Dental practices hold exactly what cyber criminals want: names, dates of birth, contact details, Medicare and health fund numbers, and sensitive health information. Health has consistently been the sector reporting the most data breaches to the Office of the Australian Information Commissioner (OAIC), and ransomware attacks on healthcare have risen sharply. Small and medium practices are targets too, often because they have fewer defences.
This guide gives practice owners and managers a practical, non-technical checklist for reducing the risk of a cyber attack and being ready to respond if one happens.
This article is general information. Work with a qualified IT provider for your practice's specific setup.
Key takeaways
- Dental practices are covered by the Privacy Act regardless of turnover, and must protect patient information and report eligible data breaches.
- Most attacks start with phishing emails, stolen passwords or unpatched systems.
- The Australian Signals Directorate's Essential Eight is a practical baseline, with multi-factor authentication, patching and backups the top priorities for most practices.
- Tested, offline or immutable backups are what let you recover from ransomware without paying.
- Have a written incident response plan before you need it, including how you'd keep seeing patients if systems went down.
Why dental practices are targets
- Valuable data: health and identity information can be used for fraud and extortion.
- Pressure to pay: a practice that can't access its appointment book or records can't operate.
- Smaller IT budgets: many practices rely on one server, shared passwords or old computers.
- Many entry points: email, remote access, practice software, imaging systems, card terminals and third-party vendors.
The Essential Eight, in plain English
The Australian Signals Directorate's Essential Eight are eight strategies to make attacks harder and limit the damage:
- Patch applications: keep software up to date, including browsers, PDF readers and practice software.
- Patch operating systems: keep Windows and other systems updated, and replace computers that no longer get security updates.
- Multi-factor authentication (MFA): require a second factor for email, remote access, practice software and anything accessible from the internet.
- Restrict administrative privileges: staff shouldn't use admin accounts for everyday work.
- Application control: only allow approved software to run.
- Restrict Microsoft Office macros: block macros from the internet, a common malware route.
- User application hardening: turn off risky features in browsers and other software.
- Regular backups: back up important data, store copies offline or in a way that can't be altered, and test restoring them.
If you do only three things this month, make them MFA everywhere, patching and tested backups.
A practical checklist for dental practices
Accounts and passwords
- Every staff member has their own login. No shared accounts
- MFA on email, practice software, remote access and cloud services
- A password manager for the practice
- Remove access promptly when staff leave
Devices and systems
- All computers on supported, updated operating systems
- Endpoint protection on every device, including the server and imaging PCs
- Remote access only through secure, MFA-protected methods, with no open remote desktop to the internet
- Separate networks for patient Wi-Fi and practice systems
Backups
- Automatic daily backups of practice software, imaging and documents
- At least one copy offline or immutable
- Test restores regularly and record the results
- Know how long a full restore would take
People
- Phishing training for all staff, including how to report suspicious emails
- A rule to verify by phone any request to change bank details or make urgent payments
- Clear guidance on what not to email or text, such as full medical histories
Vendors
- Know which vendors can access your systems or data, and how
- Check vendors' security, including MFA and breach notification. See patient data and AI vendors
- Consider cloud practice software if your on-premise server is hard to secure
If you're attacked
- Contain: disconnect affected devices from the network. Don't turn them off if your IT provider wants to investigate.
- Call your IT provider and your cyber insurer, if you have one.
- Report to the Australian Cyber Security Centre via ReportCyber, or call 1300 CYBER1 (1300 292 371).
- Assess whether it's an eligible data breach under the Notifiable Data Breaches scheme. If personal information is likely to cause serious harm, you must notify affected individuals and the OAIC. Assessments generally need to be completed within 30 days.
- Ransomware payments: businesses above the turnover threshold in the Cyber Security Act 2024 must report ransomware payments to the government. Get advice before considering any payment.
- Keep the practice running with your continuity plan.
Keep seeing patients during an outage
Your incident plan should cover:
- How to see today's appointment list if the practice software is down, for example a daily printed or offline copy
- How to contact patients to reschedule
- How to take payments and claims manually
- Who makes decisions and who talks to patients and staff
Phone and booking systems that run independently of your on-site server, such as cloud-based phone and AI receptionist services, can keep answering calls and taking messages while you recover.
Frequently asked questions
Is the Essential Eight mandatory for dental practices?
It's mandatory for many government agencies, not for private practices. But it's widely used as a baseline and increasingly expected by insurers.
Do we need cyber insurance?
Many practices find it worthwhile for incident response support and costs. Read what it covers and what security controls it requires.
What's the most common way practices get hacked?
Phishing emails and stolen or reused passwords are among the most common entry points, which is why MFA and staff training matter so much.
Next steps
This week, check that MFA is on for email and practice software, and ask your IT provider when backups were last restored successfully. For more on privacy duties, read our guide to patient data and AI vendors. To see how IntelliDent keeps answering calls from the cloud, book a demo.