Which firewall should a dental office use?
On this page
- Key facts
- Why isn't there a single "best" dental firewall?
- What features should a dental office firewall have?
- How long should a dental firewall last?
- How should it be configured on day one?
- Should the firewall be bought or leased from the MSP?
- Which free tools help with this?
- How FloorStack helps
- Free tools for this step
- Frequently asked questions
- Sources
Choose any business-class firewall that will stay under vendor support for your whole plan, runs intrusion prevention, handles your VLANs and protects remote access with MFA. In 2026, support life matters most: CISA urges organizations to replace end-of-support edge devices immediately, and its BOD 26-02 (February 5, 2026) targets them (CISA; CISA fact sheet). Brand matters less than configuration.
Key facts
| Item | What the source says | Source |
|---|---|---|
| No product endorsement | OCR "does not endorse, certify, or recommend specific technology or products" | HHS cloud guidance |
| Firewall role | Creates a "buffer zone" between your network and outside networks | HICP Technical Volume 1 |
| IPS | Most modern segmenting firewalls include an IPS component; enable automatic updates | HICP Technical Volume 1 |
| Rule sets | Default-deny inbound and outbound at the perimeter whenever possible | HICP Technical Volume 2 |
| End of support | EOS edge devices are "trivial" to exploit; inventory EOS dates and replace | CISA |
| Federal directive | BOD 26-02 (Feb 5, 2026) binds federal agencies, but CISA, FBI and NCSC urge all organizations to follow it | CISA fact sheet |
| Remote access | Phishing-resistant MFA for VPNs; don't expose RDP | CISA |
Why isn't there a single "best" dental firewall?
Because HIPAA is technology-neutral, and so is HHS. The Security Rule sets safeguards, not brands, and OCR says it doesn't endorse specific technology or products (HHS). The firewall your MSP knows well and keeps patched will protect you better than a premium box nobody manages. FloorStack stays vendor-neutral for the same reason: we don't sell hardware.
What a dental office does need is specific. You'll have imaging traffic that must stay fast, cameras and phones that should be fenced off, guest Wi-Fi in the waiting room, and vendors who need remote support. The firewall is where all of that is enforced.
What features should a dental office firewall have?
| Requirement | Why it matters for a dental office |
|---|---|
| Vendor support through your plan | Firmware and security fixes end at EOS; CISA calls EOS edge devices trivial to exploit (CISA) |
| Intrusion prevention with auto-updates | HHS 405(d) recommends IPS and automatic updates (HICP Technical Volume 1) |
| VLAN and inter-zone rules | Separate clinical, imaging, phones, cameras and guest (HICP Technical Volume 1) |
| Default-deny policy support | HHS 405(d) recommends default-deny at the perimeter (HICP Technical Volume 2) |
| VPN with MFA | CISA recommends phishing-resistant MFA for VPNs (CISA) |
| Dual WAN failover | Keeps claims, phones and cloud PMS up when the main circuit drops |
| Throughput with inspection on | Spec sheets quote raw speed; size to your circuit with IPS enabled |
| Logging you can keep | Supports HIPAA information system activity review (45 CFR 164.308) |
| Owner-held admin account | The practice, not just the MSP, can log in |
How long should a dental firewall last?
As long as the vendor supports it, and no longer. Check the vendor's published end-of-sale and end-of-support dates before you buy, and pick a model with support well past your planned refresh. CISA's guidance to all organizations is to keep an asset inventory that captures every edge device and its EOS date, track upcoming dates with reminders, and replace EOS devices (CISA).
This isn't theoretical. In February 2026 CISA issued BOD 26-02 on end-of-support edge devices, and with the FBI and the UK's NCSC warned that nation-state actors exploit EOS firewalls, routers and VPN gateways; the directive binds only federal agencies, but the agencies "strongly encourage" everyone to follow it (CISA fact sheet). Earlier, CISA's Emergency Directive 25-03 targeted threat actors persisting in Cisco ASA and Firepower firewall products (CISA ED 25-03). Every major brand has had advisories; what protects you is patching and replacing on schedule.
How should it be configured on day one?
- Change the default admin credentials and disable unused management interfaces (CISA).
- Don't expose management or RDP to the internet. CISA says not to expose services such as RDP on the web (CISA).
- Default-deny between zones, then open only what imaging, PMS and phones need (HICP Technical Volume 2).
- Put cameras and IoT in restricted zones (HICP Technical Volume 1).
- Guest Wi-Fi on its own network, with access to guest services only (HICP Technical Volume 1).
- Vendor remote access through controlled interfaces only, limited to the systems their role requires (HICP Technical Volume 1).
- Tune IPS in monitor mode first, then switch to prevention, as HHS 405(d) suggests for first deployments (HICP Technical Volume 2).
- Back up the configuration and store it with the network map (how to document a dental client's network).
The segmentation design itself is covered in dental office network design, and the full go-live list is in the IT onboarding checklist for a dental startup.
Should the firewall be bought or leased from the MSP?
Either works if the practice owns the admin account and the license is registered to the practice. If the firewall is part of a managed bundle, the contract should say what happens to the device, its configuration and its license at termination. See dental IT contract clauses.
Which free tools help with this?
The network & IT plan generator (free tool, coming soon) is planned to turn a floor plan into a network, drop and rack plan. The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ).
How FloorStack helps
FloorStack is a dental build-out platform that puts the firewall on the plan where it belongs. Studio (live, free to start) places the rack, firewall and every network device on your floor plan, and paid plans track each device's model, serial and warranty and flag end-of-life gear (FloorStack). The free Network & IT plan generator (coming soon) will draft zones and drops from your floor plan, and the free Credential ownership checklist (coming soon) confirms the practice holds the firewall admin login. Visit the Dental Office IT Setup hub.
Free tools for this step
- Network & IT plan generator: zones, VLANs and drops from your floor plan (free tool, coming soon).
- Credential ownership checklist: confirm owner-held firewall admin (free tool, coming soon).
- Studio: place the rack and network gear on the plan (live).
Frequently asked questions
Does HIPAA require a specific firewall brand?
No. OCR doesn't endorse specific products (HHS). Choose on support life, features and how well it's managed.
Is the ISP's router good enough?
Usually not for a dental office, because you need zones, IPS, MFA-protected VPN and logs you control.
What does "end of support" mean for my firewall?
The vendor stops shipping security fixes. CISA urges organizations to replace EOS edge devices (CISA).
Do I need the security subscription?
If you want IPS signature updates, generally yes. HHS 405(d) recommends IPS with automatic updates (HICP Technical Volume 1).
Should vendors have a permanent VPN into the office?
No. Give them controlled, role-limited access (HICP Technical Volume 1), with MFA, and remove it when the work ends.
Who should hold the firewall admin password?
Both the MSP (named account) and the practice (owner-held admin), stored in a vault the practice controls.
Sources
- FloorStack: Frequently asked questions
- HHS: Guidance on HIPAA & Cloud Computing
- HHS 405(d): HICP Technical Volume 1 (PDF)
- HHS 405(d): HICP Technical Volume 2, Medium and Large Organizations (PDF)
- CISA: Edge Device Security
- CISA, FBI and NCSC: Reducing the Attack Surface for End-of-Support Edge Devices
- CISA: ED 25-03, Identify and Mitigate Potential Compromise of Cisco Devices
- CISA: #StopRansomware Guide
- 45 CFR 164.308, Administrative safeguards (LII)
- FloorStack home page
More in Dental Office IT Setup
- Pricing IT Projects for Dental New BuildsHow MSPs should price IT for a dental new build in 2026: phases, cabling, hardware BOM, labor, allowances, change orders and milestone billing tied to the plan.5 min read
- Dental Office IT Setup Checklist for New PracticesA 2026 IT setup checklist for new dental practices: software choice, specs, cabling, rack, network, internet failover, backups, accounts and go-live tests.6 min read
- Dental Office Network Design: A 2026 Planning GuideHow to design a dental office network in 2026: wired gigabit to every PC, segmented VLANs, a locked rack and vendor specs from Dentrix, Eaglesoft, Open Dental.7 min read
- Dental Server vs. Cloud: What Your Software Needs (2026)Does your dental practice need a server in 2026? Dentrix and Eaglesoft do; Curve and Dentrix Ascend don't. Compare vendor specs, internet needs and imaging.6 min read
- How Many Network Drops per Dental Operatory? (2026)Most dental operatories need 3 to 6 network drops in 2026. Here's how to count them from your equipment list, plus cable type, run limits and timing.6 min read
- Dental Office Wi-Fi: Access Point Placement on Your Floor PlanPlan dental office Wi-Fi in 2026: about one access point per 1,200-2,000 sq ft, ceiling drops before drywall, a separate guest network, and wired imaging.5 min read