- New England's Only Dental-Specific IT Provider
- (207) 333-2206
How to Complete a HIPAA Risk Assessment for a Dental Office
-
Ezra Angelo
- • March 26, 2026
A HIPAA Security Risk Assessment is not optional and is not a one-time task. HIPAA requires every dental practice to conduct one annually and update it whenever significant changes occur to systems, staff, or vendors. It is the first document OCR requests during any HIPAA audit or investigation, and a practice that cannot produce a current one has no compliance defense regardless of how secure its actual systems are.
Here is how the process works, who is responsible for each part, and what your practice needs to do with the results.
Missing or outdated Security Risk Assessments are the most common HIPAA finding in dental practices and the most common trigger for corrective action plans.
A dental practice that cannot produce a current, documented Security Risk Assessment during an OCR investigation has no compliance defense regardless of how secure its actual systems are. The assessment must exist, be current, and be available for review. Secure systems without documentation is still a HIPAA violation.
What a HIPAA Security Risk Assessment Covers
A HIPAA Security Risk Assessment identifies every threat to the confidentiality, integrity, and availability of electronic protected health information in your practice across three domains.
Who has physical access to patient data and how is it secured
- Who has physical access to servers and workstations
- Whether devices are locked when unattended
- Whether the server room is physically secured
- How storage areas containing patient data are controlled
Whether systems are configured to protect patient data
- Whether workstations are encrypted
- Whether MFA is enabled on all accounts with patient data access
- Whether backups are running and verified
- Whether the network is segmented to prevent unauthorized access
- Whether software patches are current
Whether policies, training, and agreements are documented
- Whether HIPAA policies are written and distributed
- Whether all staff have completed HIPAA training with documented records
- Whether Business Associate Agreements are signed with all vendors handling patient data
Who Completes What
The technical assessment
- Encryption status on all workstations and servers
- MFA configuration across all accounts with patient data access
- Backup verification and recovery testing
- Network security and segmentation review
- Access controls and user permission audit
- Patch management status across all systems
- Audit logging configuration and review
The administrative and physical assessment
- Staff training records and HIPAA training completion documentation
- Written HIPAA policies and distribution records
- Physical security of workstations and storage areas
- Vendor BAA status for all vendors handling patient data
- Designated HIPAA Privacy Officer documentation
Both components are combined into a single documented Security Risk Assessment that identifies findings, assigns risk levels, and outlines remediation steps for each gap. Neither component alone satisfies the HIPAA requirement. Both must exist, be current, and reference the same assessment period.
Is Your Practice HIPAA Risk Assessment Ready?
Check every item your practice currently has in place. Unchecked items are gaps that OCR would identify during an investigation. Every gap needs a remediation plan before your next audit.
A completed, documented Security Risk Assessment exists from the past 12 months
This is the first document OCR requests. Without it there is no compliance defense, regardless of how secure your actual systems are.
All workstations and servers are encrypted
Unencrypted devices containing patient data are a direct HIPAA Security Rule violation. Your IT provider must confirm and document encryption status on every machine.
Multi-factor authentication is enabled on all accounts with patient data access
MFA is a required access control under the HIPAA Security Rule. This includes practice management software, email, and any cloud platforms that store or access PHI.
All staff have documented, up-to-date HIPAA training on file
Undocumented training is treated the same as no training during an OCR investigation. Training records must be current and retrievable on request.
Signed Business Associate Agreements are on file for every vendor that handles patient data
Missing BAAs are a standalone HIPAA violation. This includes your PMS vendor, imaging software, patient communication platform, IT provider, and any cloud storage used for patient records.
Data backups are tested and verified on a documented schedule
Untested backups do not satisfy HIPAA Security Rule data backup and recovery requirements. Backup verification must be documented, not assumed.
How Often the Assessment Must Be Updated
Annually at minimum. HIPAA requires the Security Risk Assessment to be reviewed and updated at minimum once per year.
Adding new locations. Each new location introduces new physical, technical, and administrative risks that must be assessed.
Changing practice management software. A new PMS changes how patient data is stored, accessed, and transmitted.
Onboarding a new vendor that handles patient data. Every new vendor with PHI access requires a BAA and a risk profile update.
Significant staff changes. Role changes, departures of key personnel with PHI access, or new hires in administrative roles.
Any security incident. A breach, ransomware event, or unauthorized access triggers a mandatory reassessment.
What to Do With the Findings
1
Assign a risk level to each finding
Each identified gap must be rated High, Medium, or Low based on the likelihood and impact of a breach. OCR expects risk levels, not just a list of issues.
2
Create a remediation plan for each gap
Each finding needs a documented remediation plan. The fix does not have to happen immediately. It must be planned, documented, and tracked.
3
Assign a responsible party to each item
Every remediation item needs an owner. OCR does not expect perfection. They expect good-faith documentation of identified risks and a plan to address them.
Treating the risk assessment as a one-time project. A dental practice that completed a thorough assessment in 2022 and has not updated it since is non-compliant in 2026 regardless of how thorough the original assessment was. The assessment must be current, not just complete.
Frequently Asked Questions
Ekim IT Solutions works exclusively with dental practices. We serve New England and New York with on-site support and dental practices nationwide with remote support. We complete the technical portions of HIPAA Security Risk Assessments for dental practices and provide the documentation your practice needs to demonstrate compliance when it counts.
-
- • March 26, 2026
