Dental practices should perform a HIPAA Security Risk Analysis regularly and revisit it when significant changes affect technology, security, or electronic protected health information (ePHI).
Rather than treating the assessment as something completed once and filed away, dental practices with 10-40 employees should make security risk analysis part of an ongoing HIPAA risk-management process.
Use this four-step framework:
Identify → Assess → Correct → Review
1. Identify Where Patient Information Lives
Start by identifying the systems that create, receive, maintain, or transmit ePHI.
For a dental practice, that could include:
- Dentrix, Open Dental, or Eaglesoft
- Dexis and imaging systems
- Servers and workstations
- Microsoft 365 and email
- Cloud applications
- Backup systems
- Laptops and mobile devices
- Remote-access systems
Don't forget third-party vendors that may have access to patient information or systems containing it.
You can't properly evaluate risk if you don't know where the information resides.
2. Assess the Risks and Safeguards
Next, evaluate potential risks to the confidentiality, integrity, and availability of electronic patient information.
Review areas such as:
- User accounts
- Multi-factor authentication
- Password practices
- Endpoint security
- Firewalls
- Remote access
- Software updates
- Backups
- Email security
- Employee access
- Vendor access
The goal isn't simply to create a checklist.
It's to understand:
What could go wrong, how serious would it be, and what safeguards are already in place?
3. Correct Identified Weaknesses
Finding a security weakness is only part of the process.
The practice should determine how identified risks will be addressed.
For example:
Risk: Former employees still have active accounts.
Action: Disable unnecessary accounts and improve the offboarding process.
Or:
Risk: Backups exist but recovery hasn't been tested.
Action: Perform a restore test and document the results.
Prioritize higher-risk issues rather than trying to correct everything at once.
4. Review the Analysis as Your Practice Changes
Your technology environment doesn't stay the same.
Review your risk analysis when significant changes occur, such as:
- Opening another location
- Installing a new server
- Moving systems to the cloud
- Adding major dental technology
- Changing IT providers
- Introducing remote access
- Adding new vendors
- Experiencing a security incident
- Making significant workflow changes
A risk analysis that no longer reflects the current environment has limited value.
The 7-Question HIPAA Security Risk Check
Ask:
- Do we know where our ePHI is stored?
- Do we know who can access it?
- Have we identified potential security risks?
- Have we documented existing safeguards?
- Do we have a plan for addressing identified risks?
- Are corrective actions being documented?
- Have major technology changes occurred since our last review?
If several answers are unclear, your risk analysis may need attention.
A Security Risk Analysis Is Not the Same as an IT Assessment
An IT assessment can identify important technical issues, but a HIPAA Security Risk Analysis is broader.
Technology is only one part of the picture.
A dental practice must also consider administrative processes, employee behavior, policies, physical safeguards, vendors, and other areas affecting protected information.
Your IT provider can help evaluate the technical environment, but technology support alone should not be treated as complete HIPAA compliance.
Why Dental Practices Choose IT Services of Utah
IT Services of Utah has supported businesses for more than 30 years and works with dental practices throughout St. George and Washington County, Utah.
We can help evaluate technical safeguards involving:
- User accounts and MFA
- Microsoft 365
- Endpoint security
- Networks and firewalls
- Remote access
- Backups
- Security monitoring
- Patch management
- Vendor access
Our team provides fast remote support, local on-site assistance, live phone answering, and a cybersecurity-first approach to dental IT.
Frequently Asked Questions
Does HIPAA require a dental practice to perform a security risk analysis?
Dental practices subject to the HIPAA Security Rule need to evaluate risks and vulnerabilities affecting electronic protected health information. The analysis should accurately reflect the practice's current environment.
Is a once-a-year review enough?
A regular review cycle can be useful, but practices should also reassess risks when significant technology, operational, vendor, or security changes occur.
Can our IT provider perform the entire HIPAA Security Risk Analysis?
An IT provider can play an important role in evaluating technical systems and safeguards. However, a complete risk analysis extends beyond IT and should consider the broader environment in which ePHI is handled.
When Was Your Last Security Risk Review?
Don't let your HIPAA risk analysis become an outdated document sitting in a folder.
Remember:
Identify. Assess. Correct. Review.
For dental practices with 10-40 employees in St. George and Washington County, Utah, IT Services of Utah can help assess the technology and cybersecurity controls that should be considered as part of your broader HIPAA risk-management process.
Schedule a Dental IT & Cybersecurity Assessment with IT Services of Utah to identify technical risks and prioritize your next steps.
