As the CEO of Darkhorse Tech, I want to bring to your attention some significant proposed changes to the HIPAA Security Rule that could have a direct impact on your dental practice.
On December 27, 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) to update the Security Rule for the first time in over a decade. The official version was published on January 6, 2025. These updates are designed to improve clarity, enhance cybersecurity measures, and ensure better compliance in protecting electronic protected health information (ePHI). Let's break down what this means for dental practices.
01A shift towards specific, mandatory security measures
For years, the HIPAA Security Rule has been broad and flexible to accommodate various healthcare providers. However, OCR is now making it clear that certain cybersecurity measures are no longer optional. In the past, some security measures were labeled as "addressable," which led to confusion and noncompliance. Now, all security standards will be required, ensuring that dental practices take cybersecurity seriously.
02Focus on emerging technologies: AI, quantum computing, and more
OCR has highlighted artificial intelligence (AI), quantum computing, and virtual/augmented reality as emerging technologies that could impact data privacy. Even if your dental practice does not currently use these technologies, OCR wants you to evaluate their potential risks and implement security measures proactively.
03Written documentation and compliance audits
Written documentation has always been required under HIPAA, but OCR has found that many organizations fail to maintain up-to-date policies. The proposed rule emphasizes the necessity of regularly evaluating and updating all security policies and procedures. Additionally, dental practices will be required to conduct annual compliance audits to assess their adherence to security standards. These audits will serve as critical documentation if your practice ever faces an OCR investigation.
04Stricter data protection standards
Some of the most impactful changes include:
ePHI must now be encrypted both in transit and at rest, ensuring that patient data remains protected from cyber threats.
Vulnerability scans at least every six months and penetration testing at least once a year, to identify security gaps before cybercriminals exploit them.
Formal patch management policies to ensure timely updates of software and systems, reducing vulnerabilities.
05Strengthened access control and authentication
Cybersecurity threats are often tied to unauthorized access. The new rule will require:
- Multi-factor authentication (MFA): Dental practices must implement MFA to verify user identities before accessing ePHI.
- Network segmentation: Practices must restrict access to sensitive data, ensuring that only authorized personnel have access.
06Business associate contracts and responsibilities
If you work with third-party vendors handling ePHI (such as IT providers, billing services, or cloud storage companies), the proposed rule places new requirements on them as well. Business associates must now:
- Verify, at least annually, that they have implemented the required security controls.
- Notify covered entities within 24 hours of activating their contingency plans due to security incidents.
07New compliance deadlines and expectations
To ensure timely compliance, the OCR is introducing specific deadlines for security reviews:
- Policies and procedures must be reviewed, updated, and verified at least once every 12 months.
- Certain security measures (such as vulnerability scanning and penetration testing) must be performed at regular intervals.
| Requirement | Frequency |
|---|---|
| Vulnerability scanning | At least every six months |
| Penetration testing | At least once a year |
| Compliance audit | Annually |
| Review, update, and verify policies and procedures | At least once every 12 months |
| Business associate verification of security controls | At least annually |
| Business associate notice after activating contingency plans | Within 24 hours |
08What this means for your dental practice
These updates signal a shift in how the government views cybersecurity in healthcare, and the changes are particularly relevant to dental practices, which often have smaller IT teams and fewer cybersecurity resources. However, compliance is no longer just about avoiding fines — it's about protecting your patients' data and maintaining trust.
Actionable steps for dental practices
- 1Assess your current security measuresMeasure them against the new requirements.
- 2Implement encryption and multi-factor authenticationSafeguard ePHI.
- 3Regularly test your cybersecurity defensesUse vulnerability scanning and penetration testing.
- 4Update written policies and perform annual compliance audits
- 5Ensure business associates complyWith the updated HIPAA Security Rule.
At Darkhorse Tech, we specialize in helping dental practices stay ahead of these regulatory changes while maintaining seamless, secure IT operations. If you have questions about how these HIPAA updates will impact your practice or need assistance in meeting compliance requirements, we are here to help. The proposed rule is currently open for public comment until March 7, 2025, so there is still time for adjustments before finalization. However, given the direction OCR is taking, dental practices should start preparing now.
Need help staying compliant?
Darkhorse Tech is committed to ensuring that dental professionals have the most up-to-date cybersecurity solutions to meet HIPAA requirements. Contact us today to learn how we can help safeguard your practice against evolving threats.
.svg)
