Most cybersecurity advice aimed at healthcare is written for hospitals. It assumes a security team, a SIEM, and a budget. A six-operatory practice with one part-time IT vendor needs a different conversation: which attacks actually reach an office this size, in what order, and which controls stop the most of them per dollar.
The honest answer is that the list is short. Criminals attacking small healthcare businesses are running volume operations. They are not picking you. They are spraying, and you are on the list. That is good news, because volume attacks are stopped by unglamorous controls applied consistently.
This piece is the threat list and the countermeasures. It builds on the HIPAA Security Rule material in Chapter 6: Compliance. Ransomware gets its own treatment in the ransomware guide, and what to do after something goes wrong is in HIPAA breach response.
Key takeaways
- Email is the front door. The FBI's 2025 Internet Crime Report logged 191,561 phishing and spoofing complaints and 24,768 business email compromise complaints with over $3 billion in reported losses.
- Multifactor authentication on email, remote access, and the practice management system stops a large share of the credential attacks that start these incidents.
- Your biggest uncontrolled risk is usually a vendor: the IT company's remote management tool, the imaging vendor's support account, or the billing service's login.
- The current HIPAA Security Rule requires a risk analysis, workforce security, access controls, audit controls, and a tested contingency plan. A January 2025 proposed rule would make many now-addressable specifications mandatory, including MFA, encryption, and asset inventories. It was not final as of September 2026.
- Cyber insurance applications now ask specific technical questions. Answering them carelessly is a coverage problem, not a paperwork problem.
Threat 1: phishing and credential harvesting
The volume attack. A message that looks like Microsoft 365, your bank, a dental supplier, or an e-fax service asks someone to sign in. The page is a convincing copy. The credentials go to the attacker, who signs into the real mailbox, sets up a hidden forwarding rule, and reads everything for weeks.
Why dental offices are soft targets: shared front-desk logins, staff who handle dozens of legitimate vendor emails a day, and mailboxes full of insurance correspondence that contains PHI.
What actually stops it
- MFA on email, for everyone, no exceptions. An authenticator app or a hardware key, not SMS if you can avoid it. Attackers who harvest a password and cannot complete the second factor move on.
- Block or limit legacy authentication protocols that bypass MFA. Ask your IT vendor to confirm this in writing.
- Alert on new mail forwarding rules. This single detection catches most mailbox compromises weeks earlier than anything else.
- Email authentication. SPF, DKIM, and a DMARC policy on your domain make it harder for anyone to spoof your practice to your patients and your lab.
- Short, frequent training with simulated phishing, not a once-a-year slide deck. Track who clicks, coach rather than punish, and make reporting a suspicious message a normal, praised act.
A compromised mailbox is usually a reportable event. If insurance correspondence, referral letters, or patient emails sat in a mailbox an attacker controlled, you have an impermissible disclosure to analyze under the four-factor test. Mailbox audit logging needs to be on before that happens, or you will not be able to show what was and was not accessed.
Threat 2: business email compromise and payment fraud
Different goal, same entry point. Once inside a mailbox, or simply by spoofing a lookalike domain, the attacker sends a payment instruction. Three patterns show up in dental practices:
- Vendor invoice redirect. An email appearing to come from your equipment dealer, contractor, or lab says banking details have changed. The next wire goes to the attacker.
- Owner impersonation. A message that looks like it is from the doctor asks the office manager to send a payment or buy gift cards, usually framed as urgent and confidential.
- Payroll diversion. An email from a "staff member" asks HR or the bookkeeper to change direct deposit details before the next run.
These are the highest-dollar incidents in the FBI data, and they are not technically sophisticated. They depend entirely on a person changing a payment destination based on an email.
What actually stops it
- A written callback rule: any change to banking details, for any vendor or employee, is verified by phone to a number already on file, never a number in the email. No exceptions for urgency, and no exceptions for the owner.
- Dual authorization for wires and ACH above a threshold you set. Your bank can enforce this.
- External-sender banners on inbound email so a lookalike domain is visibly outside.
- Positive pay or ACH debit blocks at the bank, which are cheap and catch check and ACH fraud that has nothing to do with email.
- Separation of duties between who approves an invoice and who releases the payment. This also happens to be the core internal control against embezzlement, covered in financial management for practice owners.
Threat 3: reused and weak credentials
Staff reuse passwords. When an unrelated website is breached, those username and password pairs get sold and replayed against everything: your email tenant, your remote access, your practice management cloud login, your bank.
The dental-specific version is worse than average. It is still common to find one shared "frontdesk" login used by four people, a practice management password that has not changed since the previous owner, and admin accounts for the imaging software that nobody can attribute to a person.
What actually stops it
- Unique named accounts. Every person gets their own login to every system. Shared accounts destroy your audit trail, which is a Security Rule problem as well as a practical one.
- A password manager for the practice, so unique long passwords are realistic instead of theoretical.
- Separate admin accounts. Nobody does daily clinical work from an account with administrator rights.
- Same-day offboarding. Termination checklist includes practice management, email, imaging, cloud portals, remote access, the alarm and door codes, the phone system, and any vendor portal. Set a hard rule: access ends before the conversation ends. See When It Isn't Working.
- Quarterly user access review. Print the user list from each system and confirm every name is a current employee with an appropriate role.
Threat 4: vendor and remote access compromise
This is the threat most owners underestimate. Your practice is reachable through several doors you do not control:
| Door | Typical risk | What to require |
|---|---|---|
| IT vendor's remote monitoring and management (RMM) tool | Full administrative control of every workstation and the server. A compromise at the IT company reaches all of its clients at once | MFA on the RMM console, named technician accounts, alerting when a session starts, and a written statement of who can connect |
| Remote desktop exposed to the internet | Brute-forced or replayed credentials; a very common ransomware entry point | Never expose RDP directly. Use a VPN or a broker with MFA in front of it |
| Imaging, CAD/CAM, or scanner vendor support accounts | Standing local admin accounts with shared or default passwords | Inventory them, disable when unused, change defaults, require scheduled access |
| Outsourced billing or insurance verification service | Direct logins into your practice management system, often with broad rights | Named accounts, least-privilege security groups, audit log review, a signed BAA |
| Patient communication and forms platforms | A copy of your patient data in someone else's cloud | BAA, review of their security documentation, deletion terms at end of contract |
| Backup provider | Backups reachable with the same credentials as production | Separate credentials, MFA, and immutable or offline copies |
Maintain a vendor register listing every company that touches your systems or your data, whether a business associate agreement is signed, what access they hold, and who at your office owns the relationship. Review it annually. When you replace a vendor, confirm in writing that their access was removed and their copy of your data was deleted.
A BAA is not a security control. It is a contract that allocates responsibility. It does not stop an attack, and it does not relieve you of your own Security Rule obligations. Sign it, and then ask the practical questions: do you use MFA, do you run background checks, how do your technicians authenticate, where is our data stored, and what happens when we leave.
Threat 5: the physical and the mundane
Not every incident involves an attacker. The recurring ones:
- Stolen or lost laptops, phones, and USB drives. Solved by full-disk encryption, which converts a potential mass notification into a police report and an internal memo.
- Old computers sold or donated with the drive intact. Wipe to a documented standard or physically destroy the drive, and keep the certificate.
- Screens facing the waiting room, and workstations left logged in. Set automatic screen locks and reposition monitors.
- Backup drives left plugged in at the office, which is the same as having no backup once ransomware runs.
- End-of-life operating systems on the one machine running the old panoramic unit's software. It happens in almost every practice. Segment it, do not leave it on the flat network. See dental office IT setup.
- Paper. Charts in a hallway, printouts in the trash, a fax machine in a public corridor. HIPAA covers paper too.
What HIPAA already requires of you
The Security Rule (45 CFR Part 164, Subpart C) is not optional and does not scale away because you are small. Its core obligations map cleanly onto the threats above.
| Security Rule area | What it means in a dental office |
|---|---|
| Risk analysis and risk management | A written, accurate inventory of where ePHI lives and what could go wrong, plus a plan with owners and dates. OCR's enforcement actions cite the absence of this more than anything else |
| Assigned security responsibility | A named security official. A real person, in writing |
| Workforce security and information access management | Role-based access, authorization on hire, termination procedures |
| Security awareness and training | Ongoing training including malware, login monitoring, and password management |
| Security incident procedures | A written plan for identifying, responding to, and documenting incidents |
| Contingency plan | Data backup plan, disaster recovery plan, emergency mode operation plan, and periodic testing |
| Audit controls | Logging in systems that contain ePHI, and someone actually reviewing it |
| Encryption and decryption, transmission security | Addressable under the current rule, which means implement it or document why an equivalent alternative is reasonable. In practice, encrypt |
| Business associate contracts | Signed BAAs with every vendor that touches PHI |
The pending Security Rule update
HHS published a Notice of Proposed Rulemaking on December 27, 2024 (published in the Federal Register January 6, 2025) that would substantially tighten the Security Rule. Key proposals include removing the distinction between "required" and "addressable" implementation specifications so that nearly everything becomes mandatory; a maintained technology asset inventory and network map updated at least annually; mandatory multifactor authentication with narrow exceptions; encryption of ePHI at rest and in transit; network segmentation; vulnerability scanning at least every six months and penetration testing at least annually; written incident response procedures with restoration of critical systems within 72 hours; annual compliance audits; and annual written verification from business associates that required technical safeguards are deployed.
As of September 2026 the proposal had not been finalized, and the current rule still governs. Two practical conclusions: build to the rule that exists today, and treat the proposal as a preview of where the floor is heading. Every item on that list is defensible practice regardless of what the final rule says. Check the HHS Security Rule NPRM page for current status.
Free tools worth using. HHS and ONC publish a Security Risk Assessment Tool built for small and medium providers. HHS also publishes the voluntary Healthcare and Public Health Cybersecurity Performance Goals, with nine essential goals (mitigate known vulnerabilities, email security, MFA, basic training, strong encryption, revoke credentials for departing workforce members, basic incident planning, unique credentials, and separate user and privileged accounts) and nine enhanced goals. The essential nine are a reasonable definition of "done" for a small practice.
Cyber insurance, without the jargon
A cyber policy is not a substitute for controls, and increasingly it is not available without them. What to understand before you renew:
- First-party coverage pays your costs: forensics, breach counsel, notification and credit monitoring, data restoration, business interruption, and sometimes extortion payments. This is the part a dental practice actually uses.
- Third-party coverage pays claims made against you: patient lawsuits, regulatory defense, and fines and penalties where insurable by law.
- Sublimits are the fine print. A $1 million policy can carry a far smaller sublimit for ransom payments, regulatory defense, or business interruption. Read the schedule, not the headline number.
- Waiting periods and coinsurance apply to business interruption. A 12-hour waiting period on a practice that loses three days of production matters.
- Panel vendors. Most policies require you to use the carrier's approved forensics and legal vendors. Calling your own people first can void reimbursement, which is why the carrier hotline goes near the top of your incident response sheet.
- Application warranties. Applications now ask whether you use MFA, whether backups are offline or immutable, and whether you have endpoint detection and response. Those answers are representations. Getting one wrong, even honestly, creates a rescission argument at claim time. Have your IT provider confirm each answer in writing before you sign.
- Check your other policies. Your general liability policy almost certainly excludes cyber, and your malpractice policy may include a small breach-response sublimit that is nowhere near sufficient. See malpractice insurance for dentists for how those coverages interact.
The realistic 90-day plan
- MFA on email, remote access, practice management, banking, and the backup console
- Unique named accounts everywhere; eliminate shared logins
- Written callback verification rule for any change to payment details
- Alerting on new mailbox forwarding rules; mailbox audit logging on
- Full-disk encryption on every laptop, workstation, and mobile device
- One offline or immutable backup copy, with a documented restore test
- Vendor register with access levels and signed BAAs
- RDP not exposed to the internet; RMM access documented and MFA protected
- Documented offboarding checklist executed the same day
- Written, dated security risk analysis and risk management plan
- Quarterly user access review across all systems
- Short security training every quarter, with simulated phishing
Getting started without an IT department
If you do all of this at once you will do none of it. Take the list in order of leverage: MFA everywhere first, then unique accounts and offboarding, then the payment callback rule, then backups you have actually restored from, then the written risk analysis that documents what you did. That sequence removes the majority of realistic exposure in a quarter, and it costs far less than one day of downtime.
Then hold your IT vendor to a written scope: what they monitor, what they patch, how fast they respond, who at their company can access your systems, and what they will produce if you are investigated. A support contract that does not say those things is a handshake.
Continue with ransomware prevention, backups, and recovery, the HIPAA security checklist, and dental office IT setup for the underlying network design.
This article is educational and is not legal or insurance advice. Requirements are summarized from HHS and federal sources as of September 2026 and can change. Confirm your obligations with a healthcare attorney, your carrier, and your state's privacy and breach notification laws.
Educational content only. It is not legal, financial, tax, or clinical advice. Prices and ranges are approximate and vary by region, condition, and year. Verify current rules with your state dental board and qualified professionals. ChairsideSource is not affiliated with any manufacturer, the ADA, or the DAT.