IT for Medical and Dental Practices in Virginia

Updated October 22, 2026

Small medical and dental practices carry the same HIPAA obligations as a hospital, usually without anyone on staff whose job is IT. They’re also a frequent ransomware target, because patient care can’t wait and attackers know practices are under pressure to pay.

This page is general information, not legal or compliance advice. The HHS Office for Civil Rights (OCR) publishes HIPAA guidance at hhs.gov/hipaa.

What HIPAA requires of your IT

The HIPAA Security Rule applies to electronic protected health information (ePHI). It’s written to be flexible by practice size, but some things aren’t optional.

A security risk analysis

The foundation of HIPAA compliance is a documented risk analysis: where ePHI lives, what could go wrong, and what you’re doing about it. It must be reviewed and updated periodically and when things change, like a new EHR, a new office, or a move to the cloud. Lack of a risk analysis is one of the most common findings in OCR enforcement actions.

HHS and the Office of the National Coordinator offer a free Security Risk Assessment Tool designed for small practices.

Safeguards

The Security Rule organizes requirements into administrative, physical, and technical safeguards. For a small practice, that translates to:

• Unique logins for every staff member, no shared accounts
• Access controls so staff see only what their role requires
• Automatic logoff on workstations in patient areas
• Encryption of laptops, phones, and backups
• Audit logs in your EHR and practice management system
• Backups and a contingency plan for getting back to seeing patients
• Workforce training with records showing it happened
• Written policies that match what you actually do

Business associate agreements

Any vendor that creates, receives, stores, or transmits ePHI for you needs a signed business associate agreement (BAA). That includes your EHR vendor, cloud backup provider, email provider, and your IT company. Microsoft and Google both offer BAAs for their business plans, but you must sign them and configure the service appropriately.

The technology a typical practice needs

• EHR / practice management, ideally cloud-hosted by a vendor that signs a BAA
• Business email with MFA and encryption available for messages containing patient information
• Imaging (for dental practices: sensors, panoramic and CBCT units, imaging software), which often needs a local server and specific compatible hardware
• Secure Wi-Fi with guest traffic separated from clinical systems
• Phones that integrate with scheduling and support after-hours messages
• Backups of the EHR, imaging, and email, including at least one copy offsite and protected from ransomware

Dental imaging: a special case

Dental offices often run imaging software on a local server, with sensors and X-ray units that only work with specific drivers and Windows versions. That creates two recurring problems:

1. Old operating systems. Imaging equipment sometimes requires a Windows version that no longer gets security updates. If you can’t upgrade, isolate those machines on their own network segment and limit their internet access.
2. Big data, slow restores. Imaging libraries grow large. Make sure your backup can restore them quickly, not just eventually.

Coordinate upgrades with your imaging vendor before changing operating systems or hardware.

Ransomware readiness for practices

• MFA on email, the EHR, and any remote access
• EDR on every workstation and server
• Immutable, offsite backups that are tested
• A downtime procedure: how you’ll check patients in, view schedules, and record care if systems are offline
• Your cyber insurer’s breach hotline and your HIPAA breach notification obligations in the incident plan

Questions to ask an IT provider

• Will you sign a business associate agreement?
• Have you supported practices using our EHR and imaging systems?
• Can you help us complete and update our HIPAA risk analysis?
• How do you handle machines that can’t be upgraded because of vendor requirements?
• How quickly could we be seeing patients again after a ransomware attack?