HIPAA Risk Analysis for Texas Dental Practices: A Practical Guide

Dental practices depend on a dense mix of technology: practice-management software, imaging systems, email, workstations, cloud backups, patient portals, payment systems, and vendor remote access. A HIPAA Security Rule risk analysis connects those systems to the electronic protected health information (ePHI) they create, receive, maintain, or transmit.

The requirement is not limited to large organizations. HHS describes risk analysis as the first step in identifying and implementing safeguards that are reasonable and appropriate for a regulated entity. The rule requires an accurate and thorough assessment, but it does not require one specific template or methodology. That flexibility is useful—provided the finished analysis is complete, documented, and tied to risk management.

1. Define the complete scope

Start by identifying every place the practice creates, receives, maintains, or transmits ePHI. HHS guidance says the scope should cover risks to the confidentiality, integrity, and availability of all ePHI—not only information stored in the primary practice-management system.

For a dental practice, the inventory commonly includes:

• Practice-management, EHR, imaging, claims, and e-prescribing platforms.
• Servers, desktop computers, laptops, tablets, mobile devices, printers, and imaging workstations.
• Email, file-sharing, cloud storage, backups, patient portals, online scheduling, and telehealth tools.
• Network equipment, wireless networks, remote-access tools, and connected clinical devices.
• External parties that handle ePHI, including IT providers, billing vendors, cloud services, and document-destruction companies.

Document the owner, location, purpose, data handled, access method, and criticality of each system. If the practice cannot say where its ePHI is, it cannot assess the risks to it.

2. Identify threats and vulnerabilities

A threat is something capable of exploiting or triggering a weakness. A vulnerability is the weakness itself. Pairing them prevents a common mistake: listing generic dangers without showing how they apply to the practice.

Examples include a phishing email targeting a user without multifactor authentication, ransomware reaching an unpatched imaging workstation, a stolen unencrypted laptop, a flood affecting an on-site server, or a former employee whose account remains active. Nontechnical weaknesses count too, such as missing termination procedures, incomplete vendor agreements, informal backup ownership, or policies that no longer match actual operations.

3. Evaluate current safeguards

Record safeguards already in place and verify that they work. Do not accept “we have backups” or “the vendor handles security” as sufficient evidence. Identify where backups are stored, who monitors them, how failures are escalated, and when restoration was last tested. Confirm which systems enforce MFA, which devices are encrypted, and which accounts have administrative privileges.

Evaluate safeguards across the Security Rule’s three broad categories:

• Administrative: assigned security responsibility, workforce access processes, training, incident response, contingency planning, vendor oversight, and periodic evaluation.
• Physical: facility access, workstation placement and use, device inventory, media handling, and secure disposal.
• Technical: access control, unique user identification, audit controls, integrity protections, authentication, and transmission security.

NIST SP 800-66 Revision 2 is a useful companion because it maps HIPAA Security Rule concepts to cybersecurity activities and control references without replacing the regulation.

4. Rank risk using likelihood and impact

For each meaningful threat-and-vulnerability pair, estimate the likelihood that it could occur and the impact if it did. A simple low, moderate, and high scale can work when the definitions are clear and consistently applied.

Impact should consider more than confidentiality. Could the event alter records or imaging files? Could it prevent the practice from treating patients or submitting claims? How many individuals or locations could be affected? What recovery dependencies exist? Record the reasoning behind each rating so the result can be reviewed and defended later.

5. Build a risk-management plan

The value of the analysis is what happens after the findings are ranked. For every risk that requires treatment, assign a corrective action, accountable owner, target date, required resources, and status. If the practice accepts a risk or chooses an alternative safeguard, document the reasoning.

A practical remediation plan might prioritize:

1. Removing unsupported systems and closing exposed remote-access paths.
2. Enforcing MFA for email, remote access, administrative accounts, and critical cloud systems.
3. Encrypting portable devices and protecting encryption keys separately.
4. Separating and testing backups so one incident cannot destroy production data and recovery copies together.
5. Formalizing onboarding, role changes, and immediate access termination.
6. Completing Business Associate Agreements and documenting vendor security responsibilities.

6. Retain evidence, not just a final score

HHS requires the risk analysis to be documented but does not prescribe one format. Keep enough evidence to show how conclusions were reached: asset inventories, interviews, network diagrams, policy reviews, screenshots or configuration exports, scan summaries, risk-register entries, meeting decisions, and remediation records.

The documentation should be understandable to someone who did not perform the original review. A one-page score with no supporting scope, findings, or decisions is difficult to maintain and difficult to defend.

7. Treat risk analysis as an ongoing process

The Security Rule does not set one universal annual deadline for every organization. HHS instead describes risk analysis as an ongoing process that should be updated when changes affect the security of ePHI. Many practices establish a regular review cycle and also reassess after significant events.

Common triggers include acquiring another practice, changing EHR or imaging platforms, opening a location, moving systems to the cloud, adopting a new patient-communication tool, replacing the IT provider, experiencing an incident, or making major workforce and workflow changes.

Dental-practice readiness checklist

• Every system and vendor that handles ePHI is included in the inventory.
• Threats and vulnerabilities cover administrative, physical, and technical conditions.
• Current safeguards have been verified rather than assumed.
• Likelihood and impact ratings use documented definitions.
• High-priority findings have owners, deadlines, and tracked remediation.
• Risk decisions and alternative safeguards are recorded.
• The practice has a recurring review cycle and event-based update triggers.

Related resources

Cybersecurity10-minute read

Ransomware Readiness for Healthcare

Learn More about ransomware readiness for healthcare

Managed IT8-minute read

Secure Healthcare Employee Onboarding

Learn More about secure healthcare employee onboarding and offboarding

HIPAA Compliance10-minute read

HIPAA Incident Response for Dental Practices

Learn More about HIPAA incident response for dental practices