- New England's Only Dental-Specific IT Provider
- (207) 333-2206
Can Your Dental Software Vendors Get Your Practice Hacked
-
Ezra Angelo
- • October 21, 2025
Your practice could be doing everything right and still get breached through a vendor with weak security.
Attackers can use a trusted vendor as a door into your systems. This is called a third-party or supply chain attack. It is one of the fastest-growing categories of cybersecurity risk in healthcare, and dental practices are directly in the line of fire.
exposed in 2023
In 2023, nearly 88 million patient records were exposed through vendor and business associate breaches.
That is data that was breached not by attacking practices directly, but by attacking the companies those practices trusted. The practice did nothing wrong. The vendor was the vulnerability.
How a Vendor Breach Reaches Your Practice
Your practice management software, imaging software, billing platform, and IT provider all have some level of access to your systems or your patient data. They need that access to do their job. But that access also means that if they are compromised, the attacker can reach you through them.
An attacker targets a vendor that serves hundreds of dental practices. Rather than attacking each practice individually, they compromise the vendor once and gain access to all the practices connected to that vendor. One attack, hundreds of victims.
Absolute Dental: 1.2 million patients across 50+ locations
Hackers did not attack Absolute Dental directly. They attacked the practice’s managed services provider first, then used that foothold to access Absolute Dental’s systems. The result was a breach affecting over 1.2 million patients across more than 50 locations. The practice did nothing wrong. Their IT vendor was the entry point.
Change Healthcare: The Largest Example
In February 2024, Change Healthcare, the clearinghouse that processes roughly 40 percent of all dental and medical insurance claims in the United States, suffered a ransomware attack. The attacker gained access through a remote login portal that had no multi-factor authentication.
Dental practices across the country could not process insurance claims for weeks. Many reported significant cash flow disruptions while the systems were down.
patient records affected by the breach
cost to the parent company
cash flow disruption reported by many affected practices
Dental practices did nothing wrong. Their vendor was the vulnerability.
Three vendors that can expose your practice
Your IT provider
Remote access to every computer in your office. A compromised IT provider credential gives an attacker the same access your IT team has: every workstation, every server, every file. This is exactly how the Absolute Dental breach occurred.
Your practice management software vendor
Patient records live in or pass through their systems. Your PMS vendor has a database connection to your most sensitive patient data: demographics, health history, social security numbers, and treatment records.
Your insurance clearinghouse
Billing data and patient identifiers flow through their platform. Every insurance claim your practice submits includes protected health information. Change Healthcare processed 40 percent of all US dental claims when it was breached in 2024.
What HIPAA Requires of Your Vendors
Under HIPAA, any vendor who handles your patient data is considered a business associate. You are required to have a signed business associate agreement, or BAA, with every one of them. The BAA obligates the vendor to protect patient data and to notify you of any breach within 60 days.
A BAA is a legal document, not a security guarantee
A vendor can sign a BAA and still have weak passwords, no multi-factor authentication, and outdated software. The agreement transfers some legal responsibility but it does not protect your patients. HIPAA also requires you to assess the security practices of your business associates as part of your own risk analysis. Most dental practices never do this.
How to Evaluate Vendor Security
Four actions every dental practice should take to reduce vendor-related exposure. Check each one your practice has completed.
Frequently Asked Questions
Ekim IT Solutions works exclusively with dental practices. We serve New England and New York with on-site support and dental practices nationwide with remote support. We review your vendor access controls, remote support permissions, and BAA documentation so a third-party breach does not become your practice's problem.
-
- • October 21, 2025
