Dental Practices
Charts, Images and the Schedule, Restorable on the Worst Day.
Without the practice management system there is no schedule, no chart and no ledger. Without imaging there is no diagnosis. We back up both, keep an encrypted copy off-site, and prove it restores. Capital Cyber, based in Leesburg, Virginia, provides Backup and Ransomware Recovery for dental practices and works on-site across Northern Virginia.
For dental practices and DSOs that cannot see a patient without their records and images.
Backup and Ransomware Recovery for Dental Practices
What Does a Dental Practice Have to Back Up?
The practice management database, where the schedule, charts, treatment plans and ledger live. The imaging store, where radiographs and scans are kept. The Microsoft 365 mailboxes and shared files the front desk works from. Each is backed up daily as a baseline, encrypted and stored off-site, so a failed server, a fire or ransomware on the office network does not take the copy with it.
Does HIPAA Require a Backup and Recovery Plan?
Yes. The Security Rule's contingency plan standard lists a data backup plan, a disaster recovery plan and an emergency mode operation plan as required implementation specifications, with testing and revision of those plans and an applications and data criticality analysis as addressable ones (45 CFR 164.308(a)(7)). A data backup plan means retrievable exact copies of electronic protected health information.
We run the technical side of that plan: the backups, the restores and the testing. The written plan and its fit to your practice are confirmed with your compliance advisor or our Compliance Division.
How Do You Know the Images and Charts Will Actually Restore?
We test them. Restores are tested and recovery procedures validated, so the first restore of an imaging folder is not during an emergency. Backup health is part of daily monitoring, and a failed or stalled job raises a ticket to our team.
What Happens if Ransomware Encrypts the Practice?
Ransomware protection sits in front of the backups: endpoint detection and response, application allow-listing, patching and staff training make an infection less likely to start or spread. Radiant Dental, a single-doctor practice, runs ransomware protection and application allow-listing, as published in its case study. If an attack happens anyway, the incident response plan tells everyone what to do, we contain it, and we restore from a clean copy.
Ransomware can also be a breach question. Under the Breach Notification Rule, an impermissible access to protected health information is presumed to be a breach unless a risk assessment shows a low probability it was compromised (45 CFR 164.402). That call belongs with your counsel, and the incident record we keep helps them make it.
What Is Included
6 PARTSOff-Site Encrypted Backups
Practice management data and images encrypted and stored away from the office.
Cloud Mailbox and File Backup
Microsoft 365 mail and files included in the backup plan.
Tested Restores
Restores tested and recovery procedures validated before you need them.
Backup Monitoring
Every failed job raises a ticket to our team.
Ransomware Protection
EDR, allow-listing and patching in front of the backups.
Incident Response Plan
A written plan, so the first hour of an incident is not improvised.
Frequently Asked Questions
4 QUESTIONSAre dental x-rays and imaging included in the backup?
Yes. The imaging store is one of the systems a practice cannot run without, so it is part of the backup plan alongside the practice management database and Microsoft 365.
Does HIPAA require dental practices to back up patient data?
The HIPAA Security Rule lists a data backup plan, a disaster recovery plan and an emergency mode operation plan as required parts of the contingency plan standard (45 CFR 164.308(a)(7)). Confirm how they apply to your practice with your compliance advisor.
Is an external drive in the office enough?
Usually not. A drive that stays plugged into the network can be encrypted by ransomware along with everything else, and few are ever test restored. An off-site, encrypted copy that is tested is the standard to aim for.
Is a ransomware attack a HIPAA breach?
It may be. Under the Breach Notification Rule an impermissible access to protected health information is presumed to be a breach unless a risk assessment shows a low probability of compromise (45 CFR 164.402). Confirm with your counsel; the incident record we keep supports that assessment.
More for Dental Practices
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Dental Practices
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Dental Practices
Managed IT, managed security and HIPAA compliance management for dental practices and DSOs.
Talk Through Your Practice's Backups.
Pick a time. Tell us where your charts and images live today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.