DentalBupA
DentalBupA
From preventive care and root canals to braces, implants, and cosmetic smile makeovers - we cover every type of dentistry so you can make informed decisions about your oral health with confidence.
Blog By:
kevind1
kevind1

SharePostShareShare
Where a Small Practice Leaks Data, and Who Should Fix Each Gap

Where a Small Practice Leaks Data, and Who Should Fix Each Gap

11/8/2026 7:48:00 PM   |   Comments: 0   |   Views: 9
A supplier asks the front desk to update its bank details. A dentist needs tomorrow's schedule from home. A patient connects to the waiting-room Wi-Fi. Each is an ordinary part of running a practice, but each puts a different person in charge of a security decision.

The useful question is who owns that decision. Team members can verify a payment request; they cannot confirm that a firewall separates guest devices from clinical systems. Dividing those responsibilities gives an office manager something practical to follow up on, rather than another general reminder to “be careful.”

Team: Outside the Office

A CE trip often mixes personal browsing with work. Staff might check travel plans on hotel Wi-Fi, then be tempted to open the practice schedule on the same phone. Set the boundary before they leave: personal browsing and access to patient information need different rules.

For personal activity on a personal device, a free VPN can add privacy by encrypting traffic routed between the device and the VPN server. HTTPS already protects the content of connections to properly configured websites. The VPN adds protection against local network observation; it does not establish that a website is genuine or prevent someone from handing details to a scammer.

That consumer app is not permission to access patient records, and staff should not install it on practice-managed devices without approval. Practice email can contain patient information too. Use only the devices, accounts and remote-access methods the practice has approved for work.

Huddle point: Make sure everyone knows where to ask before opening work systems from a personal device.

Team: The Front-Desk Inbox

Many attacks first land at the front desk. Phishing emails are often disguised as insurance carriers, lab invoices or updated fee schedules. They work because they look like the paperwork your team handles every day.

One costly version is a payment-change request. An email that appears to come from a lab or supplier says its bank details have changed and asks you to update them before the next payment. If the sender's account was compromised, the email may come from the real address.

Give the front desk a clear process:

- Call to confirm any change to payment details, using a phone number you already have on file, never one in the email.

- Don't open unexpected attachments, even from known senders, until you've confirmed they meant to send them.

- Report, don't delete. Use the reporting button or process your IT provider specifies. Avoid casually forwarding suspicious attachments to colleagues.

Huddle point: Agree on one person who approves any change to vendor banking details.

IT: The Waiting-Room Wi-Fi

If your practice offers patient Wi-Fi, check how it is set up. A separate network name and password do not, by themselves, prove that guest devices are isolated. If the guest network and the practice network share the same equipment without proper separation, a device in the waiting room may be able to see devices behind the front desk.

This is not a weekend project for the office manager. Network separation, firewall rules and wireless settings belong with your IT provider. Your job is to ask the questions:

- Is the guest network isolated from the practice network, or does it just have a different name?

- Can guest devices see each other, or is client isolation turned on?

- Which encryption standard is the network using, and when was the router's firmware last updated?

- Has IT tested from a guest device that clinical systems and network administration pages are unreachable?

If the answers are vague, ask for them in writing.

IT: After-Hours Access to the Schedule

Dentists and office managers often need the schedule or a chart at night. That convenience needs clear access controls.

Your setup may use a cloud practice platform, managed remote desktop access or an office VPN. A cloud login does not necessarily need an office VPN at all. Ask IT to document the approved route, including which devices are allowed and how they are kept updated.

Require individual accounts and multi-factor authentication for remote access wherever supported. If a critical system cannot support it, ask IT how access will be restricted and what replacement or upgrade is planned. An office VPN also needs maintenance; installing one is not the end of the job.

Keep consumer VPN advice in its proper place. If staff askhow to choose a VPN for personal use, privacy policies, device support and clear explanations of data handling are useful starting points. That choice does not determine whether a device or connection is approved for practice work.

A few follow-up questions are worth asking too. Do remote sessions time out after a period of inactivity, so a laptop left open at home doesn't keep the door open? Is each login recorded, so you could tell who accessed the system and when if something went wrong? And does each person have their own login, rather than one shared account for the whole team? Shared logins weaken accountability and make individual access harder to revoke.

Also ask how access is removed when someone leaves the practice. A former employee whose login still works is an easy gap to miss.

Owner and IT: Prove That Recovery Works

Access controls help prevent incidents. Backups answer a different question: how will the practice recover if records become unavailable? Ask who monitors failed backups, whether a protected copy is separated from everyday administrator access, and when a restore was last tested.

A message saying “backup completed” is not evidence that the team could restore a working system. Ask IT for the date and result of a recovery test, along with which systems it covered. A cloud software subscription also deserves a specific question: what does the vendor restore, and what remains the practice's responsibility?

The office manager should know whom to call if systems are unavailable, and where to find that number without opening practice email. Agree on a downtime procedure before reception has patients waiting and no usable schedule.

Turn the Huddle Into Assigned Tasks

Use the next huddle to agree on three actions: who confirms supplier payment changes, how staff report suspicious messages, and whom they contact about remote access. Send the technical questions about guest Wi-Fi, account access and recovery testing to IT separately.

Give each unresolved item an owner and a follow-up date. Some changes cost only staff time; network upgrades, managed devices or recovery work may need a budget. Ask IT to explain the priority and the practical consequence of delaying each one.

These checks are a starting point for managing risk, not a complete security assessment or proof of HIPAA compliance. A useful first result is simpler: every member of the team knows which decisions they can make and which need to go to IT.
SharePostShareShare
You must be logged in to view comments.
Total Blog Activity
997
Total Bloggers
13,451
Total Blog Posts
4,671
Total Podcasts
1,788
Total Videos
Dentaltown Magazine
November 2026
Dentaltown Magazine November 2026 Read Current Issue Read Archived Issues
Sponsors
Townie Perks