Ransomware protection for a dental clinic comes down to five habits: keep an offline, tested backup of the patient database and images; turn on multi-factor authentication (MFA) for email and remote access; patch Windows and the imaging software and retire anything the vendor no longer supports; train the front desk to spot phishing and report it; and keep a printed response plan. The checklist is built from official US guidance: the HHS fact sheet “Ransomware and HIPAA”, the CISA #StopRansomware Guide and the HHS 405(d) “Health Industry Cybersecurity Practices” (HICP) volume for small organisations, checked on 29 October 2026. Status: Not tested yet — the steps follow the published guidance; we have not run them on a clinic network. Nothing here is legal advice, and the HIPAA points apply to the United States only.
The checklist at a glance
| Area | Minimum for a small practice | Source |
|---|---|---|
| Backups | Offline, encrypted copy of the practice database and DICOM images; restore tested on a spare machine | HHS fact sheet; CISA guide |
| Accounts | Unique account per person; MFA on email, VPN and remote access; no daily work from admin accounts | HICP Vol. 1; CISA guide |
| Updates | Automatic patching of workstations and the imaging server; end-of-life systems removed | HICP Vol. 1; CISA guide |
| Email and web | Spam and malware filtering, Office macros from email disabled, phishing training with a way to report | HICP Vol. 1; CISA guide |
| Network | No Remote Desktop open to the internet; imaging units and devices in their own segment | CISA guide; HICP Vol. 1 |
| Response plan | Written, printed, rehearsed; isolate first, then triage, report and restore | HHS fact sheet; CISA guide |
| Paperwork | Risk analysis, incident procedures and contingency plan, as the HIPAA Security Rule requires | HHS fact sheet; NIST SP 800-66r2 |
1. Backups that ransomware cannot reach
HHS and CISA both put backups first, because some ransomware deletes or encrypts online backups before it announces itself. The HHS fact sheet says entities should consider keeping backups offline and unavailable from their networks, and that test restorations should be run periodically. CISA’s wording is “maintain offline, encrypted backups of critical data” and test them in a disaster recovery scenario.
For a dental practice that means two things to copy: the practice-management database with the schedule and ledger, and the imaging store. If your images live on a DICOM server such as Orthanc or dcm4chee Archive, the backup must include the index or database as well as the image files. Our DICOM backup guide covers the copy and restore procedure: a nightly job to a device that is not permanently writable from the workstations, plus a rotating encrypted drive kept away from the practice. HICP adds that staff must not back up practice data to personal cloud accounts or home computers.
2. Accounts: one per person, MFA on everything remote
The CISA guide asks for phishing-resistant MFA on all services, with email, VPNs and accounts that reach critical systems first in line, and for unique passwords of at least 15 characters. HICP tells small practices to turn on MFA for email before anyone uses it and warns that older IMAP or POP3 settings may bypass it.
Inside the practice HICP asks for a separate account for every user, no shared front-desk logins, access tailored to each role, and immediate removal of accounts when someone leaves. Administrative accounts belong only to whoever installs software, and that person does normal work from a regular account. Change vendor default passwords on imaging software, routers and the DICOM server during installation, as our Orthanc setup guide describes.
3. Patching and retiring old systems
HICP’s endpoint practice is blunt: configure endpoints to patch automatically, patch third-party applications as soon as possible, and remove end-of-life operating systems and applications because they no longer receive security updates. CISA adds that internet-facing systems and vulnerabilities on the known-exploited list come first.
Dental clinics have a specific problem here: the computer attached to a sensor or CBCT unit is often stuck on an old Windows version because the capture software was never updated. Treat it as untrusted: no internet, no email, its own network segment. Our CBCT workstation requirements article lists what the vendors officially support.
4. Email, web and the people who use them
The HHS fact sheet notes that a workforce member is often the first to notice an attack, and that HIPAA’s training requirement exists partly so staff can detect and report malware. HICP’s email practice for a small organisation: make sure spam and malware filtering is on and updating, avoid consumer email accounts for patient information, and run phishing awareness training with simulations if you can. CISA adds marking external emails, filtering risky attachment types, and disabling macros in Office files received by email. The most useful habit is a blame-free way to report a suspicious email: a receptionist who reports a click within minutes lets you isolate one computer instead of restoring the whole practice.
5. The network: nothing exposed, devices separated
CISA’s guide says not to expose services such as Remote Desktop Protocol on the internet, to disable unused ports and protocols, to require MFA on any VPN, and to disable SMBv1 and block port 445 at the perimeter. HICP’s network practice is to restrict all internet-sourced access into the practice network and to place high-impact assets, including medical devices, in more restricted zones. For a small clinic that means three segments: office workstations, imaging units with the DICOM server, and guest Wi-Fi. A support vendor gets a controlled path with MFA and a named account, not an open RDP port.
6. A response plan you can read when the screens are locked
CISA asks for an incident response plan with a printed, offline copy, approved in writing by whoever runs the organisation, and exercised. HHS expects the HIPAA incident procedures to cover detection, containment, eradication, recovery and review. The CISA checklist is explicit about the order of the first steps:
- Isolate. Disconnect affected machines; if several are hit, take the network offline at the switch. Coordinate by phone or another channel the attacker cannot read.
- Do not power off unless you cannot disconnect. Shutting down destroys evidence.
- Triage. Restore in order of your critical-system list; for a clinic that is usually the schedule and practice database, then imaging.
- Report. CISA, the FBI (including the IC3 portal) and the Secret Service accept reports; HHS recommends the local FBI or Secret Service field office. Tell your cyber insurer and IT provider.
- Restore from the offline backup onto clean systems, in priority order. Reset passwords and close the entry point before reconnecting.
- Review. Record what happened and what to change, and decide whether patient notification is required.
7. The HIPAA paperwork that actually helps
The HHS fact sheet makes four points. The Security Rule already requires the things that stop ransomware: a risk analysis, procedures to guard against malicious software, user training, and access controls. A data backup plan is a required part of the contingency plan, with disaster recovery and periodic testing. The presence of ransomware on a system is a security incident under HIPAA and triggers your incident procedures. And when ePHI is encrypted by ransomware, HHS treats that as an acquisition of the data and therefore a presumed breach, unless the practice can show a low probability of compromise through a documented four-factor risk assessment. NIST SP 800-66 Rev. 2 (February 2024) explains how to implement the Security Rule and maps it to the NIST Cybersecurity Framework.
Limitations
- Not tested yet: we have not run this checklist on a clinic network. It summarises the official guidance named above; read the originals before changing production settings.
- The HHS fact sheet dates from 2016 (reviewed 2021); HIPAA specifics apply to the United States only, and UK, Canadian and European practices have different breach rules.
- Cyber insurance terms, ransom payment decisions and forensic work are out of scope. This is not legal advice.
For the imaging side of a clinic, including free DICOM servers and viewers, see the hub on free dental imaging software.
FAQ
Is a ransomware attack a HIPAA breach?
Per the HHS fact sheet, when ePHI is encrypted by ransomware a breach is presumed, because the data was acquired by an unauthorised party. The practice avoids notification only by documenting a risk assessment that shows a low probability of compromise, using at least the four factors in the Breach Notification Rule.
Does ransomware steal data, or only encrypt it?
Both happen. The HHS fact sheet notes that attackers may deploy ransomware that also destroys or exfiltrates data, and the CISA guide covers data extortion alongside encryption.
Can a dental office back up to the cloud?
HICP says cloud backup is acceptable for a small organisation if a business associate agreement is in place and the data is encrypted before it reaches the vendor. Keep an offline copy as well; a cloud copy that is always connected can be reached by the same attacker.
Where does a small dental practice start with cyber security?
With the first three rows of the table: an offline, tested backup, MFA on email and remote access, and automatic patching with old systems retired.
Last updated: 29 October 2026 · DentIIT editorial team. Licence, version and platform details are checked against each developer's official documentation; none of the tools listed here should be treated as a certified medical device unless its vendor says so.
