Cybersecurity Insurance Is Only the Beginning: Is Your Dental Practice Prepared?
By Kelli Strand Ngariki, Healthcare Compliance Associates, and Joe Hood, Black Talon Security
Imagine arriving at your dental office at 8:15 a.m. and discovering you cannot access patient records. A message demands payment to unlock your systems. Patients are arriving, the schedule is full, and no one knows whom to call.
Could your practice keep operating? Would your team know what to do?
Cyber insurance can help with certain financial losses, but it cannot restore a patient's confidence or replace a prepared team. Real readiness combines insurance, strong technical defenses, and practical compliance procedures that employees understand. The practice owner, office manager, HIPAA security officer, and technology team need to know their responsibilities—and how those responsibilities fit together.
Why Insurance Matters—but Isn't Enough
Delta Dental of Oregon has advised that participating providers or affiliates serving members of the Oregon Educators Benefit Board (OEBB) or Public Employees Benefit Board (PEBB) must carry Network Security and Privacy Liability insurance with a combined limit of at least $500,000 per claim or incident. The requirements took effect in October 2024 for OEBB and January 2025 for PEBB. Practices should confirm their obligations with the applicable payer and insurance adviser.
Ask what your policy actually covers. Are incident investigations, patient notifications, data restoration, legal services, and business interruption included? What exclusions, security conditions, deductibles, and reporting deadlines apply?
Insurance is a financial safety net—not a cybersecurity plan.
The Threats Are Closer Than You Think
A phishing email can look like a message from a laboratory, insurer, or trusted colleague. A stolen password may open the door to billing systems or protected patient information. Ransomware can lock records and disrupt care. Even a breach involving a scheduling or imaging vendor can affect your office.
Preventing every attempt is unrealistic. Recognizing problems early and responding effectively is achievable.
Put Your HIPAA Security Plan to Work
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered dental practices to conduct and document an accurate, thorough security risk analysis of electronic protected health information. This means examining where information is stored, accessed, and transmitted—and what might compromise it. A technical vulnerability scan provides useful information, but it does not replace a complete HIPAA security risk analysis.
Next, turn findings into action. Prioritize risks, assign responsibilities and deadlines, document corrective actions, and revisit your analysis when technology, vendors, or workflows change.
Your employees also need clear reporting instructions. If someone clicks a suspicious link, loses a device, or sends patient information to the wrong person, who should they tell immediately? Your written incident-response process should identify who investigates, who contacts technical and insurance professionals, and who evaluates possible HIPAA breach-notification obligations. Document incidents and outcomes; not every security incident is a reportable breach.
Prepare for downtime, too. If patient records or scheduling systems become unavailable, staff should know how to maintain essential operations while protecting patient information.
Build Technical Protection You Can Verify
Your information technology (IT) provider keeps systems running, but cybersecurity requires its own expertise, tools, and accountability. Like dentistry, technology has specialties. Whether this expertise comes from your IT provider or a separate security partner, make sure responsibilities are clearly assigned.
Employees are a critical line of defense. Criminals use artificial intelligence (AI) to produce convincing phishing messages. Ongoing awareness training, effective email protection, and easy reporting procedures help staff recognize suspicious activity.
Technical safeguards should work in layers. Multi-factor authentication (MFA) adds another verification step beyond a password. Endpoint detection and response (EDR) helps detect and respond to suspicious activity on devices. Immutable backups preserve copies that cannot be changed during a defined period, making recovery more reliable when properly maintained and tested.
Connected printers, imaging equipment, firewalls, and other devices can also have weaknesses. Ask your provider about vulnerability scanning, timely fixes, and understandable reports showing what risks were found and addressed. Think of scanning as checking the doors and windows before someone else finds them open.
There's a big difference between being told your practice is protected and being able to verify it.
5 Things Every Dental Practice Should Do Now
- Review your insurance. Confirm applicable requirements, coverage limits, exclusions, and reporting instructions.
- Update your HIPAA risk analysis. Track findings, responsible people, deadlines, and corrective actions.
- Train your team. Make suspicious-email reporting and incident-response responsibilities clear, and practice what to do during downtime.
- Verify technical safeguards. Discuss MFA, EDR, vulnerability management, protected backups, and restoration testing with your cybersecurity professional.
- Review access and vendors. Remove unused accounts, verify who can access patient information, and confirm required business associate agreements are in place.
Preparation Protects More Than Data
A stronger practice connects technical cybersecurity, HIPAA compliance, employee training, and appropriate insurance. These are not separate projects; they are parts of one system that supports patient care and business continuity.
Cybersecurity insurance is a valuable tool. Readiness is the system behind it.
Written by Kelli Strand Ngariki, Healthcare Compliance Associates and Joe Hood, Black Talon Security.
