HIPAA Security Risk Assessment: A 10-Step Checklist for Small Dental Practices

By Colm FitzGerald · Oct 27, 2026

HHS enforces HIPAA against dental offices of every size. In October 2026, Shen Smiles, a Pennsylvania practice, agreed to pay $140,000 after it failed to give a patient timely access to her records. In December 2022, New Vision Dental in California paid $23,000 after replies to online reviews disclosed patient information. In 2019, Elite Dental Associates in Dallas paid $10,000 over social media disclosures.

These three cases fall under the Privacy Rule. The Security Rule asks for a separate step: a written risk assessment of every system where your patient data lives. This checklist walks a small dental office through that assessment in 10 steps. You need no IT degree to finish it. The steps fit any small office, including a general dentistry practice in Ventura, CA such as Sunset Dental.

What the Security Rule requires

The HIPAA Security Rule requires every dental practice to assess the risk to the electronic patient data you hold. Practices that send insurance claims electronically fall under the rule.

The regulation, 45 C.F.R. § 164.308(a)(1)(ii)(A), calls for an “accurate and thorough assessment” of potential risks and vulnerabilities to electronic protected health information (e-PHI). HHS publishes guidance on the risk analysis with nine elements: scope, data collection, threats and vulnerabilities, current safeguards, likelihood, impact, risk level, documentation, and periodic review.

The rule sets no fixed schedule. Some practices review every year. HHS names triggers for an update: a security incident, a change in ownership, key staff turnover, and new technology. A new practice management system or a move to cloud imaging counts.

The 10-step checklist for a dental office

Work through these steps in order. A two-person practice finishes the first pass in a day or two.

1. Name a security official. The rule requires one (45 C.F.R. § 164.308(a)(2)). In a small office, this is the owner or the office manager. Write the name in your policy.
2. Map where patient data lives. List every system: practice management software, digital x-ray sensors and the imaging server, intraoral cameras, 3D scanners, the patient portal, email, online forms, text tools, voicemail, backup drives, cloud storage, and staff phones. Include your website forms. An appointment form collects a patient’s name, phone number, dental issue, and insurance type. That is patient data.
3. List your vendors. Record each vendor with access to patient data: IT support, cloud backup, billing service, answering service, texting platform, and website form provider. Each needs a signed business associate agreement (§ 164.308(b)).
4. Name the threats. Write down the ones a dental office meets: ransomware, phishing email, a lost laptop or thumb drive, a former employee with a live login, and an unpatched workstation in an operatory.
5. Check your current safeguards. For each system, record who has access, whether each user has a personal login, whether multifactor sign-in is on for email and cloud software, whether laptops and drives are encrypted, and whether updates run.
6. Rate likelihood and impact. Score each threat low, medium, or high for how likely and how damaging. HHS asks for a risk level on each threat and vulnerability pair.
7. Test your backups. The contingency plan requirement covers backup and restoring lost data (§ 164.308(a)(7)). Restore one imaging file and one patient chart this month. Keep one copy offline.
8. Train the team. The rule requires training for all workforce members (§ 164.308(a)(5)). Cover phishing, locked screens, patient details in personal texts, and review replies. Never confirm a patient relationship in a reply to an online review. Train at hire and every year, and log attendance.
9. Control access. Give each person only the access the job needs (§ 164.308(a)(3)-(4)). Remove a departing employee’s accounts the same day. Check the user list every quarter.
10. Write it down and set a review date. Record the date, findings, owner, and fixes. Review after any trigger HHS names, such as an incident, staff turnover, or new technology. Review once a year as well.

What to document for an audit or breach

Keep one written risk analysis, dated and signed by your security official. HHS does not require a format, so a simple table works. Use one row per threat. This example shows four rows from a small dental office.

Store the supporting records beside the table: signed business associate agreements, the training log, backup test results, and a log of every security incident.

Common mistakes in small dental offices

• Staff share one login at the front desk or in the operatories. You lose track of who opened which chart.
• The practice backs up to one drive and never restores a file to test the copy.
• Replies to online reviews confirm a patient visit or name a treatment. This is the pattern in the New Vision Dental case.
• Staff text patient details from personal phones.
• The practice treats the assessment as a one-time project and skips the update after a software change or a staff departure.

Sources

• HHS: Guidance on Risk Analysis
• HHS: Summary of the HIPAA Security Rule
• HHS: Shen Smiles settlement
• HHS: New Vision Dental settlement
• HHS: Elite Dental Associates settlement

This article gives general information and is not legal advice. Ask a HIPAA attorney or compliance specialist about your practice.

About the author: Colm FitzGerald manages the website and online presence for Sunset Dental, a dental practice in Ventura, California.

Sunset Dental online: Facebook · LinkedIn · YouTube