Cyber insurance
Cyber Insurance and HIPAA Security Checklist for Gilbert Dental Offices
By Austin Thompson · Founder, Valley CISO · Published · 7 min read
Valley CISO is not an insurance agency, broker, or law firm. This is general information, not legal advice. Ask a healthcare attorney about your practice's obligations.
Short answer
A Gilbert dental office that sends insurance claims electronically is generally a HIPAA covered entity, so two sets of expectations apply. Cyber insurance carriers commonly want MFA, EDR, offline or immutable restore-tested backups, patching, email security, staff training, and an incident response plan. The HIPAA Security Rule requires a documented risk analysis and risk management plan, a backup and contingency plan, workforce training, incident procedures, and business associate agreements (BAAs) with vendors that handle patient data. If there is a breach, the HIPAA Breach Notification Rule applies (individual notice no later than 60 days after discovery), and Arizona's own breach law, A.R.S. 18-552, does not.
On this page
- Is a dental office a HIPAA covered entity?
- What does the HIPAA Security Rule require of a dental practice?
- The checklist: what carriers and HIPAA both look for
- What happens if a dental office has a breach?
- Is the HIPAA Security Rule changing?
- Why are dental offices a target?
- How can a small dental practice get started?
- How does Valley CISO help?
For the general carrier checklist, see our hub guide, Cyber Insurance Requirements for Small Businesses in Arizona.
Is a dental office a HIPAA covered entity?#
Usually, yes. HHS lists dentists as health care providers that are covered entities "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as electronic claims (HHS: Covered Entities and Business Associates). Vendors that handle patient data for you, including IT support, are business associates and need a BAA.
What does the HIPAA Security Rule require of a dental practice?#
The current Security Rule, 45 CFR 164.308, lists several items as Required (eCFR 164.308):
- Risk analysis: "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of electronic PHI (ePHI).
- Risk management: security measures that reduce those risks to a reasonable and appropriate level.
- Information system activity review: regular review of audit logs and access reports.
- A named security official.
- Security incident procedures: identify, respond to, mitigate, and document incidents.
- Contingency plan: a data backup plan, a disaster recovery plan, and an emergency-mode operation plan.
- Written BAAs with business associates that handle ePHI.
Policies and required documentation must be kept for 6 years from creation or last effective date (eCFR 164.316). Encryption is currently an "addressable" specification. That doesn't make it optional: you must assess it and either implement it or document why not and use an equivalent measure. HHS notes that encryption "is built into most software today" (Federal Register, 90 FR 898).
The free Security Risk Assessment Tool from ONC and OCR is built for small and medium practices.
The checklist: what carriers and HIPAA both look for#
| Control | What carriers and HIPAA expect | Proof to keep on file |
|---|---|---|
| Risk analysis | A current, practice-wide assessment of where ePHI lives (practice-management software, imaging, email, backups) and the risks to it, plus a plan to fix what it finds | The dated risk analysis and risk management plan |
| MFA | Enforced on email, remote access, the practice-management system, and admin accounts | MFA enforcement settings and a list of any exceptions |
| EDR | Endpoint detection and response on every front-desk PC, operatory workstation, and server | Device inventory matched to the EDR console |
| Backups | Encrypted, offline or immutable, and restore-tested. HIPAA also requires a disaster recovery plan | A dated restore-test record and the backup job history |
| Encryption | Full-disk encryption on laptops and workstations, encrypted backups, and encrypted email or a portal for sending records | Encryption status report and your documented encryption decision |
| Patching | Critical updates applied within a set window, including imaging and sensor PCs where the vendor allows it | Patch-compliance report and any vendor exceptions in writing |
| Email security | Filtering plus SPF, DKIM, and DMARC on the practice domain | Published DNS records |
| Training | Security awareness training for all staff, including dentists and part-time staff | Completion records by person |
| Incident response and breach procedure | A written plan covering who decides, who calls the carrier's hotline, and how the HIPAA breach risk assessment is done | The plan and notes from a tabletop exercise |
| BAAs and vendors | A signed BAA with every vendor that touches ePHI (IT, cloud software, backup, email) | A vendor list with BAA dates |
| Access and offboarding | Unique logins, no shared front-desk passwords, and access removed the day someone leaves | User list and offboarding checklist |
These line up with HHS's 405(d) HICP Technical Volume 1 (2023 edition), which gives small health care organizations 10 practices against five top threats, including social engineering, ransomware, and loss or theft of equipment or data. The ADA's own tips likewise urge full-disk encryption and backups with "an encrypted copy off-site" (ADA News).
What happens if a dental office has a breach?#
Under the HIPAA Breach Notification Rule:
- An impermissible use or disclosure of PHI is presumed to be a breach unless a four-factor risk assessment shows a low probability that the PHI was compromised.
- Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery.
- 500 or more people: notify HHS at the same time as individuals. If more than 500 residents of a state are affected, notify prominent media outlets too.
- Fewer than 500: keep a log and report to HHS within 60 days after the end of the calendar year.
- Business associates must notify you no later than 60 days after they discover a breach.
Per HHS's ransomware fact sheet, ransomware encrypting ePHI is presumed a breach unless that test is met. Notice is required only for unsecured PHI, and HHS's breach guidance says encryption that meets its standard relieves you of notification.
Arizona note: A.R.S. 18-552 states, "This article does not apply to" a "covered entity or business associates as defined under regulations implementing the health insurance portability and accountability act of 1996" (A.R.S. 18-552(N)(2)). A HIPAA-covered dental practice follows the federal rule instead of the 45-day Arizona rule in our hub article. Confirm with your attorney how this applies to your practice.
Is the HIPAA Security Rule changing?#
Possibly, but not yet. HHS published a proposed rule on January 6, 2025 (90 FR 898). It would, among other things, expressly require encryption of ePHI with limited exceptions and make technology asset inventories explicit. The federal regulatory agenda now lists it as a Long-Term Action with final action estimated for July 2027 (Reginfo.gov, RIN 0945-AA22). That date is an estimate and the text could change. For now, the existing Security Rule applies.
Why are dental offices a target?#
- In March 2026, HHS OCR announced a settlement with MMG Fusion, a software company focused on "helping oral healthcare professionals" market and manage their practices. OCR found the potentially impermissible disclosure of PHI of about 15 million individuals, no accurate and thorough risk analysis, and failure to notify affected covered entities. It was OCR's 12th enforcement action in its Risk Analysis Initiative (HHS press release; resolution agreement).
- In HHS's 2016–2017 audits, only 14% of covered entities were "substantially fulfilling" their risk analysis duties (90 FR 898).
- The FBI's 2025 Internet Crime Report says IC3 received more than 3,600 ransomware complaints in 2025, and that the top 10 reported variants most affected Critical Manufacturing, Healthcare and Public Health, and Government Facilities.
How can a small dental practice get started?#
- Map your ePHI and confirm a BAA with every vendor that holds it.
- Run the risk analysis and write the risk management plan.
- Close the big gaps first: MFA, EDR, encryption, and a restore-tested offline or immutable backup.
- Write it down and keep it for 6 years.
How does Valley CISO help?#
Valley CISO is a small practice in Gilbert, Arizona, with US-based staff in Arizona and California. We serve Gilbert, AZ, and Santa Ynez, Solvang, and Buellton, CA, during Arizona business hours (7 AM–5 PM).
- We sign a BAA first. We don't take administrative access to any system that may hold PHI until a Business Associate Agreement is signed and a scoped work order names the systems we may touch.
- Managed IT + Cyber Insurance Readiness, $250/month. The $200/month help desk plus tracked evidence for MFA, backups and restore tests, EDR, training, and email authentication, a written questionnaire answer sheet, and an incident response plan kept current. See pricing.
- Cyber insurance questionnaire working session, $145 (60 minutes, one-time), to go through your carrier's form line by line. See cyber insurance help.
- On-site in Gilbert, $175 per visit when hardware needs hands-on work. See IT help in Gilbert, AZ.
We document technical controls and evidence. We don't perform legal HIPAA compliance determinations, sell policies, or decide coverage; your attorney, broker, and carrier do. Email athompson@valleyciso.com.
Frequently asked questions
Is my dental office covered by HIPAA?
Generally, yes, if it transmits health information electronically in connection with a standard transaction, such as electronic insurance claims. HHS lists dentists among covered providers on that condition. Confirm your status with a healthcare attorney.
Does Arizona's 45-day breach law apply to dental offices?
A.R.S. 18-552 says it does not apply to HIPAA covered entities or business associates. A HIPAA-covered dental practice follows the HIPAA Breach Notification Rule instead, which requires individual notice no later than 60 days after discovery.
Is a HIPAA risk analysis required?
Yes. The Security Rule lists risk analysis as a required implementation specification: an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of ePHI. HHS OCR has an enforcement initiative focused on it.
Is ransomware a HIPAA breach?
HHS says that when ransomware encrypts ePHI, a breach is presumed unless the practice can show a low probability that the PHI was compromised using the four-factor risk assessment. Data already encrypted to HHS's standard is treated differently.
Is the new HIPAA Security Rule in effect?
No. HHS proposed changes in January 2025, and the federal regulatory agenda lists final action as a long-term item estimated for July 2027. The current Security Rule still applies.
Does Valley CISO sign a BAA?
Yes. Valley CISO signs a Business Associate Agreement before taking administrative access to any system that may hold PHI. A scoped work order names the systems covered.
Can Valley CISO tell me whether I'm HIPAA compliant?
No. We implement and document technical controls and evidence. HIPAA compliance determinations are legal questions for your attorney, and coverage decisions belong to your broker and carrier.
About the author
Founder, Valley CISO
Austin Thompson is the founder of Valley CISO in Gilbert, AZ. A U.S. Coast Guard veteran (2016–2024), he has more than four years of experience in threat hunting and security operations center (SOC) work. Austin holds an M.S. in Cybersecurity and Information Assurance from Western Governors University (WGU, 2025) and a B.S. in Information Technology from the University of Phoenix. His certifications include CompTIA SecurityX (CASP+), CySA+, and PenTest+, and ISC2 Certified in Cybersecurity (CC).
Want a second set of eyes on your setup?
Run the free external security scan, or take the 60-second fit check. Questions by email: athompson@valleyciso.com.