Article summaries and takeaways for readers of The Dental IT Brief. Dates are source-article publication dates, rather than evidence of email delivery. Available Spanish summaries link to complete English articles.
On October 21, 2026, PHP released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can enable unauthenticated remote code execution on vulnerable servers. Dental practices with WordPress or other PHP-powered sites should verify the PHP runtime running on their host, not just update the WordPress dashboard.
By Dental IT Team
Key takeaways
The October 21 security fixes were issued as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.2 approaches end of security support on December 31, 2026, making its longer-term upgrade plan especially important. Hosting providers may distribute backported patches, so verify the provider's security advisory and package revision before concluding that an apparently older version is unpatched.
These vulnerabilities are in the PHP runtime, rather than WordPress core. Updating WordPress plugins or themes does not itself install the required PHP runtime fix. Likewise, a web application firewall may reduce some exposure but is not a complete mitigation. Coordinate a vendor-supported PHP update with the hosting provider.
Record the PHP release or vendor patch, host confirmation, date applied, service testing, log review, accountable owner and remaining work. For an unsupported installation, plan a supported PHP migration. If the provider cannot remediate promptly, discuss isolation or temporary suspension of the affected public application rather than relying on an untested workaround.
Resumen en español
Alertas críticas de PHP: qué debe revisar tu web dental
Las actualizaciones de seguridad de PHP requieren revisar el servidor que ejecuta la página dental. Actualizar WordPress no instala automáticamente un parche del motor PHP. La práctica debe confirmar la versión y la revisión aplicada con el proveedor, probar formularios y enlaces de citas, y documentar quién responde si aparecen indicios de compromiso.
Confirma la versión real de PHP y el parche del proveedor.
Coordina las actualizaciones y prueba formularios y citas.
Documenta la revisión y cualquier investigación pendiente.
A staff password is changed, and an overnight job stops. The account may have been used by a connector, scheduled task, or other service that no one included in the change plan. Microsoft distinguishes service-account governance from ordinary user administration and recommends lifecycle ownership and least privilege. A dental practice should know which nonhuman identities support its actual environment before rotating or retiring credentials. This guide is a dependency and change-control workflow, not a universal instruction to change every password on a fixed schedule.
By Dental IT Team
Key takeaways
Assign an accountable owner and document the systems that depend on each nonhuman identity.
Use vendor-supported identity and credential options with only the required privileges.
Test the dependent job and application after a change; a successful login is not complete acceptance.
Resumen en español
Cuentas de servicio dentales: cambia credenciales con control
Las tareas automáticas, conectores y otros servicios pueden depender de identidades que no siguen el flujo de una cuenta de empleado. Microsoft recomienda gobernar su ciclo de vida y aplicar mínimo privilegio. La guía propone documentar dependencias, verificar opciones soportadas por el proveedor y probar el trabajo real después de un cambio. No establece un intervalo universal de rotación.
Asigna responsable, propósito, permisos y dependencias a cada identidad no humana.
Usa opciones de autenticación soportadas y almacenamiento protegido para los secretos.
Valida la tarea o integración y su próxima ejecución relevante antes de cerrar el cambio.
A booking widget can display a success message while the practice still needs to review, reconcile, or confirm the request. The website, scheduling vendor, practice-management system, notifications, and front-desk process must agree on what happened. This guide focuses on testing that handoff, rather than promising a specific integration or increase in appointments. HHS guidance also makes the handling of patient information and third-party tracking relevant to the review. Use fictional test data and the actual vendor-supported workflow before relying on a new scheduling tool.
By Dental IT Team
Key takeaways
Distinguish a request received from an appointment confirmed, and make that distinction clear to staff and patients.
Test duplicate submissions, notifications, PMS routing, cancellations, and failures with fictional data.
Review the actual information flow and third parties; a booking widget or consent banner does not itself establish HIPAA compliance.
Resumen en español
Citas en línea: prueba el recorrido hasta recepción
Un mensaje de éxito no demuestra que una cita esté confirmada en el PMS. La guía propone probar el flujo real con datos ficticios, identificar el calendario autorizado y asignar responsables para solicitudes pendientes. También pide revisar los datos enviados a terceros. HHS señala que una parte de su guía sobre seguimiento web fue anulada judicialmente; no se afirma que toda visita pública sea PHI.
Aclara si la herramienta recibe una solicitud o confirma una cita.
Prueba notificaciones, duplicados, cambios, cancelaciones y reconciliación tras fallos.
Revisa el flujo real de información, proveedores y divulgaciones con el responsable de privacidad.
A patient or vendor arrives with files on a USB drive and asks the front desk to open them. Staff want to help, but plugging unfamiliar media into a production workstation can create a security and privacy problem before anyone knows what the files contain. CISA warns that USB drives can spread malicious code, and NIST discusses procedural and technical controls for portable media. This guide applies that general risk to a dental intake workflow; it does not claim a particular drive is infected or prescribe a universal device policy.
By Dental IT Team
Key takeaways
Give staff an approved route for outside files and an alternative when a USB drive cannot be accepted.
Use a designated, supported review process before importing into clinical applications.
Keep malware review, patient-case matching, permissions, and media custody as separate checks.
Resumen en español
Archivos externos en USB: una recepción más segura
Una memoria entregada por un paciente o proveedor puede contener archivos necesarios y también riesgos desconocidos. CISA y NIST recomiendan controles para medios removibles. La guía propone una ruta aprobada de recepción, custodia, revisión técnica, validación del paciente y carga mediante el proceso soportado. Un análisis antimalware es una observación, no una garantía de seguridad.
Ofrece una ruta autorizada para archivos y una alternativa cuando no se acepte USB.
Distingue revisión técnica de validación clínica y del paciente.
Documenta custodia, copias temporales, importación y qué hacer si ya se conectó la memoria.
The practice website, business email, and patient-facing links can depend on a domain registration that no one reviews until a renewal message arrives. ICANN advises domain holders to understand registrar expiration terms, pay on time, and keep contact information current. A dental office should connect that responsibility to its real website and email dependencies. This guide is about ownership and renewal continuity, rather than protective DNS filtering. It proposes a record that remains usable when a marketing agency changes, a card expires, or the person who registered the domain leaves.
By Dental IT Team
Key takeaways
Identify the domain registrar, practice-authorized account owner, renewal date, and recovery route.
Verify reminders inside the known registrar account instead of paying from an unexpected message.
Check the website, email, DNS, and other dependencies separately; renewing a domain is not the same as repairing every service.
Resumen en español
Renovación de dominios: protege web y correo dental
El dominio de la práctica puede sostener el sitio web, el correo y enlaces importantes. ICANN recomienda conocer los términos de vencimiento, pagar a tiempo y mantener actualizados los contactos. La guía propone verificar avisos dentro de la cuenta conocida del registrador y mantener un mapa de dependencias sin confundir registro, DNS, alojamiento y correo.
Identifica la cuenta del registrador, responsable, fecha de renovación y vía de recuperación.
Comprueba facturación y resultado de la renovación; la renovación automática no es una garantía.
Verifica por separado web, DNS y correo después de resolver un problema de registro.
A successful upload is only one step in sending a case to a dental laboratory. The practice also needs the correct patient and case, an approved destination, an authorized recipient, usable files, and a clear way to resolve a failed handoff. HHS cloud guidance explains that using cloud services for ePHI involves appropriate safeguards, risk analysis, and applicable business associate arrangements. This article turns those principles into an operational file-handoff checklist. It does not decide which disclosures are authorized or assume every lab has the same relationship to the practice.
By Dental IT Team
Key takeaways
Verify the case, authorized recipient, destination, and supported format before sending.
Review cloud-provider responsibilities and applicable agreements with the practice's privacy lead.
Confirm receipt and usability, then manage temporary copies under the approved policy.
Resumen en español
Archivos para el laboratorio: verifica la entrega completa
Una carga exitosa no confirma que el laboratorio recibió el caso correcto y puede usar todos los archivos. La guía conecta la aprobación clínica con el destino verificado, la revisión de proveedores cloud y acuerdos aplicables, los permisos de acceso y la aceptación del laboratorio. No determina por sí sola qué divulgaciones están autorizadas ni clasifica a todos los laboratorios de la misma forma.
Confirma caso, destinatario autorizado, formato y ruta de envío.
Revisa las responsabilidades de la plataforma y los acuerdos aplicables con el responsable de privacidad.
Verifica recepción y utilidad; gestiona enlaces y copias locales según la política aprobada.
A server can have enough space for today's schedule and still lack room for the next imaging rollout, backup operation, or recovery test. Storage planning should connect measured data growth to the dental workflows that create it. Open Dental documents that its A to Z folder holds images and documents; other imaging applications may use separate repositories. This guide focuses on capacity and supported expansion, rather than repeating a backup checklist. The proposed measurements help a practice and its IT provider decide what to investigate before buying disks or removing files.
By Dental IT Team
Key takeaways
Measure each real repository and storage volume instead of assuming the PMS database contains every image.
Plan space for growth, backups, temporary work, and representative restore tests.
Expand or relocate storage through supported procedures; do not free space by deleting or renaming clinical files.
Resumen en español
Almacenamiento de imágenes dentales: planifica la capacidad
La capacidad debe reflejar los repositorios reales y el trabajo de la práctica. Open Dental documenta que la carpeta A to Z guarda imágenes y documentos; otros sistemas pueden usar repositorios separados. La guía propone medir crecimiento, considerar proyectos próximos y coordinar ampliaciones soportadas sin eliminar ni renombrar archivos clínicos de forma improvisada.
Verifica las rutas configuradas y mide cada repositorio y volumen relevante.
Incluye respaldos, copias temporales y espacio para pruebas de restauración.
Prueba los flujos clínicos, permisos, monitoreo y respaldos después del cambio.
A familiar supplier emails a revised invoice just before the practice closes. The logo, account history, and amount look right, but the bank details have changed. The FBI describes business email compromise (BEC) as fraud that can impersonate a trusted business request, including an invoice change. A dental practice needs a payment-verification process that still works when the message comes from a compromised real mailbox. This guide separates financial authorization from technical email security and proposes a practical handoff between the office manager, payment approver, bank, and IT provider.
By Dental IT Team
Key takeaways
Verify changed payment instructions through an independently established contact route before releasing funds.
Separate the person updating payee details from the person approving payment where practical.
If funds were misdirected, contact the financial institution immediately and preserve the message and transaction evidence.
Resumen en español
Fraude en pagos dentales: verifica los cambios bancarios
Un correo con apariencia legítima puede pedir que un pago vaya a una cuenta distinta. La guía propone separar la verificación del proveedor, la aprobación financiera y la revisión técnica del buzón. Si el dinero ya se envió, el FBI recomienda contactar de inmediato a la institución financiera y reportar el caso a IC3; recuperar los fondos no está garantizado.
Confirma el cambio mediante un contacto del proveedor establecido antes del mensaje.
Registra quién verificó y aprobó el cambio; protege la información bancaria.
Coordina respuesta financiera, investigación de cuentas y evaluación de privacidad según los hechos.
A South Florida dental practice that works in English and Spanish can make its technology procedures easier to use by designing both versions together. This is a workflow recommendation for teams that choose bilingual support, not a demographic claim or an assertion that every local office operates the same way. NIST's small-business guidance emphasizes communicating cybersecurity expectations and responsibilities. The practical application here is a shared vocabulary for rooms and systems, a concise support-ticket format, reviewed translations, and a test that the next person can perform the approved action. It extends general training into the everyday handoff between reception, clinical staff, managers, and vendors.
By Dental IT Team
Key takeaways
Use the same room names, system identifiers, and approval boundaries in English and Spanish procedures.
Collect the task, exact error, time, affected scope, and safe evidence before escalating a ticket.
Test instructions through a supported synthetic workflow; a translated document alone does not prove the handoff works.
Resumen en español
Handoffs bilingües de IT dental en South Florida
Para prácticas que eligen trabajar en inglés y español, la guía propone identificadores compartidos, traducciones revisadas, evidencia segura y pruebas con escenarios ficticios. No presume preferencias lingüísticas por nombre o ubicación.
Conserva los mismos identificadores de salas y sistemas en ambos idiomas.
Incluye tarea, error exacto, hora y alcance en el ticket.
Comprueba que la persona pueda explicar y seguir el paso autorizado.
QR codes can make a dental workflow convenient: forms, directions, payment pages, and other links can be opened without typing a long address. They also make it harder to inspect the destination on a printed sign or unexpected message. The FTC warns about malicious QR links and advises using known contact paths to verify unexpected requests. This guide applies that warning to a dental front desk and to the practice's own printed materials. The scenarios are fictional planning examples, not reported incidents involving Dental IT customers, insurers, or payment vendors. The goal is a practical verification and reporting routine rather than banning useful QR codes.
By Dental IT Team
Key takeaways
Verify unexpected QR requests through a known website or contact route before signing in, paying, or approving access.
Maintain an inventory of the practice's own QR destinations and inspect printed signs for changes.
Report what happened after a scan, including any login, payment, permission grant, or download, so the response fits the actual exposure.
Resumen en español
Seguridad de códigos QR en la recepción dental
La FTC advierte sobre códigos QR que dirigen a sitios falsos. La guía aplica esa advertencia a ejemplos ficticios de recepción y a los propios letreros de la práctica, con rutas conocidas para verificar y reportar.
Verifica solicitudes inesperadas mediante un sitio o contacto conocido.
Asigna un responsable a cada destino y letrero QR de la práctica.
Reporta si hubo login, pago, permiso o descarga después del escaneo.
Dental records can span practice-management software, imaging systems, scanned documents, and other approved repositories. When an individual requests a copy, the office needs a repeatable process that connects the records decision with the technical export. HHS explains that electronic PHI generally must be supplied in the requested electronic form when readily producible, or an agreed readable alternative. Its guidance includes a qualification concerning the Ciox court order. This article concentrates on the IT workflow for an individual's own records; it does not set fees, deadlines, retention periods, or rules for third-party requests. Those decisions stay with the practice's responsible records and privacy staff.
By Dental IT Team
Key takeaways
Confirm request ownership, identity, scope, format, and destination before preparing an export.
Check the actual exported files, including requested imaging and attachments; a backup is not a patient record copy.
Keep staging, delivery, and cleanup inside the practice's approved records process.
Resumen en español
Exportación de expedientes dentales: un flujo práctico
La guía cubre la tecnología que respalda solicitudes individuales de copias: ubicar repositorios, usar exportaciones compatibles, comprobar los archivos y entregar por el proceso aprobado. Las decisiones de acceso, plazos y cargos corresponden al responsable de expedientes.
Confirma alcance, formato y destino antes de exportar.
Comprueba el contenido y las imágenes; un backup no es una copia individual.
Mantén preparación, entrega y limpieza dentro del proceso aprobado.
A renovation project can leave the building looking finished while the dental workflow is still incomplete. A moved workstation may reach the internet but not the imaging system; a temporary reception desk may expose screens to a new waiting area. The practical IT task is to preserve the functions of each room through construction, temporary operations, and final acceptance. HHS physical-safeguard guidance covers facilities, workstations, and device handling. The room-by-room method below is a proposed planning tool that applies that context without claiming a universal construction standard, fixed project cost, or guaranteed opening date.
By Dental IT Team
Key takeaways
Inventory the function of each room, including peripherals and application dependencies, before disconnecting equipment.
Define temporary workspace privacy and contractor access alongside cabling and installation work.
Accept the room through a complete approved workflow test and keep a practical fallback until the change is verified.
Resumen en español
Renovación dental: transición de tecnología por sala
Mover una estación puede afectar imágenes, impresoras, permisos y privacidad. La guía propone documentar cada sala, coordinar acceso de contratistas, preparar espacios temporales y aceptar el cambio mediante pruebas autorizadas.
Registra la función de la sala y sus dispositivos antes de desconectarlos.
Incluye privacidad y acceso de contratistas en el plan temporal.
Verifica el flujo completo y conserva una alternativa hasta aceptar el cambio.
Open Dental's eConnector is a separate operational dependency that deserves a place in the practice's support map. The vendor documents it as the communication link required for its eServices, installed on one machine that must remain on and awake. That means opening the desktop application is not a complete test of the online workflows the office uses. This checklist focuses on host ownership, availability, safe troubleshooting, planned changes, and restoration evidence. It does not prescribe a database upgrade or replace Open Dental support. The aim is to make a partly working system easier to diagnose without broad firewall exceptions or repeated unplanned service changes.
By Dental IT Team
Key takeaways
Record the single eConnector host, responsible support owner, and workflows that depend on it.
Test both service status and an approved end-to-end workflow after maintenance.
Use current Open Dental instructions and vendor escalation rather than broad network changes or duplicate installations.
Resumen en español
Open Dental eConnector: lista de continuidad
La documentación de Open Dental indica que el eConnector debe instalarse en un solo equipo, normalmente el servidor, que debe permanecer encendido y activo. La guía organiza responsables, mantenimiento, evidencia y pruebas del flujo completo.
Documenta el equipo del eConnector y los procesos que dependen de él.
Comprueba el estado del servicio y una prueba autorizada del flujo completo.
Coordina cambios y reparaciones específicas con soporte de Open Dental.
A permission prompt can look familiar because the sign-in provider is legitimate, while the application asking for access is not. Microsoft describes consent phishing as tricking users into granting permissions to malicious cloud apps. For a dental practice, the practical question is which applications can reach business mail, files, calendars, and other data, and who approved that access. This article focuses on application permissions rather than repeating an administrator-MFA checklist. The proposed workflow helps an office manager and IT provider connect each grant to a business purpose, a responsible owner, a review decision, and a way to remove unnecessary access.
By Dental IT Team
Key takeaways
A familiar sign-in page does not establish that the requesting app should receive practice data.
Connect each permission grant to a documented business purpose and named owner.
Investigate suspicious application access separately from password recovery; changing a password is not the full application-remediation workflow.
Resumen en español
Consentimiento de apps en Microsoft 365: revisión dental
El consentimiento de una aplicación es una decisión de acceso. La guía propone relacionar cada permiso con un propósito, un responsable y un proceso de revisión, y explica cuándo escalar una autorización sospechosa.
Revisa el permiso solicitado, además del nombre de la aplicación.
Asigna un responsable y un propósito a cada integración.
Una recuperación de cuenta no sustituye la revisión del acceso de la aplicación.
On October 6, 2026, the FBI, part of the U.S. Department of Justice, and the U.S. Secret Service published a joint FortiBleed cybersecurity advisory. It describes credential-based compromise of internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, including administrator lockouts and access supplied to ransomware affiliates. For a dental practice using affected technology, the relevant question is not only whether the firewall is patched: it is whether exposed access, accounts, sessions, configuration, and recovery have been reviewed. The dental impacts below are practical risk scenarios, not evidence that a particular practice has been attacked. Start with your authorized IT provider and the original advisory, rather than an improvised reset.
By Dental IT Team
Key takeaways
Verify whether the practice has internet-facing FortiGate administration or SSL VPN access; the advisory is not proof that every dental office is affected.
Review sessions, credentials, account legitimacy, API keys, configuration, logs, MFA, and supported password-storage hardening together.
If compromise is suspected, use coordinated incident response and protect dental operations; a patch or password reset alone does not establish eradication.
Resumen en español
FortiBleed: riesgos para prácticas dentales según el aviso del FBI y USSS
El aviso conjunto del FBI, parte del DOJ, y el U.S. Secret Service describe compromisos de credenciales en FortiGate y gateways SSL VPN expuestos, con posibles bloqueos administrativos y acceso para actores de ransomware. No demuestra que tu práctica esté comprometida: verifica exposición y evidencia con tu proveedor autorizado de IT.
Identifica si hay administración o SSL VPN de FortiGate expuestos a internet en cada ubicación.
Revisa sesiones, credenciales, cuentas, claves API, MFA, configuración y logs mediante el proceso autorizado.
Si sospechas compromiso, coordina contención, evidencia y recuperación; un parche o cambio de contraseña no demuestra erradicación.
Microsoft 365 is common in dental offices because email, calendars, Teams, SharePoint, OneDrive, and identity can sit under the same tenant. That concentration makes administrator accounts especially important. Microsoft's current guidance says admin accounts have elevated privileges, recommends limiting their number, using least privilege, and separating administrative work from ordinary productivity. Microsoft also documents security defaults as the baseline option available in Microsoft Entra ID Free, while Conditional Access provides more granular control in eligible licensing. A dental practice should know which model it uses rather than assuming MFA is configured correctly because users remember seeing a prompt.
By Dental IT Team
Key takeaways
Inventory every Microsoft 365 administrator and reduce Global Administrator use to people and scenarios that genuinely require that level of privilege.
Know whether the tenant relies on security defaults or Conditional Access and verify MFA coverage from the actual Entra configuration rather than user memory.
Use separate administrative identities where practical, protect recovery paths, monitor sign-ins and admin changes, and remove stale vendor or former-employee access promptly.
Resumen en español
Seguridad de administración Microsoft 365 para prácticas dentales
Microsoft 365 concentra email, identidad y colaboración. Esta guía explica cómo revisar administradores, MFA, security defaults o Conditional Access, least privilege, recovery, logging y offboarding.
Inventaría cada administrador y limita Global Administrator a necesidades reales.
Verifica si el tenant usa security defaults o Conditional Access desde la configuración real.
Usa identidades administrativas separadas cuando sea práctico y retira acceso antiguo de empleados o proveedores.
Guest Wi-Fi is convenient for patients, family members, vendors, and visitors, but it belongs in a different trust zone from systems that support clinical care and ePHI. CISA's ransomware guidance recommends network segmentation to limit lateral movement, and federal mobile-workplace guidance describes guest Wi-Fi as a practical way to separate untrusted devices from work devices. In a dental office, that principle means the guest network should be designed as internet access—not as a second password into the production network.
By Dental IT Team
Key takeaways
Keep guest devices on a separate network or segment that does not provide ordinary access to clinical servers, imaging, business workstations, printers, or management interfaces.
Protect wireless administration separately from the guest password and restrict who can change SSIDs, security settings, VLANs, firewall rules, and access points.
Test the boundary from an actual guest device so the practice verifies isolation instead of assuming the SSID name or router checkbox proves separation.
Resumen en español
Seguridad de Wi-Fi para invitados en prácticas dentales
El Wi-Fi de invitados debe ofrecer internet sin crear una ruta hacia sistemas clínicos o administrativos. Esta guía cubre segmentación, credenciales, firewall, bandwidth, monitoreo y pruebas de aislamiento.
Mantén visitantes en una red separada sin acceso ordinario a sistemas internos.
Separa el password de invitados de las credenciales de negocio y administración.
Prueba el aislamiento desde un dispositivo real después de cambios de firewall, switches o wireless.
Dental practices depend on printers, scanners, copiers, label printers, and multifunction devices for records, insurance, referrals, patient forms, imaging-related paperwork, and administration. CISA has specifically warned that printers and scanners commonly retain default credentials and may even contain privileged domain accounts used for scan-to-folder or scan-to-email workflows. HHS has also enforced HIPAA in a photocopier breach involving hard drives that were returned without erasing stored ePHI. The practical lesson is simple: networked printers and scanners belong in the security and lifecycle inventory, not outside it.
By Dental IT Team
Key takeaways
Change default administrative credentials and avoid loading broad domain-administrator credentials into printers or scanners for convenience.
Document scan-to-email, scan-to-folder, address-book, storage, firmware, network, and vendor-access settings as part of the device inventory.
Before return, resale, reuse, or disposal, determine whether the device contains storage with ePHI and follow the practice's documented media-sanitization process.
Resumen en español
Seguridad de impresoras y scanners para prácticas dentales
Impresoras, scanners y copiadoras modernas pueden almacenar datos, usar cuentas privilegiadas y conectarse a shares o email. Esta guía explica cómo administrarlas como dispositivos de red y no como muebles de oficina.
Cambia credenciales predeterminadas y evita cargar cuentas de dominio excesivamente privilegiadas.
Documenta scan-to-folder, scan-to-email, firmware, administración, almacenamiento y acceso de proveedores.
Evalúa y sanitiza almacenamiento antes de devolución, reventa, reutilización o disposición.
Dental teams increasingly use smartphones and tablets for email, MFA, cloud portals, patient communication, photos, remote support, scheduling, and clinical or administrative applications. HHS confirms that health care providers may use mobile devices to access ePHI in the cloud when appropriate administrative, physical, and technical safeguards are in place and applicable business associate requirements are met. A practical BYOD policy therefore starts with approved use, data handling, device security, account separation, and offboarding rather than assuming every personal phone can safely become a work device.
By Dental IT Team
Key takeaways
Define which dental systems and data personal devices may access before staff begin using phones or tablets as informal workstations.
Protect approved devices with supported authentication, encryption, updates, screen locking, controlled apps, and remote-response procedures appropriate to the risk.
Separate business accounts and data from personal use as much as practical so the practice can revoke access without depending on personal passwords or unmanaged copies of ePHI.
Resumen en español
BYOD y seguridad de dispositivos móviles para prácticas dentales
Los teléfonos personales pueden acceder a email, MFA, cloud apps y datos de trabajo. Esta guía explica cómo definir usos aprobados, protección del dispositivo, separación de datos, respuesta a pérdida y offboarding.
Define qué sistemas y datos pueden usar dispositivos personales antes de convertirlos en workstations informales.
Aplica autenticación, cifrado, updates, screen lock y apps aprobadas según el riesgo.
Diseña la revocación para que la práctica pueda retirar su acceso sin depender del password personal del empleado.
Dental teams use email, practice-management software, imaging portals, payment systems, vendor sites, insurance tools, cloud services, backup consoles, and administrative accounts every day. CISA recommends password managers because they make long, random, unique passwords practical across many accounts. For a dental practice, the bigger operational question is how to use a password manager without turning one shared vault or master account into a new single point of failure. The right design separates personal logins from shared business credentials, protects privileged access, documents recovery, and removes access when roles or vendors change.
By Dental IT Team
Key takeaways
Use unique credentials for users and administrators instead of reusing one office password across email, vendors, backups, and clinical systems.
Separate individually assigned logins from credentials that genuinely need controlled team access, and make shared-vault ownership visible.
Protect the password manager itself with strong authentication, documented recovery, limited administrators, and prompt offboarding when staff or vendors leave.
Resumen en español
Gestores de contraseñas para prácticas dentales: guía de seguridad 2026
Un gestor de contraseñas facilita credenciales únicas y fuertes, pero la práctica todavía necesita definir propiedad, acceso compartido, MFA, recuperación, proveedores y offboarding.
Usa credenciales únicas para usuarios y administradores en lugar de reutilizar una contraseña de oficina.
Separa logins personales de secretos que realmente necesitan acceso compartido y controlado.
Protege el gestor con MFA, recuperación documentada y administración limitada.
Microsoft's current lifecycle materials place the end of extended support for Windows Server 2016 in January 2027. Microsoft currently shows a one-day difference across official lifecycle surfaces, so a dental practice should plan around the January 2027 lifecycle window rather than rely on a single displayed day. A server may host a practice-management database, imaging files, domain services, shared folders, licensing components, backups, or vendor utilities, so migration planning should begin with dependency discovery and a verified recovery path.
By Dental IT Team
Key takeaways
Microsoft's current lifecycle materials place the end of extended support for Windows Server 2016 in January 2027.
Inventory applications, databases, imaging, shares, identity, licenses, devices, backup agents, and vendor dependencies before selecting a replacement.
Use validated backups, application testing, a maintenance window, and documented rollback criteria before production cutover.
Resumen en español
Windows Server 2016: guía de migración para prácticas dentales
Microsoft lista enero de 2027 como el final del soporte extendido de Windows Server 2016. La práctica debe identificar aplicaciones, bases de datos, imágenes, shares, licencias, backups e integraciones antes de escoger una ruta de reemplazo.
Identifica cada servidor Windows Server 2016 y sus dependencias antes de escoger una plataforma de reemplazo.
Verifica compatibilidad de PMS, imágenes, bases de datos, drivers e integraciones con los proveedores correspondientes.
Valida backups y define criterios de prueba y rollback antes de la ventana de producción.
The National Cybersecurity Alliance lists the 2026 Cybersecurity Awareness Month theme as “Don’t Make It Easy for Them” and centers the campaign on four actions: stronger account security, multifactor authentication, recognizing and reporting scams, and updating software. Dental practices can map those ideas to email, practice-management software, imaging workstations, remote support, cloud portals, backups, payment systems, and administrator accounts.
By Dental IT Team
Key takeaways
Use the 2026 campaign as a verification exercise tied to named dental systems and owners.
Prioritize administrator, email, remote-access, backup, security, and vendor accounts.
Record findings and follow-up dates so October activity becomes part of normal operations.
Resumen en español
Mes de la Ciberseguridad 2026: plan de acción para prácticas dentales
La campaña 2026 se centra en hábitos sencillos y repetibles. Esta guía traduce esos principios a cuentas, dispositivos, proveedores, backups, acceso remoto y sistemas clínicos de una práctica dental.
Usa octubre como una verificación de controles reales, no solo como una campaña de concientización.
Prioriza email, administradores, acceso remoto, backups, seguridad y cuentas de proveedores.
Registra hallazgos, responsables y fechas de corrección para convertir la revisión en trabajo operativo.
Atlantic hurricane season continues through November 30, and South Florida businesses also face flooding from severe rain and other local hazards. Florida's Division of Emergency Management tells businesses to follow local instructions before re-entering after a disaster, prioritize safety, document damage before repairs, and maintain continuity plans. For a dental practice, technology recovery should follow that same sequence: confirm the facility is safe, avoid energizing wet or questionable equipment, preserve evidence, verify backups and communications, and reopen clinical systems in a controlled order.
By Dental IT Team
Key takeaways
Do not energize wet, submerged, or water-exposed technology until the facility and equipment have been evaluated by the appropriate qualified professionals.
Photograph and inventory damaged technology before disposal or repair decisions, preserve serial numbers and evidence, and notify insurers and vendors according to the practice's recovery process.
Restore in a controlled sequence: safe power and connectivity, network core, servers or cloud access, identity, PMS and imaging dependencies, phones, backups, then representative clinical workflows.
Resumen en español
Recuperación de TI dental tras inundaciones o agua: guía 2026
Después de una inundación o intrusión de agua, la prioridad no es encender equipos. Esta guía cubre reingreso seguro, documentación del daño, energía, custodia de dispositivos, respaldos, orden de recuperación y pruebas antes de retomar operaciones.
No energices equipos mojados o expuestos al agua hasta que profesionales apropiados evalúen la seguridad.
Fotografía e inventaría daños antes de reparar o desechar y conserva la cadena de custodia de dispositivos con datos.
Recupera en secuencia controlada y prueba flujos clínicos representativos antes de reabrir completamente.
A dental firewall is not secure merely because it is installed and licensed. Over time, temporary vendor rules, old VPN accounts, abandoned port forwards, broad network objects, remote-support exceptions, and undocumented changes can survive long after the original need disappears. CISA guidance emphasizes strong segmentation, restricting internet-facing management, robust logging, and controlled network configuration. A dental firewall review turns those principles into a practical inventory of what is allowed, why it exists, and who owns the decision.
By Dental IT Team
Key takeaways
Start with exposure: identify inbound rules, remote management, VPNs, published services, and vendor paths that can be reached from outside the practice.
Tie significant rules to a business owner and current purpose; remove or narrow stale rules rather than keeping them because nobody remembers what they do.
Use logging and change documentation so the practice can investigate suspicious traffic and understand why network access changed.
Resumen en español
Revisión de reglas de firewall para prácticas dentales: checklist 2026
Las reglas de firewall se acumulan con nuevos proveedores, software y proyectos. Esta guía ayuda a revisar exposición entrante, acceso remoto, segmentación, objetos obsoletos, registros y control de cambios.
Empieza por exposición entrante, administración remota, VPNs y rutas de proveedores.
Relaciona cada regla importante con un propósito actual y un responsable.
Registra cambios y eventos relevantes para facilitar investigación y rollback.
The HIPAA Security Rule requires regulated entities to implement hardware, software, and/or procedural mechanisms to record and examine activity in information systems that contain or use ePHI. CISA's current small-business logging guidance likewise recommends enabling logs across servers, firewalls, endpoints, and cloud services, centralizing important events where practical, monitoring high-risk activity, protecting logs, and defining response ownership. For a dental practice, the challenge is choosing useful evidence without collecting endless noise that nobody reviews.
By Dental IT Team
Key takeaways
Prioritize logs that answer practical incident questions: who signed in, what changed, which device or system was involved, where the action came from, and when it occurred.
Protect important logs from unauthorized alteration or deletion and centralize them where doing so improves detection and investigation.
Define review and escalation responsibilities before an incident; a large archive of unreviewed events is not the same as operational monitoring.
Resumen en español
Logs de auditoría HIPAA para prácticas dentales: guía 2026
Los logs solo ayudan si la práctica puede usarlos para examinar actividad, investigar eventos y escalar alertas. Esta guía prioriza fuentes de alto valor, centralización, protección de evidencia, retención basada en riesgo y respuesta.
Prioriza eventos que respondan quién accedió, qué cambió, desde dónde y cuándo.
Protege logs importantes contra modificación o borrado y centralízalos cuando mejore la investigación.
Define responsables y escalamiento antes de que una alerta se convierta en un incidente real.
Buying a dental practice creates a narrow transition window where ownership, access, vendors, contracts, software, domains, backups, and support responsibilities can become ambiguous. The pre-close diligence process should identify the environment; day-one IT cutover turns that evidence into controlled ownership. The goal is not to replace every inherited system immediately. It is to make sure the buyer can operate, recover, secure administrative access, reach vendors, and know which risks still need remediation after closing.
By Dental IT Team
Key takeaways
Before closing, identify who owns domains, cloud tenants, backups, firewalls, remote tools, software portals, licenses, and vendor relationships; day one is not the time to discover an account belongs to a former employee.
Sequence credential changes so the buyer removes stale access without locking out required vendors or breaking production systems.
Stabilize first, then standardize. Separate urgent security and recovery gaps from longer-term refresh projects so patient operations can continue.
Resumen en español
Cutover de TI para el día uno de una adquisición dental: guía 2026
La debida diligencia identifica riesgos; el día uno asigna propiedad, elimina acceso obsoleto y mantiene continuidad. Esta guía organiza cuentas administrativas, proveedores, respaldos, red, software, MFA y estabilización posterior al cierre.
Confirma propiedad de dominios, tenants, respaldos, firewall, herramientas remotas y portales antes del cierre.
Secuencia cambios de credenciales para retirar accesos antiguos sin romper servicios o integraciones.
Estabiliza primero y estandariza después, separando riesgos urgentes de proyectos de modernización.
