Dental · 6 min read
The HIPAA Security Risk Assessment: What Every Dental Practice Needs to Know
It is required, it is the first thing investigators ask for, and most practices are overdue. Here is what a useful risk assessment actually covers.
IT for dentists, orthodontists & oral surgeons
Your chairs stay full. Your patient data stays protected.
HIPAA-minded IT support for North Bay dental practices — from imaging workstations and practice management software to backups, email security, and the risk analysis your practice is required to have.
- General dentists
- Orthodontists
- Oral surgeons
- Multi-location groups
Safeguard check
Monitored- Security Rule safeguardsHIPAAAddressed
- Business Associate AgreementsBAAAddressed
- California's Confidentiality of Medical Information ActCMIAAddressed
- California breach notificationCiv. Code 1798.82Addressed
Problems we solve
Sound familiar? Here's how we fix it.
Imaging that stalls mid-appointment
The problem: Sensors drop, pano and CBCT images load slowly, and the operatory computer freezes with a patient in the chair.
How we fix it: We right-size operatory workstations, segment imaging traffic on your network, and coordinate directly with your imaging and software vendors so issues get solved instead of bounced between support lines.
Practice management software downtime
The problem: When Dentrix, Eaglesoft, Open Dental, Dolphin, or your surgical software goes down, check-in, charting, and billing stop with it.
How we fix it: We monitor the server and database that run your practice software, patch on a schedule that respects your clinical hours, and keep a tested restore plan so downtime is measured in minutes.
HIPAA paperwork nobody has time for
The problem: The HIPAA Security Rule requires a documented risk analysis, but most practices have an outdated binder — or nothing at all.
How we fix it: We walk your office through a practical security risk assessment, fix what we find, and give you documentation you can actually hand to an auditor or cyber insurance carrier.
Ransomware aimed at healthcare
The problem: Healthcare is one of the most targeted industries. One clicked email can encrypt your charts and x-rays.
How we fix it: Layered email filtering, endpoint protection, multi-factor sign-in, and encrypted off-site backups that are isolated from your network so an attack cannot reach them.
Free AI site scan for dental
Is your practice website leaking patient data to ad platforms?
Meta and Google pixels on appointment request and new-patient forms are the HIPAA tracking pattern HHS OCR warns about. Enter your website to see what loads on those pages, plus security and ADA gaps that draw demand letters.
- Pixels on appointment and intake pages
- ADA/WCAG issues behind Unruh Act claims
- HTTPS, HSTS, and security headers
- CCPA/CPRA privacy links
We only read publicly available pages, the same way a browser does. The scan sends public page data to an AI model to write your report. Results are not stored. See our Privacy Policy.
Security & compliance
The rules you're held to — built into your IT.
Federal requirements and California law shape what "reasonable security" means for dental. We design safeguards around them and document what we do.
- HIPAASecurity Rule safeguards
- Administrative, physical, and technical safeguards for electronic protected health information (ePHI) — access controls, audit logs, encryption, and a documented risk analysis.
- BAABusiness Associate Agreements
- Vendors that touch ePHI need a signed BAA. We help you inventory them — email, backup, cloud fax, and software vendors — and we sign one with you too.
- CMIACalifornia's Confidentiality of Medical Information Act
- California layers its own medical privacy law (Civil Code § 56 et seq.) on top of HIPAA. We build safeguards with both in mind.
- Civ. Code 1798.82California breach notification
- California requires notice to affected residents when unencrypted personal information is breached. Encryption at rest and in transit dramatically reduces that exposure.
M&R Systems provides IT and security services, not legal advice. Consult your attorney or compliance advisor for guidance on your specific obligations.
Find the gaps before an auditor, attacker, or demand letter does.
Run a free scan of your website now, or talk to a local technician about your whole environment.
Why M&R Systems
Built around the schedule, not the help desk queue
A dental office runs on a tight schedule. A 15-minute imaging outage is not a ticket — it is a rescheduled patient, an idle hygienist, and a lost production hour. That is why we plan maintenance around your clinical day and keep the most important systems monitored around the clock.
Orthodontic offices live in their imaging and treatment-planning software. Oral surgery practices add sedation records, surgical guides, and referral workflows from general dentists. Multi-location groups need consistent configurations across every office. We tailor support to the kind of practice you run.
And because patient records are some of the most sensitive data a small business can hold, every recommendation we make starts with a simple question: does this keep protected health information safe, and can you prove it?
What's included
Operatory & imaging workstations
Sensor, intraoral camera, pano, and CBCT workstation setup and support.
Practice software support
Server, database, and update management for your practice management platform.
HIPAA risk assessment
A practical, documented review of where ePHI lives and how it is protected.
Encrypted backup & recovery
Local and off-site backups, tested restores, and a written recovery plan.
Secure email & e-fax
Encrypted messaging options and filtering that stops phishing before staff see it.
Front desk & phones
Reliable Wi-Fi, guest network separation, printers, scanners, and card terminals.
FAQ
Dental IT questions, answered
Do you sign a Business Associate Agreement (BAA)?
Yes. Because our technicians may come into contact with ePHI while supporting your systems, we sign a BAA with every healthcare client before work begins.
Which dental software do you support?
We regularly support offices running common practice management, imaging, and orthodontic platforms such as Dentrix, Eaglesoft, Open Dental, and Dolphin. We work alongside your software vendor rather than replacing their support, handling the servers, workstations, network, and backups the software depends on.
What is a HIPAA security risk assessment and do we really need one?
The HIPAA Security Rule requires covered entities — including dental practices — to conduct an accurate and thorough assessment of risks to ePHI and to address what's found. It is also one of the first documents requested after a breach or complaint. We help you complete it, remediate the gaps, and update it as your practice changes.
Can you help us move to cloud-based practice software?
Yes. We evaluate whether a cloud platform fits your workflow and imaging needs, plan the data migration with your vendor, and make sure your internet connection and backup plan are ready before cutover.
What happens if ransomware hits our office?
Our backups are encrypted and stored off-site, isolated from your network. We isolate affected machines, restore from a clean backup, and help you document the incident — important because HIPAA and California law may require notifying patients.
Do you support orthodontic and oral surgery practices specifically?
Yes. Ortho offices rely heavily on imaging and treatment-planning software and patient-facing tablets; oral surgery practices add CBCT, surgical planning, and referral workflows. We plan support around those specialty systems.
Will you work after hours so we do not lose chair time?
Yes. Updates, migrations, and hardware swaps are scheduled outside clinical hours whenever possible so your schedule is not disrupted.
Still have questions? Start with a free scan.
See your security, ADA, HIPAA, and California privacy results in about a minute. No sign-up required.
Insights
Guides for dental teams
Practical, plain-English reading on the security and technology issues you deal with every day.
Dental · 5 min read
Ransomware and Dental Imaging: Protecting X-Rays, CBCT, and Charts
Imaging files are large, irreplaceable, and exactly what attackers want to encrypt. Here is how to make sure you can always get them back.
Dental · 4 min read
An IT Checklist for Orthodontic and Oral Surgery Practices
Specialty practices have specialty systems. Use this checklist to find the gaps before they cost you chair time.
Free assessment · No pressure
Get a free dental IT & HIPAA check-up
Tell us about your practice and we will review your imaging, backups, and HIPAA safeguards — and give you a straightforward list of what to fix first.
- Local, family-owned team
- Plain-English report
- No cost, no obligation
Rather call?(415) 497-4137