IT Services for Dental Offices: Prices, Server Specs, HIPAA Rules and 267 Dental Breaches

By The Uptime Report Team · Last reviewed: October 2026

IT services for dental offices run the practice-management server, imaging storage, backups and security that HIPAA’s Security Rule (45 CFR 164.308 to 164.316) requires; at least 267 dental breach reports to HHS show where those defenses fail.

What do IT services for dental offices include?

IT services for dental offices cover six jobs: the practice-management server and database, the imaging network and its storage, backup and disaster recovery, endpoint and email security, HIPAA paperwork, and the business associate agreements with every vendor that touches patient data. Each job maps to a published vendor requirement or a section of 45 CFR Part 164, listed in the table below.

The dental version differs from general office IT in its software: a practice-management system such as Dentrix, Eaglesoft or Open Dental, plus imaging software bridged to it. Henry Schein One sells Dentrix as an on-premises system and Dentrix Ascend as its cloud alternative, so the first scoping question for any provider is whether a local server exists at all.

What does the HIPAA Security Rule require a dental office’s IT to do?

The HIPAA Security Rule requires a dental office to run a risk analysis, assign one security official, back up patient data, plan for disasters, give every user a unique login and keep its documentation for 6 years. Some implementation specifications are “Required” and others “Addressable”, which under the current text of 45 CFR 164.312 still includes encryption.

The table maps each safeguard section to the dental-office task it usually becomes. The section numbers and Required or Addressable labels are quoted from the eCFR as of October 2026; the task column is our editorial mapping, not regulatory text.

“Addressable” does not mean optional. Under 45 CFR 164.306(d)(3), an office must assess whether each addressable specification is reasonable and appropriate, and if it is not, document why and implement an equivalent alternative measure if one is reasonable and appropriate, so an unencrypted laptop needs a written reason. The safeguards apply equally to the IT provider, because a business associate “must” meet the same sections, per the opening words of 164.308.

Is the 2026 HIPAA Security Rule update in force?

No. As of 20 October 2026, the HIPAA Security Rule update that would require encryption and multi-factor authentication exists only as a proposed rule, published on 6 January 2025 as 90 FR 898 with comments closing on 7 March 2025. The Federal Register lists no final rule under its regulation number, RIN 0945-AA22, and HHS states that “the current Security Rule remains in effect.”

Some compliance vendor blogs headline the proposal as the “HIPAA Security Rule 2026”, which reads like a rule in force. The table separates what the eCFR says today from what the HHS fact sheet on the proposal would add, so a practice can plan for the proposal without buying against a rule that does not yet bind it.

The American Dental Association already recommends several of the proposed controls. Its March 2022 ADA News guidance tells practices to keep “multiple recent backups” that are “disconnected (inaccessible)” from office systems, and its March 2023 article adds full-disk encryption and an encrypted off-site copy.

What do Dentrix, Eaglesoft and Open Dental need from the server and network?

Dentrix, Eaglesoft and Open Dental publish different server rules. Patterson’s Eaglesoft sheet asks for 16 GB of server RAM, a dedicated server from 6 workstations and Windows Server from 10. Henry Schein One’s Dentrix G7.7 sheet asks for 8 GB up to 10 workstations and 16 GB above, and Open Dental flags the 20-connection cap on Windows 10 and 11 file shares.

The Dentrix sheet is the newest Henry Schein One requirements PDF we could retrieve, dated June 2022, and it predates Windows Server 2025, so confirm current figures for your Dentrix version with Henry Schein One. The Eaglesoft sheet is dated 08.11.2026 and adds three rules an IT provider breaks easily: McAfee VirusScan is “not compatible”, Microsoft Office 365 and Office 2019 are “not supported with any versions of Eaglesoft”, and Eaglesoft is “not supported with any WAN solution.”

Backup method is where general IT providers most often get dental systems wrong. Patterson’s Answer 206 has everyone log out, the server engine stopped, the Data folder copied, then the engine restarted, rotating 3 external drives for 15 daily and 3 monthly backups and keeping yearly copies 3 years. Open Dental’s backup guide sets a daily minimum and says “RAID is not a backup solution”; our backup and disaster recovery guide covers the restore testing HIPAA’s contingency plan expects.

Microsoft’s lifecycle page lists Windows 10 Home and Pro as retired in October 2025, and Open Dental dates its own end of Windows 10 support to 14 October 2025, so an operatory PC still on it gets security updates only if the practice pays for Microsoft Extended Security Updates ($61 per device in year one for businesses, doubling each year for up to three years), and Open Dental no longer supports it either way.

How much storage does dental imaging use?

Dental imaging storage grows by roughly 74 GB to 257 GB a year in the worked example below, using Planmeca’s published estimates of about 9 MB per 2D image and 50 MB to 1 GB per 3D scan. The image volumes are illustrative inputs, not survey data; replace them with your own daily counts from the imaging software.

Scan size matters more than scan count. With the same 30 2D images a day, a 1 TB RAID1 pair lasts 15.4 years with no CBCT, but 3.9 years at 4 scans a week of 1 GB and 1.8 years at 10. At Planmeca’s low estimate of 50 MB per scan, the same pair still lasts 11.3 years at 10 scans a week.

How often are dental offices breached, and how?

Dental entities filed at least 267 breach reports of 500 or more records with the HHS Office for Civil Rights from 2010 to 21 September 2026, in our hand-reviewed export of the breach portal. Hacking or IT incidents appear in 172 of them (64%), and the breached data sat on a network server in 126 (47%) and in email in 73 (27%).

Reports by year, with hacking or IT incidents in brackets: 2010 10 (1); 2011 7 (1); 2012 11 (1); 2013 9 (3); 2014 3 (1); 2015 9 (2); 2016 12 (5); 2017 12 (6); 2018 10 (5); 2019 25 (17); 2020 26 (16); 2021 25 (21); 2022 11 (8); 2023 21 (17); 2024 27 (21); 2025 20 (18); 2026 to 21 September 29 (29).

The cause shifted from stolen equipment to intrusions: theft appears in 62 of the 267 reports, 46 of them filed before 2019. The median report covered 4,391 people, and 188 reports (70%) involved fewer than 10,000, so most entries are single practices or small groups. Dental entities filed 20 of the 802 reports from all of healthcare in 2025, per the same export behind our Healthcare Data Breach Report 2026.

Email held the data in 73 reports, which puts mailbox controls such as filtering and sign-in protection inside dental IT scope; our email security guide lists the layers that stop those attacks.

Dental vendors are a supply-chain risk of their own. Twenty of the 267 reports were filed by dental entities acting as business associates or as a clearinghouse, led by Smile Brands, Inc. with 2,592,494 people and including Patterson Dental, the company behind Eaglesoft, and DentalXChange, a dental clearinghouse. The largest are below.

Method: we searched the 8,009-row HHS OCR breach portal export (Under Investigation and Archive lists, latest submission 21 September 2026) for names containing dental, DDS, dentist or dentistry, DMD, orthodont, endodont, periodont or oral surgery, which returns 254 candidates. Hand review removed 6: four employer benefit plans whose names include a dental plan (JHU/APL, Asarco, Erie Indemnity, North Hill Needham) and, by one rule applied to both, the two community health centers that offer dentistry alongside medical care (Lakewood Resource and Referral Center, Olde Towne Medical and Dental Center).

A second pass for maxillofacial, oral and facial, oral health, smile, braces, denture, teeth, perio and prosthodont, plus dental support organization names, added 19 reports whose names are clearly dental, such as Smile Brands, Andrews Braces and Fairfax Oral and Maxillofacial Surgery. The 267 are 235 providers, 19 business associates, 12 health plans and 1 clearinghouse.

The 267 is a floor: seven more names that may be dental (for example Smile Solutions, ProSmile Holdings and Fair Oaks Ortho) were left out because the name alone does not confirm it.

The counts are breach reports, not incidents: Professional Dental Alliance entities filed 11 reports on 1 October 2021, which is 11 of that year’s 25. The figures are a snapshot of the export dated 21 September 2026; OCR posts some reports weeks after submission, and the live portal checked on 20 October 2026 already showed at least one dental report posted after the export was taken (Young C. Park DDS, submitted 18 September 2026, under investigation). The portal lists only breaches of 500 or more people.

What happens if a dental office has a data breach?

A dental office that suffers a breach of unsecured patient data must notify each affected patient no later than 60 calendar days after discovery under 45 CFR 164.404. HHS must be told at the same time when 500 or more people are affected, and prominent media outlets in the state when more than 500 of its residents are involved. Smaller breaches go into a log reported to HHS once a year.

Ransomware counts. The HHS OCR ransomware fact sheet says that when ransomware encrypts patient data “a breach has occurred”, unless the office documents a “low probability” of compromise using the four factors in 45 CFR 164.402. The same fact sheet says a properly encrypted laptop that is powered off when lost holds no “unsecured PHI”, so no notice is required. Laptops appear in 15 of the 267 dental breach reports above.

OCR has also settled dental cases over disclosures made online. Elite Dental Associates of Dallas agreed to pay $10,000 in a settlement HHS posted in October 2019 over social media disclosures, and New Vision Dental of South Pasadena and Glendora, California, agreed to pay $23,000 in a resolution agreement HHS posted in December 2022 after the practice replied to Yelp reviews with patient details. Both sit among the 162 OCR actions in our HIPAA enforcement tracker data.

Does a dental IT provider have to sign a business associate agreement?

Yes. An IT provider that can access, store or transmit patient data on a dental office’s behalf is a business associate, and 45 CFR 164.308(b) lets the office use it only after “satisfactory assurances” documented in a written contract that meets 164.314(a). Vendor breaches are not rare in dentistry: 28 of the 267 dental breach reports (10%) list a business associate as present.

The first three terms below come from 164.314(a)(2)(i) and 164.410; the rest are what a practice should get in writing from an MSP before signing, and what an MSP should be ready to show.

1. The provider will comply with Subpart C of 45 CFR Part 164, as 164.314(a)(2)(i)(A) requires.
2. Subcontractors that handle patient data, such as the provider’s backup host, sign equivalent terms, per 164.314(a)(2)(i)(B).
3. The provider reports any security incident, including breaches, within a set period shorter than the 60-day ceiling in 164.410(b).
4. The backup method for each system is named: for Eaglesoft, the engine-stop copy in Patterson Answer 206; for Open Dental, a tool that handles a running database. Ask for the date and result of the latest restore test, since 164.308(a)(7)(ii)(D) treats testing as addressable.
5. Staff use multi-factor authentication on the remote access tool that reaches the server; our RMM vulnerabilities report shows remote support tools feeding ransomware, and our MFA statistics found only 1 in 9 online services supports phishing-resistant sign-in.
6. Supported versions are listed: practice-management version, imaging software, Windows edition (Eaglesoft needs Windows 11 Pro or Server, never Home), and antivirus product (Patterson lists McAfee VirusScan as not compatible and Windows Defender as supported).

How much do IT services for dental offices cost?

Five dental IT providers that publish prices list entry plans from $299 to $597 a month, with a median of $422 (one provider’s calculator default at 15 workstations), as of October 2026. The plans differ in what they cap and exclude: TST Support covers up to 15 computers, Siotek about 10 workstations, and DrewData one server with unlimited workstations, so price per seat ranges from about $20 to $56.

The five plans are not the same product: Darkhorse prices by workstation count, and $422 is its calculator default of 15 workstations with a local server, while Sodium Dental’s $597 buys 5 hours of remote support a month rather than unlimited support. Per seat at each plan’s cap, TST Basic works out to $19.93 ($299 / 15), Siotek to $39.90 ($399 / 10), Darkhorse to $28.13 (Silver) and $49.93 (Gold), and DrewData to $56 at 10 workstations; the general-business DPC plan runs $175 a user. The median uses one entry plan per dental provider: $299, $399, $422, $560 and $597.

For a practice on hourly support, the break-even sits between 2.0 and 5.0 billed hours a month at $150, and DrewData’s 1-hour minimum per request means several short calls reach it sooner. For an MSP quoting a dental office, the published list shows what buyers compare against: a seat cap, a backup allowance in TB or retention days, and an on-site visit count, with security tools such as EDR priced separately.

Which IT setup fits your dental practice?

The right setup for a dental practice follows from four measurable thresholds: workstation count against Patterson’s 6 and 10 and Open Dental’s 20-connection cap, whether 3D CBCT scans are stored on site, whether the backup can stop the database engine, and whether billed support exceeds 2.0 to 3.7 hours a month. The decision table and the flowchart carry the same rules.

How we compiled this

We compiled this from 40 primary documents accessed in October 2026: 11 eCFR sections, the Federal Register record for RIN 0945-AA22, 10 HHS and HealthIT.gov pages, 8 vendor requirement documents (including the Dentrix G7.7 and Eaglesoft Rev 040 sheets), 2 Microsoft Learn pages, 2 ADA News articles and 6 provider price pages. Breach figures are our own reviewed count of the HHS OCR portal export, method shown above. This is not legal advice.

Frequently asked questions

Does HIPAA say how long a dental office must keep patient records?

No. HHS says in its FAQ on record retention that “the HIPAA Privacy Rule does not include medical record retention requirements” and that state laws generally set the period. HIPAA does require safeguards for as long as records are kept, including at disposal, under 45 CFR 164.530(c). Security Rule documentation such as risk analyses is a separate 6-year rule in 164.316(b)(2).

Can a dental office email x-rays or records to a patient?

Yes, with reasonable safeguards. HHS FAQ 570 says the Privacy Rule lets providers use email with patients under 45 CFR 164.530(c), suggests checking the address before sending, and says unencrypted email is not prohibited for treatment messages if the amount of information is limited. A patient can also ask for communication by alternative means under 164.522(b).

Can a dental practice server run as a virtual machine?

Dentrix and Open Dental can; Eaglesoft cannot. Patterson’s Eaglesoft requirements say a virtual machine “is not supported” for any Patterson software and that Eaglesoft is not supported over any WAN. The Dentrix G7.7 sheet says Dentrix was tested on Hyper-V and VMware but does not support Terminal Services or Citrix, and Open Dental runs in a Windows virtual machine with dedicated drives advised.

Which antivirus works with Eaglesoft?

Patterson’s Eaglesoft hardware requirements (Rev 040, 08.11.2026) list McAfee VirusScan as not compatible and say AVG Free, Webroot and Avast are not recommended, while Windows Defender is supported and Windows Defender Firewall is recommended. Whatever product runs, Patterson says its port and executable exceptions in Answer 15372 should be added.

Does Eaglesoft work with Microsoft 365?

Not for Office integration. Patterson’s Eaglesoft sheet says Microsoft Office 365 and Office 2019 are “not supported with any versions of Eaglesoft”, Office 2016 has limited support from version 18, and Office 2013 is supported from version 17. Dentrix needs a Microsoft-supported version of Word with mail merge to print form letters, per its G7.7 sheet.

Can a dental office use Windows 11 Home on its computers?

Not with Eaglesoft: Patterson says it “is not supported with any version of Windows Home” and requires Windows 11 Professional. The Dentrix G7.7 sheet supports any Windows edition, including Home. Open Dental says Home editions are “sometimes unacceptable because of connection and networking limits” and names Pro and Business as the best editions.

Can a dental office back up to a USB drive?

Yes, if the drive is encrypted and rotated. Open Dental’s backup guide recommends encrypted USB drives, prefers hardware-encrypted drives, and suggests separate monthly archive copies. Patterson’s Answer 206 for Eaglesoft uses 3 rotating external drives for 15 daily and 3 monthly backups, plus a fourth drive for year-end copies kept off site for 3 years.

Sources

1. eCFR, 45 CFR 164.306 Security standards: General rules. Accessed October 2026.
2. eCFR, 45 CFR 164.308 Administrative safeguards. Accessed October 2026.
3. eCFR, 45 CFR 164.310 Physical safeguards. Accessed October 2026.
4. eCFR, 45 CFR 164.312 Technical safeguards. Accessed October 2026.
5. eCFR, 45 CFR 164.314 Organizational requirements. Accessed October 2026.
6. eCFR, 45 CFR 164.316 Policies and procedures and documentation requirements. Accessed October 2026.
7. eCFR, 45 CFR 164.402 Breach definitions. Accessed October 2026.
8. eCFR, 45 CFR 164.404 Notification to individuals. Accessed October 2026.
9. eCFR, 45 CFR 164.406 Notification to the media. Accessed October 2026.
10. eCFR, 45 CFR 164.408 Notification to the Secretary. Accessed October 2026.
11. eCFR, 45 CFR 164.410 Notification by a business associate. Accessed October 2026.
12. HHS Office for Civil Rights, Breach Portal: Breaches Affecting 500 or More Individuals. Accessed October 2026.
13. The Uptime Report, HHS OCR healthcare breaches 2009 to 2026 (CSV export of the HHS breach portal). Accessed October 2026.
14. HHS, Submitting Notice of a Breach to the Secretary. Accessed October 2026.
15. HHS, HIPAA Security Rule NPRM. Accessed October 2026.
16. HHS, HIPAA Security Rule NPRM Fact Sheet. Accessed October 2026.
17. Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 FR 898. Accessed October 2026.
18. HHS Office for Civil Rights, Fact Sheet: Ransomware and HIPAA. Accessed October 2026.
19. HealthIT.gov, Security Risk Assessment Tool v3.7. Accessed October 2026.
20. HHS, Elite Dental Associates resolution agreement. Accessed October 2026.
21. HHS, New Vision Dental resolution agreement and corrective action plan. Accessed October 2026.
22. Open Dental, Computer Requirements. Accessed October 2026.
23. Open Dental, MySQL. Accessed October 2026.
24. Open Dental, Backups. Accessed October 2026.
25. Planmeca, Planmeca Romexis system requirements. Accessed October 2026.
26. Henry Schein One, Dentrix or Dentrix Ascend. Accessed October 2026.
27. Microsoft Learn, Windows 10 Home and Pro lifecycle. Accessed October 2026.
28. Microsoft Learn, Extended Security Updates (ESU) program for Windows 10. Accessed October 2026.
29. ADA News, ADA advises dentists to be on alert for internet security risks (1 March 2022). Accessed October 2026.
30. ADA News, How to protect your dental practice from cyberattacks (3 March 2023). Accessed October 2026.
31. Henry Schein One, Dentrix G7.7 System Requirements (June 2022). Accessed October 2026.
32. Patterson Dental, Eaglesoft and CAESY Cloud Hardware and Network Requirements, Rev 040 (08.11.2026). Accessed October 2026.
33. Patterson Dental, Data Backup Recommendations, Answer ID 206. Accessed October 2026.
34. HHS, FAQ 580: Does HIPAA require covered entities to keep medical records for any period of time?. Accessed October 2026.
35. HHS, FAQ 570: Does HIPAA permit health care providers to use e-mail to discuss health issues with patients?. Accessed October 2026.
36. DrewData, Services and Rates. Accessed October 2026.
37. TST Support, home page plans. Accessed October 2026.
38. Siotek, Pricing. Accessed October 2026.
39. Darkhorse Tech, Pricing. Accessed October 2026.
40. Sodium Dental, Month to Month Support Agreement. Accessed October 2026.
41. Clutch, DPC Technology profile (Complete Care packages). Accessed October 2026.