The server sits under the front desk. The password is on a sticky note. The backup drive is plugged in all the time, which means ransomware will encrypt it along with everything else. This is a normal dental office, and it has never had a problem, yet.
The checklist below is written for the office manager, not the IT company. Every item is something you can verify yourself in an afternoon.
What is the biggest threat right now?
Ransomware. The HHS Office for Civil Rights breach portal shows hacking and IT incidents as the largest category of reported large breaches of health information in recent years, and the Verizon Data Breach Investigations Report (2024) found ransomware or extortion involved in roughly a third of all breaches it studied. Dental offices are attractive because they hold full patient identities, run older Windows machines, and often have remote desktop open so the doctor can check the schedule from home.
The two doors are email attachments and remote access. Close those and most of the risk goes with them.
The checklist
Backups
- A backup runs every night and you have seen the log this week.
- At least one copy is offline or in a separate cloud account that the office computers cannot write to.
- You have restored a file from backup in the last 90 days and it worked. A backup that has never been restored is a hope, not a backup.
- The backup includes the practice database (Open Dental’s MySQL data, Dentrix’s database folder, Eaglesoft’s Sybase database) and the image folders, which are often stored separately.
Access
- One log-in per person in Windows and in the practice software. No shared “FrontDesk” account.
- Workstations lock after five minutes.
- Multi-factor authentication on email and on any remote access.
- Remote desktop is not open to the internet. Access from home goes through a VPN or a remote access service with its own log-in, never a forwarded port.
- Permissions reviewed twice a year. Staff who left are removed the same day.
Machines and software
- Windows updates install automatically and no machine runs a version that is out of support.
- The practice software is on a supported version.
- Antivirus or endpoint protection is on every machine, including the server.
- Nobody browses the web or reads personal email on the server.
- Attachments from unknown senders are not opened. Staff have been shown what a fake EOB or fake invoice email looks like.
- Patient information goes out only through an encrypted channel, not plain email.
Vendors
- Every vendor that touches patient data has signed a Business Associate Agreement: IT company, backup provider, claims clearinghouse, patient communication service, analytics tools. Keep the signed copies in one folder.
- You know whether each vendor’s access is read-only or read-write.
Paper and physical
- The server is in a locked room or cabinet, not under the front desk.
- Printed day sheets and EOBs are shredded, not binned.
- Screens at the front desk cannot be read from the waiting room.
What does HIPAA actually require?
The Security Rule (45 CFR 164.308 to 164.316) requires a risk analysis, administrative, physical and technical safeguards, audit controls, and documentation kept for six years. It does not list products. There is no HIPAA certification; a vendor that claims one is describing a self-assessment or a third-party audit, not a government seal. What you can ask a vendor for is their BAA and a plain description of their controls.
The audit trail page covers the audit controls part, which is the piece most offices have without knowing it.
What Calibic adds
Calibic connects read-only to Open Dental, Dentrix and Eaglesoft. It cannot write, edit or delete a record in the practice software, which limits what an attacker could do with its credentials. It is built for HIPAA, and a Business Associate Agreement is sent with every sign up. Calibic does not hold a SOC 2 report today and we say so. Protect (LIVE) also records user log-ins and log-outs from Open Dental’s securitylog, so a log-in at an unusual hour sits next to the payment and adjustment alerts. The read-only integration page explains what read-only means in practice.
Next step: the Coverage page shows exactly which tables Calibic reads in each system.