A Massachusetts dental practice has to meet two sets of rules for patient data: the federal HIPAA Security Rule and the state’s own 201 CMR 17.00. In practice that means a documented risk analysis, a written information security program, encryption on laptops and data in transit, tested backups of your practice management and imaging data, and a signed business associate agreement with any IT provider that can reach patient records. Your IT provider should handle most of the technical work and keep the paperwork that proves it.
Key takeaways
- The HIPAA Security Rule that applies today is the current one. The proposed overhaul published in January 2025 is still not final, and the federal regulatory agenda now lists July 2027 for a final rule.
- A current, written risk analysis is the document regulators ask for first. HHS lists it as a required part of the Security Rule.
- Massachusetts adds its own requirements on top of HIPAA, including a written information security program and encryption of personal information on laptops and over public networks.
- Any IT provider with access to patient data is a business associate and needs a signed BAA before it touches your systems.
Which rules apply to a dental office in Massachusetts?
Two main ones. If you bill insurance electronically, you are a HIPAA covered entity, so the HIPAA Security Rule applies to every system that stores or sends electronic protected health information. Separately, because you hold names with Social Security numbers, driver’s license numbers or payment details for Massachusetts residents, 201 CMR 17.00 applies too. The state rule requires a written information security program, often called a WISP, plus specific technical controls such as encrypting personal information on laptops and portable devices and when it travels across public networks.
The two overlap a lot. One well-run security program can satisfy both, as long as it is written down and kept current. Our WISP guide explains what the Massachusetts document needs to cover.
Is the new HIPAA Security Rule in effect yet?
No. HHS published a proposed rule on January 6, 2025 (90 FR 898) that would turn many of today’s “addressable” safeguards into firm requirements. Among other things it proposes mandatory multi-factor authentication, encryption of patient data at rest and in transit, a written inventory of technology assets with a network map, and written procedures to restore critical systems and data within 72 hours.
That rule has not been finalized. The current federal regulatory agenda lists it as a long-term action with a final rule planned for July 2027, and those dates have slipped before. Until a final rule is published, the existing Security Rule is what HHS enforces.
Our advice is to start on the proposed controls now anyway. MFA, encryption, an asset inventory and fast restores are good practice regardless of the final wording, and they are what ransomware crews test first.
What does the risk analysis need to cover?
A risk analysis lists where patient data lives, what could go wrong with each system, how likely and how bad that would be, and what you are doing about it. For most practices that means the practice management server or cloud service, imaging workstations and sensors, front desk computers, email, phones, backups, and every vendor with remote access. HHS publishes guidance on risk analysis, and the federal Security Risk Assessment Tool is a free starting point for small practices.
Enforcement keeps coming back to this document. The settlements listed on HHS’s resolution agreements page repeatedly cite a missing or outdated risk analysis. Update yours at least once a year and after any big change, such as a new practice management system or a second location.
What should your IT provider handle for a dental practice?
- Imaging and practice management. Keep the server or cloud connection, imaging software and sensor drivers patched and compatible. Imaging workstations are often the oldest computers in the building, so plan their replacement before support ends.
- Backups that restore. Back up the practice management database and imaging files every night, keep a copy offsite, and test a restore on a schedule. A backup nobody has restored is a guess.
- Accounts and access. MFA on email and remote access, separate logins for every staff member, and same-day removal when someone leaves.
- Network separation. Patient and guest Wi-Fi on a separate network from the clinical systems.
- Vendor remote access. Software and imaging vendors often need to connect in. That access should be approved, logged and turned off when the session ends.
- Documentation. An up-to-date asset list, network diagram and record of what was done, so the risk analysis and WISP reflect reality.
Our page on dental IT support in Boston covers how we set this up for practices across Greater Boston.
What happens if patient data is breached?
Under the HIPAA Breach Notification Rule you must notify affected patients without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also go to HHS within 60 days and, in most cases, to local media. Massachusetts has its own breach notification requirements, including notice to the Attorney General and the Office of Consumer Affairs and Business Regulation. Your IT provider should be part of your incident plan, so the first hours of an incident go to containment and evidence, not searching for phone numbers.
Frequently asked questions
Does our IT company need to sign a business associate agreement?
Yes, if it can access, store or transmit patient data, which nearly every managed IT provider can. Sign the BAA before onboarding starts.
Is cloud practice management software automatically HIPAA compliant?
No. The vendor secures its own platform, but your logins, devices, network and staff habits are still your responsibility.
How often should a dental practice update its risk analysis?
At least once a year, and whenever you add a location, change major software or have a security incident.
Do we need both a HIPAA program and a Massachusetts WISP?
You need to meet both sets of requirements, but one well-documented program can cover both if it addresses each rule’s specific items.
If you can’t say with confidence when your practice’s backups were last restored or when your risk analysis was last updated, Boston Managed IT will review both with you for free. Call (617) 322-5155 or visit bostonmit.com/contact to book a 15-minute dental IT and HIPAA review.
— Boston Managed IT
