South Florida Dental Hurricane IT Checklist: 2026

Plan for combinations. A building can have power but lose its primary internet carrier. Internet can remain available while roof or water damage makes the office inaccessible. A generator can run critical circuits while an unprotected switch, modem, or server is still offline. Staff may be unable to reach the practice even though cloud systems remain healthy. Vendor support queues can become busy across an entire region at the same time.

Map technology to business functions: scheduling, patient communication, chart access, imaging, prescriptions, claims, phones, backups, remote work, security monitoring, and payment processing. For each function, identify the systems and dependencies required to keep it available or recover it. That makes the plan usable when the actual failure does not match a simple 'power outage' scenario.

Confirm recent backup status for critical systems and, more importantly, confirm that the practice knows how those systems would be restored. Verify off-site or appropriately isolated recovery copies, administrator credentials, encryption or recovery keys, vendor contacts, internet-account information, firewall configuration backups, and the list of systems that must return first. Do not wait for a watch or warning to discover that a backup alert has been ignored for weeks.

Update contact lists for leadership, IT, ISP, phone provider, PMS, imaging, cloud services, alarm/security, landlord or facility management, and electrical or generator support as applicable. Store the continuity plan somewhere accessible if the office network is unavailable while still protecting sensitive credentials separately.

Inventory the systems connected to UPS equipment and confirm the UPS batteries are healthy enough to perform their intended role. A UPS is usually designed to bridge short outages, protect against abrupt shutdowns, or allow equipment to stop cleanly; it should not be assumed to run a dental practice through an extended regional outage unless the system was specifically engineered for that purpose.

If the practice has generator support, know which circuits are actually backed up and whether networking, internet equipment, servers, storage, and critical workstations are included. A generator does not protect against failed ISP infrastructure or water damage, so power continuity should be one branch of the plan rather than the entire plan.

Cloud PMS, VoIP, cloud imaging, email, patient communication, payment services, and remote access can make internet continuity clinically important. If the practice has a secondary circuit or cellular failover, test whether the firewall actually changes paths and whether critical services remain usable. Two services that share the same physical last-mile path may not provide as much independence as the billing names suggest.

Document which services degrade during failover and whether bandwidth or latency is sufficient for the workflows that matter most. For multi-location groups, consider whether staff can operate from another office if one site loses connectivity or building access. Continuity is stronger when the workflow has been rehearsed rather than assumed.

There is no universal shutdown time for every practice. Decisions depend on official emergency guidance, building conditions, power quality, evacuation or closure decisions, equipment design, and vendor recommendations. If leadership decides to close and safely shut down systems, use a written sequence so servers, storage, imaging equipment, workstations, and networking are handled according to their supported procedures.

Avoid last-minute improvised unplugging that can corrupt systems or leave backups unfinished. Confirm final data protection, stop applications or databases correctly when required, label any equipment that will be disconnected, protect portable devices, and document what must be powered on first during reopening. Safety and official local instructions take precedence over keeping technology online.

The HIPAA Security Rule requires contingency procedures for emergencies or other occurrences that damage systems containing ePHI, including procedures for obtaining necessary ePHI during an emergency. A hurricane plan should therefore consider how authorized staff can obtain needed information when the normal office, internet connection, or primary system is unavailable.

Emergency access should still be controlled. Define who may initiate it, what alternate systems or procedures are available, how activity is documented, and how access returns to normal after the emergency. Do not create a permanently shared password in the name of disaster readiness; design a controlled process that can be invoked when normal access truly is unavailable.

If staff may work from home during a closure, identify which tasks are actually approved for remote performance and which systems can be accessed securely. Use managed devices and supported remote-access methods where possible, protect accounts with MFA, avoid exposing server or database services directly to the internet, and make sure remote access does not depend on a workstation left powered on in a damaged or inaccessible building unless that is an intentional supported design.

Plan patient communication separately. Staff may need to update voicemail, reschedule appointments, send notifications, or access cloud scheduling without opening the full clinical environment. Define the minimum capabilities needed to communicate safely during closure and test them before a storm.

Do not treat power restoration as proof that technology is healthy. Check the facility for electrical, water, temperature, and physical damage before energizing affected equipment. Bring systems online in a controlled sequence, confirm firewall and internet status, verify servers and storage, review backup and security alerts, and inspect workstations or clinical devices that may have been exposed to unstable power or environmental conditions.

Then validate workflows: PMS access, representative patient records, imaging, scanning, printing, phones, internet, claims, payment systems, backups, and remote/vendor connectivity. If systems were restored from backup or failed over to alternate infrastructure, verify the expected recovery point and document any data that must be reconciled before normal clinical operations resume.

Use every closure, test, or near miss as input. Record what worked, which contacts were outdated, which batteries or circuits failed expectations, whether internet failover behaved correctly, how long remote access took, and whether staff understood their responsibilities. Update the continuity plan, asset list, vendor information, and recovery priorities while the lessons are still fresh.

Also fold findings into the next lifecycle budget. If an old UPS, unsupported server, single-carrier connection, undocumented firewall, or untested backup created avoidable risk, hurricane readiness has identified a concrete technology improvement rather than merely generating another checklist for next year.