What belongs on a HIPAA IT checklist for opening a dental office?

Key facts

How to use this checklist

The Security Rule is "flexible, scalable, and technology neutral." It doesn't name products. It requires you to choose safeguards based on your size, setup, costs and risks (HHS).

Items marked "required" must be done. "Addressable" doesn't mean optional. You implement it if it's reasonable and appropriate. If it isn't, you document why and adopt an equivalent alternative where reasonable (HHS).

This list covers IT. It isn't legal advice, and state law can add duties such as breach-notification timelines (CISA). For the hardware and network side of opening, use the dental office IT setup checklist.

Checklist: before you buy anything

• Confirm you're covered. If you'll file claims or check eligibility electronically, you are (HHS).
• Name a security official. One person must be assigned security responsibility (45 CFR 164.308). In a startup, that's usually the doctor or office manager.
• Map where patient data will live. Include the PMS, imaging, email, backups, scanners, phones and any cloud services. OCR lists mapping where ePHI flows among its recommended steps (HHS, March 2026).
• Decide on server vs. cloud, because it changes who holds the data and which BAAs you need (server vs. cloud).

Checklist: vendors and BAAs

• Sign a BAA with the IT provider, cloud PMS, backup vendor, email host and anyone else who creates, receives, maintains or transmits ePHI for you (HHS). HHS publishes sample provisions (HHS sample BAA).
• Treat cloud vendors as business associates even if they only store encrypted data and have no key (HHS cloud guidance).
• Check the data-return terms. HHS says a business associate may not block your access to PHI, including in a payment dispute (HHS FAQ 2074).

To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.

Checklist: build-out (physical safeguards)

• Lock the network closet. HHS 405(d) says data and network closets should always be locked (HICP Technical Volume 1).
• Place screens so patients can't read them. The rule covers workstation use and security (HHS).
• Separate guest Wi-Fi from clinical systems (HICP Technical Volume 1; network design).
• Plan camera placement away from treatment areas (security cameras).
• Write a device and media policy: how hardware enters, leaves and gets wiped (HHS).

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

Checklist: before go-live (technical safeguards)

• Unique logins for every user, with access by role (HHS).
• Turn on audit logs in the PMS and email, and decide who reviews them. Information system activity review is required (45 CFR 164.308).
• Encrypt laptops, servers and backups. Encryption is addressable today. HHS wrote in 2025 that it "generally would be reasonable and appropriate" (Federal Register).
• Require MFA on email, remote access and admin accounts. CISA recommends phishing-resistant MFA for all services, particularly email, VPNs and accounts that reach critical systems (CISA).
• Never expose remote desktop directly to the internet (CISA).

Checklist: backup and recovery

• Data backup plan (required) (45 CFR 164.308)
• Disaster recovery plan (required)
• Emergency mode operation plan (required): how the front desk works if the PMS or internet is down (internet failover)
• Test a restore before opening day. Testing is addressable, but an untested backup is a guess (dental data backup).

To turn this into a drawing your low-voltage contractor can bid, the free network & IT plan generator (coming soon) is planned to produce drops, rack, Wi-Fi and VLAN plans from your floor plan.

Checklist: people and paperwork

• Run the risk analysis and record a risk management plan. Use the free HHS/ONC SRA Tool, which runs on Windows and stores data locally (HealthIT.gov).
• Train every staff member on security, including phishing and passwords (HHS).
• Write an incident response procedure (required) (45 CFR 164.308).
• Write termination procedures that remove access the day someone leaves (45 CFR 164.308).
• File everything for 6 years (HHS).

Why is OCR so focused on the risk analysis?

Because it's the one document that justifies everything else. OCR's Risk Analysis Initiative reached its 12th enforcement action in March 2026, a settlement with MMG Fusion. OCR said a 2020 intrusion affected about 15 million people and found the company had failed to conduct an accurate and thorough risk analysis (HHS, March 5, 2026).

What would the proposed rule add?

Among other changes, it would require encryption of ePHI at rest and in transit, with limited exceptions, and consistent configuration of systems including workstations (HHS NPRM fact sheet). It isn't law. The Unified Agenda lists it under "Long-Term Actions," targeting July 2027 (Reginfo.gov). Attorneys at Davis Wright Tremaine noted the date had moved from May 2026 (DWT, July 2026). The current rule stays in effect meanwhile (HHS fact sheet).

From an MSP's chair: encryption, MFA and an accurate asset inventory cost little in a new office and a lot to retrofit. Build them in now.

How FloorStack helps

A risk analysis starts with knowing what devices you have. The free FloorStack Studio plan, part of the FloorStack dental build-out platform, places every device on your floor plan, which gives you a starting inventory for the SRA. FloorStack plans technology. It isn't built to hold patient records. Start a free Studio plan, see the Dental Office IT Setup hub, and read who owns your dental office passwords.

Free tools on the FloorStack dental build-out platform for this step: Network & IT plan generator (free tool, coming soon) and Credential ownership checklist (free tool, coming soon).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.