Proposed HIPAA Security Rule: Dental Practice Guide

HHS issued the notice of proposed rulemaking on December 27, 2024. The proposal would strengthen cybersecurity requirements for covered entities and business associates, including most covered dental practices and organizations that handle electronic protected health information on their behalf.

HHS’s official proposal page states that the current Security Rule remains in effect while the Department undertakes rulemaking. The proposal does not itself create a final compliance deadline. The federal regulatory agenda lists the action as long-term, which reinforces why practices should verify status rather than publish a guessed deadline.

A final rule could change the proposed text, implementation periods, exceptions, and effective dates. Practices should monitor HHS and the Federal Register, and should obtain qualified legal or compliance advice before treating any proposed provision as mandatory.

Many proposed controls address risks dental practices already face: stolen credentials, ransomware, unsupported workstations, weak remote access, untested backups, flat networks, incomplete inventories, inconsistent vendor oversight, and incident plans that exist only on paper.

The current Security Rule already requires a risk analysis, risk management, workforce security, access controls, contingency planning, evaluation, documentation, and other safeguards. Waiting for a final rule does not suspend those current responsibilities or make known risks disappear.

Early preparation can reduce rushed spending. A phased roadmap lets the practice replace unsupported systems during normal lifecycle planning, improve identity and backup controls, document architecture, and coordinate vendors before a regulatory deadline concentrates demand across the health sector.

The proposal would remove much of the current distinction between required and addressable implementation specifications and add more prescriptive cybersecurity requirements. HHS’s fact sheet describes written, reviewed, tested, and regularly updated policies and procedures, along with more detailed expectations for technical and organizational safeguards.

Proposed requirements include a technology asset inventory and network map illustrating the movement of electronic protected health information, more specific risk-analysis documentation, written incident-response and contingency procedures, annual compliance audits, and stronger verification between covered entities and business associates.

The final rule may differ, so practices should use these items as planning signals rather than final checklist language. Build capabilities that improve current security and can be adjusted when HHS publishes final text.

A useful asset inventory covers servers, workstations, laptops, mobile devices, network equipment, phones, printers, scanners, imaging systems, sensors, practice-management software, cloud services, remote-support tools, backup platforms, and accounts that provide administrative access.

A network map should show how ePHI moves between the practice-management system, imaging, operatories, front desk, cloud portals, forms, clearinghouses, communications, remote users, vendors, and backups. It should identify trust boundaries, internet connections, wireless networks, and external services.

These records also improve troubleshooting and recovery. The practice can identify unsupported systems, excessive access, missing backup coverage, undocumented vendor connections, and single points of failure. Keep the inventory current through onboarding, purchasing, change management, and disposal procedures.

The proposal would generally require encryption of ePHI at rest and in transit, with limited exceptions, and would require multifactor authentication in covered environments subject to specified exceptions. That is more prescriptive than the current rule’s addressable encryption specifications.

Practices should inventory where encryption and MFA are available today. Review email, cloud applications, remote access, laptops, servers, backup portals, administrator consoles, software-vendor accounts, mobile devices, and removable media. Confirm recovery methods and enrollment changes, not only the login prompt.

Legacy dental equipment may create constraints. A device may not support modern authentication or encryption, but that does not justify ignoring the risk. Document the limitation, isolate the device where possible, restrict access, monitor it, protect surrounding systems, and create a replacement or compensating-control plan.

The proposal points toward stronger network segmentation and more structured vulnerability management. In a dental office, guest wireless, user workstations, servers, imaging devices, voice systems, management interfaces, backups, and building systems should not automatically have unrestricted access to one another.

Segmentation must respect clinical integrations. Document required ports and data flows, test sensors, scanners, imaging bridges, printers, and vendor support, and monitor blocked traffic. Randomly isolating devices without understanding workflow can create patient-care disruption.

Vulnerability management includes supported software, patching, configuration, scanning, remediation, and documented exceptions. Prioritize internet-exposed systems, remote access, identity platforms, servers, administrator devices, and known exploited vulnerabilities. A scan report with no owner or follow-up is not an operating program.

The proposal would increase specificity around contingency planning, criticality analysis, restoration, testing, and written procedures. Dental practices should already know which systems are essential, how much data loss is tolerable, how quickly each workflow must return, and who authorizes recovery.

Protect more than the practice-management database. Imaging repositories, scanned documents, file shares, cloud data, configuration, phone systems, and specialty applications may be required to operate. Keep at least one recovery copy resistant to changes from the production environment and protect backup accounts separately.

Test the restore path. Recover representative data, open the application, access patients and images, verify permissions, and record timing and issues. Tabletop exercises should also test leadership decisions, communications, vendor coordination, and temporary clinical workflows.

The proposal would strengthen expectations for covered entities and business associates to verify certain technical safeguards and update agreements within specified periods. Final details may change, but dental practices should already maintain a complete vendor inventory and current business associate agreements where required.

Ask vendors how they authenticate administrators, restrict privileged access, log activity, secure remote-support tools, manage subcontractors, encrypt data, protect backups, report incidents, and return data at termination. Request evidence appropriate to the relationship rather than relying solely on a general security statement.

The practice should retain ownership or appropriate control of domains, cloud tenants, backups, firewalls, phone numbers, documentation, and critical accounts. Offboarding procedures should remove access promptly and allow the practice to continue operations without dependence on one technician’s credentials.

First, correct current gaps: complete an accurate risk analysis, inventory systems and vendors, remove unsupported technology from sensitive workflows where feasible, secure privileged access, deploy MFA where supported, improve endpoint monitoring, protect backups, and document incident and recovery procedures.

Second, create a proposal-readiness gap analysis. Compare current capabilities with major proposed themes, label each item as current requirement, proposed requirement, best practice, or business-resilience improvement, and avoid telling staff that every proposed detail is already law.

Third, build a phased budget. Prioritize high-risk access and recovery gaps, then plan segmentation, asset management, encryption expansion, vendor evidence, policy updates, testing, and lifecycle replacements. Track HHS updates and revise the roadmap when final text arrives.

Do not advertise a specific proposed-rule compliance deadline unless HHS has issued a final rule with that deadline. Do not claim that one product makes a practice HIPAA compliant, that encryption eliminates breach duties, or that a signed business associate agreement proves technical security.

Avoid absolute security promises. MFA, endpoint protection, backups, segmentation, and monitoring reduce risk but cannot guarantee prevention. Describe controls accurately, identify their scope, and preserve evidence that they are configured, monitored, tested, and maintained.

Separate legal interpretation from technical planning. IT professionals can inventory systems, implement safeguards, test recovery, and document evidence. Qualified legal and compliance advisers should guide interpretation of final regulatory obligations and organization-specific legal decisions.