Information Security for Dental Offices: The Basics

One of the greatest responsibilities of an IT company or MSP is network security, and dental offices face threats from cyber criminals at an ever-increasing rate. We pride ourselves on being HIPAA experts, and threats to our clients drive the security options we recommend. Before a client is onboarded, we audit their system to pinpoint weak points in their existing security, then recommend and explain the components they need and why.

Once a practice decides to work with us, we provide the baseline of our security protocol: an actively managed firewall, backup and disaster recovery hardware and software (to secure data and provide failover options), anti-virus and anti-ransomware software (proactive options highly recommended), 24/7 monitoring, documentation of any existing HIPAA pitfalls, and a rundown of best practices for internal SOPs. Previous posts focused on what we do for clients; this one outlines simple steps any office can take to make information security a little easier.

01Common sense

You’d be surprised how many security mistakes could be avoided by taking a deep breath, standing up, and sitting back down. It’s easy to get caught up in the drama of a situation, and stepping back drops the chance of doing the wrong thing dramatically. With alertness and critical thinking, almost all information security issues are avoidable.

If you or an employee are asked to reveal information, consider the request: where is it coming from, and was it solicited? If it’s unsolicited, it’s very likely dangerous. Even if it was solicited, if you don’t have a contract with the requester and they want names, emails, computer usernames, or passwords, take a minute before moving forward, and if you have an IT company, ask them to investigate.

02Recommended policies and best practices

Passwords

Information security starts with a classic: choose a strong password, meaning hard to guess. Far too often we find existing passwords made of names, nicknames, common words, addresses, phone numbers, or number swaps like pa55w0rd. Good passwords are, let’s face it, annoying, but a password manager (do your research) can manage them for you using encryption.

1. 1
   Go long12 to 14 characters is a good place to start.
2. 2
   Mix it upUse symbols, numbers, and varied capitalization. If it’s annoying, it’s probably a good password.
3. 3
   Never reuseDon’t use the same password across accounts: Facebook, email, Instagram, your bank. If that just reminded you of one password, go change them now.
4. 4
   Don’t shareThere are exceptions, like your IT company, but in general, don’t do it.
5. 5
   Change them regularlyEvery three months is a good rule of thumb.

Lock your workstations

Any locking solution is better than leaving workstations open. An accessible workstation isn’t just a HIPAA violation; it leaves your office vulnerable. The simplest option is to sign out or press the Windows key + L. You can also set every computer to lock or log out after a set time (five minutes?), look into user-specific solutions like fobs, and we highly recommend solutions connected to Active Directory (learn more in our Active Directory post).

Secure your network

Your IT provider should set you up with a secure private network (encrypted and hidden) and a separate public network for patients, but your team can still access the public side. Staff need to take personal responsibility for always using the private network: trust your provider for the tools, and make sure employees know their responsibilities.

On the hardware side, whether you have a self-enclosed IT rack or a server room, it must be housed in a secure, lockable space. Your server (if you aren’t on the cloud) and network components should never be accessible to the public, and ideally only to a select inner circle. That adds another layer of protection and brings you one step closer to HIPAA compliance.

Individual awareness

• Avoid pop-ups, unknown emails, and links. Never enter personal or company information in response to an email, pop-up, or any communication you didn’t initiate. Phishing can lead to identity theft, and it’s how most ransomware attacks begin.
• Never send passwords by email.
• Never send personal information by email.
• Never open an attachment from a company or person you don’t know, or one you weren’t expecting, and don’t reply to unsolicited emails.
• Don’t open emails from someone you don’t know or trust.
• If you think an email may be real, send a new email to the sender asking about it.

Failsafe measure

Whether you work with Darkhorse Tech or another IT company, keep in touch. Report security warnings from your internet security software right away, including unsolicited emails, pop-ups, and alerts that appear while browsing. Some threats show up unexpectedly, and your IT team should hear about them ASAP.

About Darkhorse Tech

Whether you’re just starting out or a well-established organization, Darkhorse Tech has the experience and technology to help get you moving, cut costs, and streamline your operations with unlimited IT support. We help you do what you do best: provide top-notch care and service for patients, not deal with IT problems, time spent on hold with technical support, or complicated technical mishaps. Our additional security services include:

• Unlimited remote and/or on-site IT support of all your hardware and software
• Improved network performance and security
• HIPAA-compliant off-site and local backup service (Darkhorse Secure Backup)
• Managed antivirus, anti-malware, and anti-ransomware (Darkhorse Security Products)
• Compliance and security law standards
• Microsoft security patch management
• Vendor management: we will be on the phone, not your employees
• Secure, remote access to your office
• Firewall management
• Network management
• Long-term planning and budgeting

Contact us anytime to learn more about our dental-specific solutions and unlimited support packages. Read our reviews or call us today at 800.868.4504.