Security

Are dental practices really HIPAA-compliant? The vendor BAA gap

In one sentence

Many dental practices believe they are HIPAA-compliant but have real gaps — the most common being the vendor BAA gap: an IT company that maintains systems holding patient data on your behalf without a signed Business Associate Agreement. Compliance is ongoing safeguards, agreements, and evidence, not a one-time certificate. Here is where practices fall short.

Last updated

On this page
7 min read Published
hipaacompliancebaavendor riskdental

Are dental practices really HIPAA-compliant?

Many dental practices believe they are HIPAA-compliant when they have real gaps - and one of the most common is the vendor BAA gap: the IT company that maintains systems holding patient data on your behalf, without a signed Business Associate Agreement in place. HIPAA compliance is not a certificate you earn once; it is an ongoing set of safeguards, agreements, and evidence. This page covers where dental practices commonly fall short, with a focus on the vendor gap. (General information, not legal advice.)

What HIPAA actually expects of a practice

At a high level: a documented security risk analysis, administrative/physical/technical safeguards for protected health information (PHI), workforce training, and signed Business Associate Agreements with any vendor that creates, receives, maintains, or transmits PHI on your behalf. "We are a small office" does not exempt a practice from any of this.

The vendor BAA gap

Your IT company can almost certainly reach systems that contain PHI - the server, the practice-management database, email. That makes them a business associate, and a signed BAA is expected. Yet plenty of practices have never signed one with their IT provider, or signed an old one that no longer reflects how the vendor actually operates. If a breach traces back to that vendor and there is no BAA, the practice is exposed. (See what is a BAA, and does your IT company have one?)

The other common gaps

  • No documented risk analysis - the foundational HIPAA requirement many skip.
  • Untested backups - "we have backups" with no proven restore. (See do my dental backups actually work?)
  • No multi-factor authentication on email and remote access.
  • Unaudited vendor remote access - broad, shared, always-on. (See is my IT vendor my biggest security risk?)
  • No evidence - even good controls fail an audit if you cannot show they exist.

How to check your own practice

  • Do you have a signed, current BAA with your IT company - and with every vendor that touches PHI?
  • When was your last documented security risk analysis?
  • Has anyone tested a restore of your practice-management database recently?
  • Is MFA on for email, remote access, and admin accounts?
  • Can you see and audit what your IT vendor accesses?

BAA-by-default is the right posture

A dental-fluent IT provider should sign a BAA by default and treat it as table stakes, not an upsell. (See Security & Compliance.) Closing the vendor gap, documenting a risk analysis, and proving your backups restore covers most of what separates "we think we are compliant" from "we can show we are."

This is general information about HIPAA expectations, not legal advice. A qualified compliance professional or attorney can advise on your specific obligations.

Frequently asked questions

Is my dental practice actually HIPAA-compliant?

Many practices believe so but have gaps. HIPAA is an ongoing set of safeguards, agreements, and evidence - not a one-time certificate. Common shortfalls include no signed BAA with the IT vendor, no documented risk analysis, untested backups, and missing MFA. Compliance means you can show the controls exist, not just claim them.

Does my IT company need a BAA?

Almost certainly. If your IT company creates, receives, maintains, or transmits protected health information on your behalf - which routine administration of the server, the practice-management database, or email usually involves - they are a business associate, and HIPAA expects a signed Business Associate Agreement. If a breach traces to a vendor with no BAA in place, the practice is exposed.

How do I know if my practice has HIPAA gaps?

Check the basics: a current signed BAA with every vendor that touches PHI, a recent documented security risk analysis, a tested backup restore, MFA on email and remote access, and the ability to audit what your IT vendor accesses. If you cannot answer those clearly, you likely have gaps to close.

Security7 min read

The 2026 HIPAA Security Rule changes every dental office needs to know

The 2026 HIPAA Security Rule changes are a major proposed update — not final law as of mid-2026. If finalized, the proposal would make encryption and MFA mandatory, remove the addressable-versus-required distinction, and add inventories, testing, and tighter oversight. Most of it is good practice now, so prepare without treating it as a current deadline.

Read article
Security6 min read

What is a Business Associate Agreement — and does your IT company have one?

A Business Associate Agreement is a HIPAA-required contract between your practice and any vendor that creates, receives, maintains, or transmits protected health information on your behalf. Your IT company almost certainly qualifies — they maintain the server, database, and email that hold it — so a signed BAA is expected even if they never read a chart. Without one, you have a compliance and liability gap.

Read article
Security9 min read

What are the HIPAA technical safeguards for a dental practice?

The HIPAA Security Rule’s technical safeguards are set out in 45 CFR §164.312 as five standards — access control, audit controls, integrity, person or entity authentication, and transmission security — with seven implementation specifications beneath them, two required and five addressable. They apply to every system that stores or transmits electronic protected health information.

Read article