Imaging software dictates what you can patch, the front desk is a shared-login habit waiting to fail an audit, and a day of lost charting is not recoverable.
A dental practice is a small business with a hospital's data obligations and a factory's uptime sensitivity. Three to six operatories, eight to twenty staff, no IT person, and a practice management system that the entire day runs through.
That combination is genuinely awkward. The obligations are those of a healthcare provider, so the compliance bar is real. The budget is that of a small business. And the tolerance for downtime is low, because a patient in a chair is a cost accruing in real time.
Where IT touches the day
Mapping it this way is worth doing with your own practice, because it reorders priorities. Most practices, asked what matters most, name the imaging system. In terms of what actually stops the day, scheduling and check-in usually come first, and in terms of what is unrecoverable, charting does.
The three things that are specific to you
Imaging software dictates the operating system
Sensor manufacturers and imaging suites certify against specific operating system versions and are frequently slow to certify new ones. The result is chairside workstations that cannot be patched on a normal schedule without risking the vendor saying the configuration is unsupported.
This is real and it is not an excuse to leave them unpatched indefinitely. The workable position is the one used in manufacturing: separate the estate. Front office machines patch normally. Chairside workstations patch on the vendor's certified cadence, and in exchange they get compensating controls: no general internet browsing, restricted accounts, network segmentation away from the front office, and monitoring.
Write down which compensating control covers which unpatchable machine. That document is what you show an auditor, and it is also the honest answer to whether you are exposed.
The shared front desk login
Almost every practice has one, for understandable reasons. The front desk is busy, three people use the same machine during a shift, and individual logins feel like friction at exactly the moment nobody has time for friction.
It is also the control failure that defeats everything downstream. Your practice management system's audit log becomes useless, because every action was performed by "Front Desk". You cannot answer who accessed a record. And a departing staff member's access cannot be removed without changing a password four people know.
The fix is less painful than it looks: individual accounts with fast user switching, short PINs backed by a card or biometric where the software supports it, and screen locks with a sensible timeout. Done well, it costs a couple of seconds per switch.
A day of charting is unrecoverable
Most systems can be rebuilt from a backup with some data loss and some inconvenience. Clinical notes cannot be reconstructed from memory at the end of a day of patients.
So the recovery point objective for the practice management database is meaningfully different from everything else in the practice. In practice that means more frequent backups of that specific database, and a restore you have actually performed rather than a backup job showing green.
Ask your software vendor two questions: how do I obtain an independent copy of my data, and if I call you with a corrupted database on a Tuesday morning, what happens and how long does it take? The answers vary enormously between vendors and are rarely what practices assume.
The practical list
The first group is a day of work and it addresses most of the real risk. The one that gets deferred most often is the business associate agreements, because it is paperwork rather than technology, and it is also one of the first five things requested in any investigation.
Vendor remote access
Your imaging vendor, your practice management vendor and possibly your equipment suppliers all want remote access, and most practices end up with two or three permanently installed remote access tools, each with a standing account.
Each of those is a route into your network that you do not control and cannot see. The better arrangement: access is enabled when requested, by you, and disabled afterwards, with a log of when and who. Most vendors will accept this if asked, and the ones who push back are telling you something about how they operate.
While you are at it, check what the remote tools can reach. A support tool installed on the front desk machine that can see the whole network is a bigger exposure than one scoped to the application.
What to ask a provider
"Have you supported this practice management system before?" Generic IT skill covers eighty percent of the work. The remaining twenty, meaning the database quirks, the upgrade process, the way the imaging bridge breaks, is learned on somebody's practice. Preferably not yours.
"What is your response time during clinic hours, and is it in the contract?" Nine-to-five is fine if you work nine-to-five. Early starts and Saturday clinics need to be explicit.
"How do you handle the imaging workstations?" The right answer involves vendor certification and segmentation. The wrong answer is that everything gets patched the same way.
"Will you sign a business associate agreement, and what does it say about your own staff's access?" They will sign. The second half of the question is the one worth hearing the answer to.
A realistic first ninety days
Month one: individual logins at the front desk, MFA on email and anything remotely accessible, and a tested restore of the practice management database. Month two: encryption on laptops and backup media, screen locks, and the business associate agreement set completed. Month three: segment the chairside workstations, replace standing vendor access with a brokered process, and write the one-page plan for the day the imaging server dies.
That is three months of part-time effort for a practice manager working with a competent provider, and it closes most of what an investigation or an insurer would find.
