How do I make dental Wi-Fi HIPAA compliant?

Key facts

What does HIPAA actually require for Wi-Fi?

HIPAA doesn't mention Wi-Fi. The Security Rule's technical safeguards apply to any system that holds or transmits ePHI. Under 45 CFR 164.312, unique user identification is required, while encryption and transmission-security integrity controls are "addressable" (45 CFR 164.312). HHS explains that addressable doesn't mean optional. A practice must adopt the measure where it is reasonable and appropriate, or document why not and use an equivalent alternative (HHS). For office Wi-Fi carrying patient data, it's hard to argue that encryption is unreasonable.

The rule may get stricter. Davis Wright Tremaine reported in July 2026 that HHS pushed final Security Rule amendments from May 2026 to July 2027 and moved them to "long term actions" (DWT). Build to current best practice now rather than to the minimum.

Which Wi-Fi encryption should I use?

WPA3. The Wi-Fi Alliance says WPA3 is mandatory for Wi-Fi CERTIFIED devices, offers WPA3-Personal protection against password guessing and WPA3-Enterprise for sensitive networks, disallows outdated legacy protocols, and requires Protected Management Frames (Wi-Fi Alliance). For staff, WPA3-Enterprise with individual logins goes furthest toward the unique-user requirement. If older devices only support WPA2, put them on a separate SSID and plan their replacement.

How should patient guest Wi-Fi work?

Completely separate from practice systems. HHS's cybersecurity practices recommend guest networks in waiting areas that separate organizational data and systems and allow only authorized guest services (HHS 405(d) HICP). NIST says guest and internal WLANs should be logically separated so devices on one can't reach devices on the other (NIST SP 800-153). In practice that means a guest SSID on its own VLAN with internet-only access. For an open guest network without a password, the Wi-Fi Alliance's Wi-Fi Enhanced Open provides unauthenticated data encryption, an improvement over unprotected open networks (Wi-Fi Alliance). See VLAN design.

Should clinical devices use Wi-Fi at all?

Some shouldn't. Dentsply Sirona supports no wireless networks for its 3D imaging components (Dentsply Sirona). Dentrix says wireless networks are used at your own risk because of potential interference from X-ray machines, require professional installation, and should be Wireless-AC or higher if used (Dentrix). Wire imaging and fixed workstations; use Wi-Fi for tablets, laptops and phones. See network requirements for imaging.

How do I control who gets on the network?

Staff need unique credentials, not a shared password on a sticky note. Unique user identification is a required specification (45 CFR 164.312). With WPA3-Enterprise, each person signs in with their own account, and you remove that account when they leave. With a shared WPA3-Personal key, change it whenever staff depart.

Just as important: the practice should own the Wi-Fi controller and firewall admin accounts, not the IT vendor. If an outside IT company manages the network and will create, receive, maintain or transmit ePHI, HHS says a business associate agreement must be in place before it does (HHS). The free credential ownership checklist (coming soon) is planned to list every admin account the practice should own. See who owns dental office passwords.

How do I keep Wi-Fi secure after installation?

Standardize and check. NIST recommends standardized security configurations for access points and client devices, and periodic WLAN security assessments at least quarterly unless continuous monitoring already gathers the needed information (NIST SP 800-153). HHS also requires a periodic technical and non-technical evaluation of security measures, and a new one when the environment changes, such as adding new technology (HHS). A quarterly check might cover firmware updates, rogue access points, guest isolation tests and the user list.

What about physical security of access points?

Network closets should be locked, and unused wired ports disabled, per HHS (HHS 405(d) HICP). Ceiling-mounted access points are harder to tamper with than desk units. Place them for coverage, not convenience; see dental office Wi-Fi for AP density and placement.

When should Wi-Fi be planned?

During design, with the network. Access points need ceiling drops and PoE from the rack. The free network & IT plan generator (coming soon) is planned to turn your floor plan into a drops, rack, Wi-Fi and VLAN plan. FloorStack Studio (live, free plan) places access points in a 3D model of your office. See the HIPAA IT checklist and network design.

How FloorStack helps

FloorStack is a dental build-out platform that plans Wi-Fi, guest separation and the rest of the network before drywall. FloorStack Studio (live, free plan) places every access point. The network & IT plan generator and credential ownership checklist are free tools coming soon. Back to the Dental Office IT Setup hub.

Free tools for this step

• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.