--- title: "Ransomware and data breaches: steps for a dental practice" description: "Federal guidance on ransomware for small dental practices: backups, response plans, reporting and HIPAA breach rules from CISA and HHS. Not legal advice." url: https://joncopeland.multisites.ai/blog/dental-ransomware-data-breach publisher: Copeland Consulting Services email: drcopeland@joncopelanddds.com contact: https://joncopeland.multisites.ai/contact --- # Ransomware and data breaches: steps for a dental practice Federal guidance says to keep offline, encrypted backups, test restores and keep a written incident response plan. HHS says a ransomware attack on patient data is presumed a breach unless the office shows a low probability of compromise. CISA says to report incidents to CISA or the FBI. Confirm duties with an adviser. Practice managementPublished October 26, 20264 min read This post collects steps from federal guidance on ransomware and data breaches for small dental practices. It is a checklist for planning and conversation. It is not legal or technical advice. Involve a HIPAA adviser, an IT professional and an attorney for any real incident. ## What is ransomware? CISA describes ransomware as “a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” Attackers then demand ransom for decryption. CISA adds that attackers have also taken victim data and pressured victims “by threatening to release the stolen data.” CISA calls the use of both tactics “double extortion.” For a dental office, locked files can mean no schedule, no charts and no images. The effect is operational first and a privacy matter second. The [ransomware](https://joncopeland.multisites.ai/glossary/ransomware) and [data breach](https://joncopeland.multisites.ai/glossary/data-breach) entries in the glossary define the terms. ## What does CISA say to do before an attack? CISA’s guide has a preparation section. It says organizations should keep offline, encrypted backups and test them. It says: “It is important that backups are maintained offline, as many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” The guide is written for a wide audience, including IT professionals and others who build incident response plans. A small practice will rely on its IT vendor for most steps. The table below lists items from the guide that a practice can ask about. Preparation item (CISA) Question for the practice or its IT vendor Offline, encrypted backups of critical data Where are our backups, and can an attacker reach them? Regularly test backup procedures When did we last restore a file from backup? Basic cyber incident response plan with a communications plan Is there a written plan, and does everyone know their part? Phishing-resistant multi-factor authentication Which logins use a second factor, especially email? Guidance for staff on suspicious activity Do staff know how to spot and report a phishing email? A [business continuity plan](https://joncopeland.multisites.ai/glossary/business-continuity-plan) covers how the office keeps seeing patients if systems are down. The ADA’s risk management page also lists tips on emergency action and disaster recovery plans. ## What does HHS say about ransomware and HIPAA? HHS says a ransomware attack is presumed to be a breach unless the office shows otherwise. Its fact sheet states: “Unless the covered entity or business associate can demonstrate that there is a ‘…low probability that the PHI has been compromised,’ based on the factors set forth in the Breach Notification Rule, a breach of PHI is presumed to have occurred.” If a breach is presumed, the notification rules apply. The entity must notify affected individuals “without unreasonable delay,” then HHS, and then the media when the breach affects over 500 individuals. An adviser decides whether the presumption applies in a given case. ## What steps does HHS list after an attack? HHS lists response activities in order. They begin with an initial analysis to find the scope, origin and timing of the incident. Later steps are listed below. 1. Contain the impact and spread of the ransomware. 2. Eradicate the ransomware and fix the weaknesses that allowed it. 3. Recover by restoring lost data and returning to normal operations. 4. Run post-incident activities, such as checking whether any regulatory, contractual or other duties apply, and record lessons learned. HHS notes that those duties could include “providing notification of a breach of protected health information.” The office should also call its insurer and attorney early, since policies and state laws can add steps. This post does not give advice on either. ## Who should receive a report? CISA’s guide says to report the incident to, and consider asking for help from, “CISA, your local FBI field office, the FBI Internet Crime Complaint Center (IC3), or your local U.S. Secret Service field office.” The ADA’s risk management page also points dentists to the IC3, which it describes as run by the FBI and “the Nation’s central hub for reporting cyber crime.” HHS timing depends on size, as the [HIPAA for dental offices](https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices) post explains. If a breach affects 500 or more individuals, HHS says covered entities must notify the Secretary “without unreasonable delay and in no case later than 60 days following a breach.” Who Source of the step CISA, FBI field office, IC3 or Secret Service field office CISA ransomware guide Affected individuals, HHS, and sometimes the media HHS Breach Notification Rule Insurer and attorney Ask your adviser; not set by these sources ## How can an office start this week? A first step is a short meeting with the IT vendor. Ask three things. Where are the backups? When was the last restore test? Is there a written incident plan? The ADA says “identifying the risks that exist in a dental practice is the first step to effectively managing them.” Write the answers down and set a date to review them. The [dental compliance checklist](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) lists the other areas a practice tracks. The post on [website accessibility](https://joncopeland.multisites.ai/blog/dental-website-accessibility) covers another part of patient-facing technology. The glossary explains [cybersecurity](https://joncopeland.multisites.ai/glossary/cybersecurity) and [risk management](https://joncopeland.multisites.ai/glossary/risk-management). ## Next step Read the [dental compliance checklist](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) for the wider view. To ask about consulting, [contact Dr. Copeland about consulting](https://joncopeland.multisites.ai/contact?topic=consulting). ## Frequently asked questions ### Is a ransomware attack a HIPAA breach? HHS says a breach of protected health information is presumed to have occurred unless the entity can show a low probability that the information was compromised. Then notification rules apply. Ask a HIPAA adviser how this applies to a specific incident. ### What should a dental office back up? CISA advises offline, encrypted backups of critical data, with regular tests of the backup procedure. CISA notes many ransomware variants try to delete or encrypt backups they can reach, so offline copies matter. ### Who should a practice report ransomware to? CISA's guide says to report the incident to, and consider requesting help from, CISA, the local FBI field office, the FBI Internet Crime Complaint Center or the local U.S. Secret Service field office. Also involve a HIPAA adviser. ## Terms on this page - [Business continuity plan](https://joncopeland.multisites.ai/glossary/business-continuity-plan) - [Compliance checklist](https://joncopeland.multisites.ai/glossary/compliance-checklist) - [Risk management](https://joncopeland.multisites.ai/glossary/risk-management) - [Cybersecurity](https://joncopeland.multisites.ai/glossary/cybersecurity) - [Data breach](https://joncopeland.multisites.ai/glossary/data-breach) - [Ransomware](https://joncopeland.multisites.ai/glossary/ransomware) - [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) - [ADA](https://joncopeland.multisites.ai/glossary/ada) ## Sources 1. [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) 2. [CISA: #StopRansomware Guide, preparation section](https://www.cisa.gov/stopransomware/ransomware-guide) 3. [HHS: Fact Sheet: Ransomware and HIPAA](https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/ransomware-fact-sheet/index.html) 4. [HHS: Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) 5. [ADA: Risk Management](https://www.ada.org/resources/practice/practice-management/risk-management) Written by Copeland Consulting Services and checked against the sources above on October 26, 2026. Rules, data and guidance change, so check the linked page before you act on it. ## Keep reading - [Dental practice compliance checklist: OSHA, HIPAA and infection controlA dental compliance checklist covers three federal areas: OSHA workplace safety, HIPAA privacy and security, and CDC infection control. OSHA has no dentistry-specific standard but applies general industry standards such as bloodborne pathogens. HIPAA covers patient information. Use the checklist to organize questions, then confirm requirements with your own advisers.](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) - [HIPAA for dental offices: a plain checklist for ownersHIPAA has three rules most dental offices must know: the Privacy Rule, the Security Rule and the Breach Notification Rule. The Security Rule asks for administrative, physical and technical safeguards for electronic patient information. After a breach, notice goes to patients and HHS, and sometimes the media. Ask a qualified adviser about your office.](https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices) - [Website accessibility for dental practices: a checklistThe U.S. Department of Justice says the Americans with Disabilities Act applies to the web services of businesses open to the public. It has no detailed web rule, so offices choose how to comply. Its guidance lists practical items: color contrast, alt text, captions, labeled forms and keyboard use. Ask an attorney about your office.](https://joncopeland.multisites.ai/blog/dental-website-accessibility) - [Dental practice KPIs and benchmarks: formulas, sources and limitsA dental practice KPI is a number the team tracks on a schedule, such as collections, overhead percentage, no-show rate or case acceptance. Few KPIs have an official benchmark. The ADA publishes survey averages for income and billings. Most other benchmarks online come from vendors, and formulas differ, so compare your own trend first.](https://joncopeland.multisites.ai/guides/dental-practice-kpis-and-benchmarks) - [Dental practice management: people, money, schedule, patients and complianceDental practice management is the business side of running a dental office: finances, scheduling, patient communication, insurance decisions, team systems and legal compliance. Track a few core numbers, build written systems, review them on a set schedule, and use federal and ADA sources for compliance basics.](https://joncopeland.multisites.ai/guides/dental-practice-management) - [Starting a dental practice: planning, funding and complianceStarting a dental practice means building the business from nothing: a plan, a startup cost list, funding from a lender, a licensed entity, a site, equipment, a team and compliance systems. The SBA publishes free planning tools. Cost depends on your plan, so get quotes. This guide is education, not legal, tax or financial advice.](https://joncopeland.multisites.ai/guides/starting-a-dental-practice) ## Talk with Dr. Copeland [Contact Dr. Copeland](https://joncopeland.multisites.ai/contact)[Email](mailto:drcopeland@joncopelanddds.com)