Give everyone a password manager and end shared logins
- Run a real restore test, and time it
- Patch or replace anything your vendor no longer supports
- Complete or refresh your annual HIPAA risk analysis
- List every vendor with patient data and confirm BAAs
- Start five-minute monthly huddles and test phishing emails
- Write a one-page AI policy and an incident plan
Six questions for your IT provider
Whoever supports your practice, these are fair questions to ask this week: When did we last restore from backup, and how long did it take? Who has administrator access, and is multi-factor on? Which of our systems are out of vendor support? If our office were down for a week, what happens? Do you sign a BAA, and where is our risk analysis? Who watches alerts at 2 a.m. on a Saturday?
Thank you to the Roanoke Valley Dental Society for having us, and to everyone who stayed for questions. If you want the full detail, read the guide or work through the checklist with your office manager.
This post is general information, not legal advice. Talk with your HIPAA counsel about your specific situation.