IT Support for Dental Practices That Keeps the Chairs Moving

Imaging and practice software that has to talk. X-ray sensors, imaging software and your practice management system need to connect reliably in every operatory.

Older equipment computers. Some imaging gear is tied to older computers that are hard to update and easy to forget.

A small team wearing many hats. Your office manager probably handles the IT on top of everything else.

Ransomware and phishing. Dental offices hold the same patient data as medical practices, and criminals know it.

HIPAA paperwork. Risk analyses, vendor agreements and policies pile up, and it’s hard to know what’s current.

We keep the operatories connected. Ongoing care for computers, network and the systems your imaging relies on, with a real person to call.

We look after the forgotten computers. We help you find and protect the older machines attached to equipment.

We back it up and test it. Patient records and images backed up so you can actually restore them.

We help protect patient information. MFA, access controls and encryption.

We help with the technical side of HIPAA. We’ll help you document how your systems are protected and support your risk analysis.

This section is a plain English overview to help you understand what the rules ask for. It isn’t legal advice. For questions about what applies to your practice, talk with your attorney. Our role is to help you meet these requirements on the technology side and document the work. The responsibility for your program stays with your practice, and we don’t promise or guarantee compliance.

HIPAA (Health Insurance Portability and Accountability Act)

HIPAA is enforced by the HHS (U.S. Department of Health and Human Services) Office for Civil Rights. Three parts matter most for your technology.

• The Security Rule. HHS says it sets national standards to protect electronic protected health information (ePHI) that a covered entity or its business associate creates, receives, uses or keeps. It requires administrative, physical and technical safeguards. It’s found at 45 CFR Part 160 and Subparts A and C of Part 164.
• A risk analysis. The Security Rule expects you to look honestly at where patient information lives and what could go wrong. HHS and the ONC (Office of the National Coordinator for Health IT) offer a free Security Risk Assessment Tool built for small and medium-sized practices.
• Breach notification. After a breach of unsecured protected health information, you must notify affected patients without unreasonable delay and no later than 60 days after discovery. A breach affecting 500 or more people also must be reported to HHS within 60 days, and one affecting more than 500 residents of a state requires notice to prominent media there. Smaller breaches can be reported to HHS once a year. HHS says information that has been properly encrypted isn’t “unsecured,” which is one big reason encryption matters.
• Business associates. Outside companies that handle patient information for you, like your IT provider, are business associates, and HIPAA expects a written business associate agreement with them.

HHS also published a proposed update to the Security Rule on January 6, 2025. It was released as a proposed rule, so check the HHS website for its current status.

New Jersey’s data breach law (N.J.S.A. 56:8-161 to 56:8-166)

New Jersey’s Identity Theft Prevention Act covers any business that does business in New Jersey, and any public entity, that keeps computerized records with personal information. If there’s a breach of New Jersey residents’ personal information, you have to tell the affected people in the most expedient time possible and without unreasonable delay. Before you tell them, the law says you must report the breach to the New Jersey State Police. The State Police and the NJCCIC (New Jersey Cybersecurity and Communications Integration Cell) provide an online form for that report. If you decide misuse of the information isn’t reasonably possible, the law says to document that decision in writing and keep it for five years.