- New England's Only Dental-Specific IT Provider
- (207) 333-2206
What Happens to a Dental Practice After a Cyberattack
-
Ezra Angelo
- • August 8, 2025
The attack itself is not the worst part. For most dental practices, the worst part is everything that comes after.
When a cyberattack hits a dental office, the immediate disruption gets most of the attention. But the consequences stretch out for weeks, months, and sometimes years. Understanding what the aftermath actually looks like helps practices make better decisions before an attack ever happens.
breach cost
The average healthcare data breach costs $9.77 million in total recovery costs.
That figure covers downtime, forensic investigation, legal fees, patient notification, regulatory fines, and reputational damage. For a small dental practice, even a fraction of this total can be devastating.
The First 72 Hours
The moment a ransomware attack or breach is detected, the practice faces a cascade of immediate decisions. Systems may be locked. Patient records may be inaccessible. Scheduling software may be down. Clinical staff cannot see who is coming in or what procedures are planned.
per day in lost revenue and recovery costs during active downtime for dental practices
average time to restore operations after a ransomware attack. Nearly three weeks of disrupted or halted care
The first decisions matter enormously. Who investigates? Do you pay the ransom? Who do you call? Practices without an incident response plan waste critical hours figuring out their next step while the situation worsens.
The Legal Clock Starts Immediately
HIPAA requires breach notification within 60 days of discovering a breach that affects patient data. That clock starts the moment you become aware of the incident, not when you finish investigating it.
60 days from discovery, not from investigation completion
If more than 500 patients in a state are affected, you must also notify the media. If more than 500 patients total are affected, the breach appears on the HHS Breach Portal, which is publicly searchable. Your practice name, the number of patients affected, and the nature of the breach all become permanent public record.
Westend Dental in Indiana paid a $350,000 settlement after regulators found it had delayed notifying patients of a ransomware attack. The fine was not for the attack. It was for the delayed response.
Four things you must do after a breach
Notify patients within 60 days of discovery
Every affected patient must receive written notification explaining what happened, what was involved, and what they can do to protect themselves.
60-Day DeadlineReport to HHS if 500 or more patients are affected
The breach is reported to the HHS Office for Civil Rights and listed on the public HHS Breach Portal with your practice name and details.
Public RecordAlert media in affected states if 500 or more patients are involved
A breach affecting 500 or more patients in a single state also requires notifying prominent media outlets in that state.
State RequirementCooperate fully with OCR if they investigate
The HHS Office for Civil Rights may open a formal investigation. Full cooperation is required. Obstruction compounds penalties significantly.
MandatoryThe Patient Notification Process
Every affected patient must receive a written notification that explains what happened, what information was involved, what the practice is doing about it, and what the patient can do to protect themselves. This notification typically includes an offer of free credit monitoring.
Chord Specialty Dental Partners
Notified after their 2025 email breach. Notification letters, postage, call center setup, and credit monitoring services for each patient.
Absolute Dental
Over 1.2 million patients notified following their breach. At that scale, notification costs alone run into the tens of millions of dollars.
For a breach affecting thousands of patients, the cost of notification letters, postage, call center setup, and credit monitoring services can run tens of thousands of dollars before any fines, legal fees, or remediation costs are counted.
The OCR Investigation
The HHS Office for Civil Rights investigates breaches affecting 500 or more patients. During an investigation, OCR reviews your security practices, your risk assessment history, your staff training records, your business associate agreements, and your incident response documentation.
If OCR finds gaps, it can impose fines ranging from $145 per violation for unknowing violations up to $2,190,294 per violation for willful neglect. Multiple findings can compound quickly. It is not uncommon for an investigation to uncover multiple separate violations, each carrying its own penalty.
Is Your Practice Ready to Respond?
Class Action Lawsuits
Data breach class action lawsuits against dental practices have become more common. Patients whose information was exposed can join a class action and seek damages. Law firms routinely monitor HHS breach notifications specifically to identify new class action opportunities.
Absolute Dental: regulatory scrutiny and legal exposure at the same time
After the Absolute Dental breach in 2025, multiple law firms announced investigations into the incident within weeks of the breach notification going out. The practice was dealing with OCR scrutiny and class action exposure simultaneously, a combination that significantly compounds response costs and management bandwidth.
Reputational Damage
Patient trust is hard to rebuild after a breach. Your practice name on the HHS Breach Portal is permanent and publicly searchable. Patients searching your practice name will find it.
Breach listing appears in search results for your practice name
Reviews mentioning the breach appear on Google and Yelp
Referrals from other providers and specialists may slow
Patient attrition begins. Soften quietly, over months
The reputational harm is difficult to quantify but real. For single-provider practices especially, where patient relationships are the foundation of the business, a public breach can cause patient attrition that outlasts every other consequence.
Frequently Asked Questions
Ekim IT Solutions works exclusively with dental practices. We serve New England and New York with on-site support and dental practices nationwide with remote support. We build the layered security and backup infrastructure that keeps a cyberattack from becoming a practice-ending event.
-
- • August 8, 2025
