Key Takeaways
- Cybersecurity risk extends beyond a dental practice’s own systems to vendors and other companies with access to sensitive information.
- Practices should know which outside providers have access to patient, financial, employee, and practice data and regularly review whether that access is still necessary.
- Information exposed in one breach can be used later to make phishing, payment, and credential-stealing scams far more convincing.
- Strong passwords, multifactor authentication, limited system access, and employee awareness remain important defenses.
- Cybersecurity is also a business and financial risk because an incident can disrupt billing, collections, operations, and cash flow while creating unexpected expenses.
Dental practices spend a lot of time thinking about protecting patient information inside the practice. But what happens when the potential security problem starts somewhere else?
A recent situation involving eAssist Dental Solutions is a timely reminder that cybersecurity risk doesn’t stop with your own computers, employees, or practice management system. It also includes the outside companies that have access to your data and systems.
In early September, eAssist notified customers that it was investigating a potential information security incident and had brought in outside experts to investigate. Separately, the DireWolf ransomware group listed eAssist on its extortion site and claimed access to the company’s systems. As of September 9, however, eAssist had not confirmed that customer or patient information had been compromised or identified what specific information, if any, was affected.
There is no reason for practices to panic or assume information has been stolen when an investigation is still underway. But there is every reason to use situations like this as a reminder to look at where your practice may be vulnerable.
Your Vendors Are Part of Your Cybersecurity Picture
Think about how many outside companies may interact with your dental practice’s information: billing and insurance companies, practice management software providers, payroll processors, banks, accountants, IT providers, payment processors, and others.
Depending on the relationship, those companies may have access to patient information, insurance portals, financial information, employee records, passwords, remote access tools, or other sensitive systems.
That means protecting your practice isn’t only about what happens inside your four walls. A security incident involving a vendor can potentially create risk for your practice even when your own systems weren’t the original target.
For dental practices subject to HIPAA, this is particularly important. The Department of Health and Human Services says conducting a risk analysis is foundational to identifying threats and vulnerabilities to electronic protected health information and determining the safeguards needed to address them.
This doesn’t mean practice owners need to become cybersecurity experts, but it does mean they should know which vendors have access to sensitive information, what those vendors can access, and whether that access is still necessary.
When Stolen Information Makes the Next Scam More Convincing
There’s another reason cybersecurity incidents deserve attention even when passwords or bank accounts aren’t known to have been stolen: seemingly ordinary personal information can make the next attack much more believable.
Cryptocurrency hardware-wallet company Trezor recently reported that a breach involving one of its third-party shipping providers exposed customer information, including names, email addresses, phone numbers and shipping addresses. Trezor warned affected customers that the information could be used for fraudulent emails, phone calls, or even physical letters.
That warning is particularly relevant because scammers have been sending convincing physical letters impersonating Trezor and other hardware-wallet companies. The letters direct recipients to scan a QR code for a supposed security or authentication check. The QR code instead leads to a fraudulent website designed to obtain the wallet’s recovery phrase. Trezor warns that it will never contact users by postal mail asking them to take action with their wallet and will never ask for a wallet backup, PIN, password, or authentication code.
The lesson applies well beyond cryptocurrency. Imagine receiving an email that appears to come from an insurance company and includes your practice name, provider information, and other details that only a legitimate business contact would seemingly know. Or a phone call about a payment that references an actual vendor relationship. The presence of accurate information can make a fraudulent request much harder to recognize.
That’s why a breach can have consequences beyond the initial exposure. Information taken from one source may later be used to create a much more targeted phishing, payment, or credential-stealing attempt.
A Good Time to Check the Basics
You don’t need to wait for a cybersecurity incident involving one of your vendors to review your practice’s protections.
Start by looking at who has access to what. Former employees, old vendors, and unused integrations shouldn’t retain access simply because no one remembered to remove it. Review remote-access permissions, administrative accounts, and connections to your practice management, insurance, billing, and financial systems.
Passwords also deserve attention. Avoid reusing passwords across systems and use multifactor authentication wherever it is available. The Cybersecurity and Infrastructure Security Agency recommends MFA particularly for email, remote access, and accounts that provide access to critical systems because it creates another barrier even if a password is compromised.
Your team matters, too. Make sure employees know that a message can contain accurate information and still be fraudulent. Unexpected requests to reset a password, change payment instructions, provide credentials, scan a QR code, or move money should be verified through a separate, trusted method rather than through the contact information provided in the message.
And if a vendor you use reports a possible security incident, don’t guess about what it means for your practice. Save the vendor’s communications, determine what access and information you share with that company, and contact the appropriate IT, cybersecurity, HIPAA compliance, insurance, or legal professionals to determine what action is appropriate.
Cybersecurity Is Also a Business Risk
Edwards & Associates is not a cybersecurity firm, and we aren’t going to tell you which firewall to buy or how to configure your network. But we do spend a lot of time helping dental practice owners protect the financial health of their businesses.
Cybersecurity belongs in that conversation. A security incident can affect much more than technology. It can interrupt billing and collections, expose financial information, create unexpected expenses, disrupt operations, and potentially affect patients and employees. HHS continues to identify ransomware and hacking as significant threats to healthcare organizations, with consequences that can include operational disruption and substantial financial costs.
The goal isn’t to assume the worst every time another company reports a possible breach. It’s to recognize that your practice is connected to a much larger network of vendors, systems, and people, and each connection deserves some attention.
While you may not be able to control what happens inside every company you work with, you can know who has access to your practice, limit that access to what is actually needed, strengthen the protections you control, and have a plan for what to do when something goes wrong.
Listen Now!
