- New England's Only Dental-Specific IT Provider
- (207) 333-2206
What Is a HIPAA Security Incident in a Dental Practice
-
Ezra Angelo
- • January 22, 2026
Most dental practices know what a HIPAA breach is. But HIPAA defines a separate category called a security incident. Every practice must have procedures for identifying, responding to, and documenting these incidents. That applies even when no breach occurs.
Most dental teams have never been trained on the difference. Here is what you need to know about security incidents, how they differ from breaches, and what your practice must do when one happens.
HIPAA requires every dental practice to have a documented incident response procedure, whether or not they have ever experienced a breach.
OCR investigations frequently find that practices had no incident response documentation in place. The absence of these procedures is a violation independent of any actual incident.
What a HIPAA Security Incident Is
The HIPAA Security Rule defines a security incident broadly. It covers any attempted or successful unauthorized access to information in a health IT system. Importantly, the definition also includes interference with system operations. The rule casts a wide net on purpose.
A security incident does not require stolen patient data. For instance, a failed login attempt counts. So does a staff member accessing a record they should not have. Similarly, malware detected on a workstation qualifies as an incident, even if nothing was taken.
The Difference Between an Incident and a Breach
Security Incident
Any attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations. Every practice must document and respond to these.
Reportable Breach
A specific subset of incidents where unsecured PHI is acquired, accessed, used, or disclosed in a way the Privacy Rule does not permit. Requires notification to patients, HHS, and in some cases the media.
A HIPAA breach is a specific type of security incident. It occurs when unsecured PHI is acquired, accessed, or disclosed in a way the Privacy Rule does not permit. Not every incident rises to that level.
For example, a failed ransomware attack stopped before encrypting files is an incident but may not be a reportable breach. Likewise, a staff member who opened a phishing email without clicking a link triggers an incident but likely not a breach. The distinction matters because the response requirements differ significantly.
Need incident response documentation and HIPAA technical safeguards in place before something goes wrong? Ekim IT Solutions works exclusively with dental practices.
Schedule a Fit Call →The Four-Factor Breach Assessment
When a security incident involves a potential disclosure of PHI, HIPAA requires a four-factor risk assessment to determine whether the incident constitutes a reportable breach. The four factors are: the nature and extent of the PHI involved, the identity of who accessed or could have accessed it, whether the PHI was actually acquired or viewed, and the extent to which the risk to the PHI has been mitigated.
If this assessment cannot demonstrate a low probability that PHI was compromised, the incident must be treated as a breach and handled accordingly.
Four steps when a security incident occurs
Contain it.
Isolate systems, change passwords, disconnect exposed devices immediately.
Document it.
Record what happened, when, and what was done. HIPAA requires this even if no breach occurred.
Run the four-factor assessment.
Determine if PHI was involved and if the incident is reportable.
Call your IT provider.
They confirm containment, investigate the cause, and close the gap.
Common Security Incidents in Dental Offices
Phishing emails
A staff member receives an email designed to look like a trusted sender and either clicks a link or opens an attachment. Even if no credentials were entered, this is a security incident that must be documented. If credentials were entered on a fake login page, the incident must be assessed as a potential breach.
Ransomware detection
Ransomware detected on a workstation is always a security incident. Depending on whether patient data was encrypted or exfiltrated before the malware was contained, it may also be a reportable breach. Ransomware incidents require immediate containment, documentation, and a thorough forensic investigation.
Unauthorized access by staff
A staff member accessing a patient record they have no treatment relationship with is a security incident. HIPAA requires access controls and audit logging specifically so these incidents can be detected and investigated.
Lost or stolen devices
A lost laptop, phone, or USB drive that contains or could access patient data is a security incident. If the device was not encrypted, it is likely a reportable breach. If the device was encrypted and the data is inaccessible, it may qualify for the safe harbor exception to breach reporting.
Frequently Asked Questions
Ekim IT Solutions works exclusively with dental practices. We serve New England and New York with on-site support and dental practices nationwide with remote support. We help dental practices build and document incident response plans that meet HIPAA requirements so your team is never making it up as they go when something goes wrong.
-
- • January 22, 2026
