The IT side of a HIPAA security risk assessment for dental offices

HIPAA requires a dental practice to assess the risks to the patient data on its computers, and much of that assessment is about IT. This guide walks through the technical questions, what HHS's rules and guidance say, and the free tool HHS offers to help you record the answers.

What HHS asks for

The HIPAA Security Rule lists risk analysis as a required part of every practice’s security program. The wording in 45 CFR 164.308 is an “accurate and thorough assessment” of the risks to the confidentiality, integrity and availability of the electronic patient information you hold. A related requirement, risk management, asks you to put security measures in place that bring those risks down to a reasonable level.

HHS’s guidance on risk analysis says the rule does not prescribe a specific method, and that methods will vary with the size of the organization. It does say what the result must cover: every place electronic patient information is created, received, kept or sent, the threats you can reasonably anticipate, the weak spots those threats could use, and the measures you already have. All of it has to be written down.

The same guidance says how often varies by practice. It names a security incident, a change in ownership, turnover in key staff and plans for new technology as times to look at the risks again.

The technical safeguards, in plain terms

45 CFR 164.312 holds the technical safeguards. This is the part of the assessment your IT person should be able to answer line by line.

• Access control. Each person gets a unique user name, so activity can be traced to them. You need a way to reach patient data in an emergency. Automatic logoff after a period of inactivity and encryption are listed as addressable. In a dental office the usual finding is a shared front desk login or a hygienist logging in as the dentist.
• Audit controls. Hardware, software or procedures that record and examine activity on systems holding patient data. Your practice software and Windows both keep logs. The question is whether anyone looks at them.
• Integrity. Policies to protect patient data from improper changes or destruction, with an addressable item for electronic checks that data has not been altered.
• Person or entity authentication. Procedures to confirm that whoever is signing in is who they claim to be.
• Transmission security. Measures that protect patient data sent over a network, with integrity controls and encryption listed as addressable. Think of emailed X-rays, claims, and remote access to the server.

“Addressable” does not mean optional. HHS’s risk analysis guidance says that if you decide an addressable item is not reasonable for your practice, you must document why and adopt an equivalent measure where that is reasonable.

Backups, patching and the firewall

These sit outside 164.312, but they come up in every assessment. The contingency plan standard in 164.308 requires a data backup plan that keeps retrievable exact copies of patient data, and a disaster recovery plan to restore lost data. Periodic testing of those plans is listed as addressable. In practice, a backup nobody has restored is an assumption, not a plan. Write down when you last restored a file and whether it opened.

The security awareness standard in the same section lists protection from malicious software and password management as addressable items. Missing Windows updates, an unsupported server, or a firewall nobody has logged into for years are the kind of weak spots HHS expects you to identify and document. Note the firewall model, whether its firmware and security subscriptions are current, and which ports are open to the internet.

HHS’s free SRA Tool

The Office of the National Coordinator for Health IT built the Security Risk Assessment (SRA) Tool with the HHS Office for Civil Rights. Its page on HealthIT.gov says the target audience is small and medium providers. The current release is version 3.7, offered as a Windows desktop application and as an Excel workbook with the same content.

• It walks you through multiple-choice questions, threats and vulnerabilities, and an inventory of assets and vendors, then produces reports you can save and print.
• The information you enter stays on your computer. HHS says it does not collect, view, store or send anything entered into the tool.
• Version 3.7 added questions on assessment scope (every location that handles patient data) and on remote access and telework.
• The page’s disclaimer says using the tool is not required and does not guarantee compliance, and that the survey alone may not identify every risk.

For more detail on the safeguards, NIST Special Publication 800-66 Revision 2 (February 2024) is practical guidance on the Security Rule for organizations of all sizes.

What to have ready before you start

• A list of every computer, server, laptop, tablet and imaging device, with its Windows version.
• Every place patient data lives: the practice software database, imaging, scanned documents, email, cloud services and backups.
• Who has a login to each system, including former staff who should not.
• Your backup reports and the date of the last test restore.
• The firewall model, its admin login holder and its last firmware update.
• Every remote access tool installed, and every outside company that can use one.

This guide describes what HHS publishes. It is not legal advice. Confirm your own obligations with your compliance adviser.

Where we come in

We can gather the technical answers for your assessment and fix what it turns up, from user accounts to firewall setup and management. Start with a free on-site assessment.