Can a dentist respond to a patient's online review by discussing their treatment?

No. Even if a patient publicly posts about their experience, HIPAA does not allow a provider to disclose or confirm protected health information without the patient's authorization.

What types of cybersecurity incidents commonly cause HIPAA breaches in dental practices?

Common cybersecurity incidents include phishing attacks, ransomware infections, malware, compromised email accounts, and unauthorized access to cloud-based systems containing protected health information.

Why should dental practices perform regular HIPAA risk assessments?

Regular risk assessments help identify security vulnerabilities before they are exploited by attackers, allowing practices to strengthen safeguards, improve compliance, and reduce the likelihood of reportable HIPAA breaches.

What is the HIPAA Minimum Necessary Standard?

The Minimum Necessary Standard requires covered entities and business associates to access, use, or disclose only the minimum amount of protected health information needed to perform an authorized task or business function.

Brace Yourself: 9 Examples of Dental HIPAA Violations

Example H2

🔒 Dental HIPAA Violations: Common Breaches & Lessons for Protecting Patient Data

HIPAA violations can occur through employee mistakes, improper disclosures, vendor failures, phishing attacks, ransomware, or inadequate data disposal practices. Real-world dental industry breaches demonstrate that responding to online reviews with protected health information (PHI), failing to secure business associates, and neglecting cybersecurity safeguards can result in investigations, costly penalties, reputational damage, and mandatory corrective action plans. Strong employee training, vendor oversight, and regular security assessments are essential for protecting patient privacy.

The Four Most Common Causes of Dental HIPAA Breaches

👥 Employee Privacy Violations: Sharing PHI without authorization, discussing patient information publicly, or disclosing health information in online review responses violates HIPAA.
💻 Cybersecurity Attacks: Phishing emails, ransomware, malware, and compromised email accounts continue to expose thousands of patient records across dental organizations.
🤝 Vendor & Business Associate Risks: Third-party technology providers, cloud services, and software vendors can create HIPAA compliance risks if contracts and security controls are inadequate.
🗂️ Poor Records Management: Improper disposal of paper records or failure to securely transfer electronic health records can result in reportable data breaches and regulatory enforcement.

The Health Insurance Portability and Accountability Act (HIPAA) requires standards to protect patients’ health information so that it isn’t disclosed without proper consent. Improper disclosure can happen for many reasons, resulting in a reportable violation.

Sometimes human error causes these violations. Workforce members may intentionally share PHI, send data to the wrong individual, or improperly dispose of PHI. Other times, breaches occur when hackers find and exploit cybersecurity vulnerabilities.

Dental practices have had their share of violations. Some of these breaches resulted from intentional actions, but others were out of the practices’ control.

Here are nine examples of dentists and dental practices that suffered HIPAA breaches.

Anchorage, Alaska Dentist

Alaskan dentist Dr. Seth Lookhart performed a tooth extraction on a sedated patient while riding a hoverboard. The dentist had the extraction filmed, then sent the video to several people. He joked that performing oral surgery while on a hoverboard was the “new standard of care.”

The patient said she didn’t consent to the filming of the procedure, so Lookhart violated her privacy by both the filming and sending the video. She also did not consent to have her tooth taken out while the dentist was on a hoverboard.

The state filed a lawsuit that charged Lookhart with “unlawful dental acts.” He was also found guilty for committing medical assistance fraud for billing Medicaid for procedures that were unnecessary or not justified. The case led to Lookhart’s conviction on 46 felony and misdemeanor counts. The judge scheduled sentencing for April 30, 2020.

Elite Dental Associates

A patient submitted a complaint to the Office for Civil Rights (OCR) against Elite Dental Associates after an incident on the business review platform Yelp. The practice responded to a review by disclosing the reviewer’s last name and details about their health condition.

Through an investigation, the OCR found that this wasn’t the first time the practice violated patient data. Elite had disclosed protected health information (PHI) of other patients in response to reviews on its Yelp page. Not only did Elite violate patient privacy, but they also didn’t have a Notice of Privacy Practices that complied with the HIPAA Privacy Rule.

Elite received a fine due to the several violations. The practice paid $10,000 to settle their improper disclosures of PHI. This fine was substantially low since each violation could have been up to $50,000. With several previous uncorrected violations, Elite might have faced a fine as much as $1.5 million.

But OCR accepted the low settlement because of Elite’s size, financial circumstances, and cooperation. Elite also had to adopt a corrective action plan to settle the violations. This includes two years of monitoring by the OCR for compliance with HIPAA regulations.

Canyon Ridge Endodontics

In August 2019, a patient posted a harsh review on Yelp about a dental procedure she received. This prompted a backlash from the doctor.

The endodontist responded to the claims with the patient’s specific dental history details and procedures since 2013. The doctor’s goal was to prove that the patient’s dental problems were not his fault.

An anonymous tipster filed a complaint with the Arizona State Board of Dental Examiners, worried that the information violated HIPAA. The doctor wrote in his response that since the patient put her grievances online, she had forfeited her right to confidentiality.

An outside attorney who was not involved in the case said that this is not how it works. If a patient posts a comment about a provider, it doesn’t give the provider permission to disclose any PHI.

Key Dental Group

When the Florida-based Key Dental Group switched providers, it requested its former vendor to return its EMR database. The end-user license agreement (EULA) stated that the vendor must return all patient data after the termination of the agreement. But the vendor refused.

The practice said that the vendor violated HIPAA since it was a business associate. Since the violation could’ve led to unauthorized access of PHI, the security breach required the practice to notify patients.

Key Dental Group couldn’t access, track, or protect the database from unauthorized access after the termination of the EULA. Since there was no way to determine if there was wrongful access, it was necessary to send notifications.

Delta Dental of Arizona

Delta Dental Arizona noticed suspicious activity with an employee’s email account in July 2019. After launching an investigation, it found that the employee fell for an email phishing attempt. An unauthorized individual gained access to the account through the scheme.

Delta Dental Arizona had no evidence of data misuse within the account, but couldn’t rule out the possibility. The practice took steps to identify all data within the compromised account so that it could notify affected individuals.

Advantage Dental

The Oregon-based company Advantage Dental provides dental services for over 30 clinics. In 2015, it discovered that hackers used malware to access its internal computer systems over three days.

As soon as the company detected the activity, it shut off access to the data. But Advantage Dental determined that the attackers had already access patient information. This is a reportable HIPAA breach since it exposed Social Security numbers along with names and contact information.

Advantage Dental’s investigation determined the affected records of over 150,000 customers. The investigation found no evidence that hackers used information for criminal activity.

Digital Dental Record

The software company Digital Dental Record suffered a breach of its backup solution in August 2019. About 900 practices were using the company’s medical record backup service, DDS Safe. Hackers accessed DDS Safe through a ransomware attack on its cloud management provider, PerCSoft.

The attack affected nearly 400 dental practices that use the DDS system. PerCSoft used a third-party software company to get a decryptor to recover the client files. Recovery time took between 30 minutes to four hours for some clients, according to DDS. For some practices, the decryption process didn’t work and they still lost files.

Complete Technology Solutions

Complete Technology Solutions (CTS) provides IT services to dental offices. CTS suffered a ransomware attack in November 2019 that affected more than 100 dental practices’ services.

CTA declined to pay the $700,000 ransom to unlock the affected systems at all dental locations. The impact was different for all CTS clients. Some were able to use backups of their data available off-site. One dental practice received no help from its insurance and it experienced a great loss of income.

Others had to work with outside experts to negotiate and pay the ransom only for their office. Two sources said that they received several ransom notes. Once they paid the attackers, the decryption key only unlocked some of their files. This caused them to spend more time and money to get all the keys needed to restore full access.

Kokomo, Indiana Dentist

The Indiana Attorney General’s Office sued Dr. Joseph Beck for improper disposal of PHI. In 2011, the Indiana Board of Dentistry revoked Beck’s license for negligence and fraudulent billing. But in 2013, the dentist received a fine of $12,000 from the state. This was the first time that the state’s Attorney General’s Office sued for a HIPAA violation.

Beck had hired the data company Just the Connection Inc. to retrieve and destroy paper records from his former patients. But more than 60 boxes of the patient records ended up in the recycling dumpster of a church. The boxes contained records from 2002-2007 of almost 7,000 files from his former Comfort Dental practice. There was no reported identity theft.

Conclusion

In order to avoid exposing sensitive information to malicious attackers, dentists need to stay vigilant…

Employees must have proper training, so they don’t incorrectly disclose PHI.
Regular risk assessments must occur to identify system vulnerabilities before a hacker does.
Vendors must be thoroughly reviewed to ensure that they’re trustworthy.

Achieving all three of these preparations will ensure that you’re making the best effort to protect your patient’s privacy through security. Although data breaches may still occur due to situations outside of your control, staying prepared ensures you’re adhering to the Minimum Necessary Standard.

❓ Dental HIPAA Compliance FAQ

What are the most common HIPAA violations in dental practices?

Common violations include responding to online reviews with protected health information (PHI), phishing attacks that compromise email accounts, ransomware infections, improper disposal of patient records, and unauthorized disclosures by employees or third-party vendors.

Can a dental practice respond to negative online reviews?

Yes, but practices must never disclose protected health information when responding. Even if a patient publicly discusses their treatment, HIPAA does not permit a provider to reveal or confirm details about the patient's care without authorization.

How can dental practices reduce the risk of HIPAA breaches?

Reducing HIPAA risk requires a combination of administrative, technical, and physical safeguards.

Train Employees Regularly on HIPAA Privacy and Security Rule requirements.
Perform Routine Risk Assessments to identify cybersecurity vulnerabilities before attackers exploit them.
Vet Business Associates and maintain compliant Business Associate Agreements (BAAs) with vendors handling PHI.
Securely Dispose of Records using approved destruction methods for both paper and electronic health information.

Why are phishing attacks such a major HIPAA risk?

Phishing emails can trick employees into revealing login credentials, allowing attackers to access email accounts and systems containing protected health information. These incidents often trigger breach notifications, investigations, and remediation efforts even when there is no confirmed misuse of patient data.

What is the Minimum Necessary Standard under HIPAA?

The HIPAA Minimum Necessary Standard requires healthcare organizations to limit the use, disclosure, and access of protected health information to only the minimum amount needed to perform a specific job or accomplish an authorized purpose. Following this principle helps reduce the likelihood and impact of data breaches.

Emphasize your product's unique features or benefits to differentiate it from competitors

In nec dictum adipiscing pharetra enim etiam scelerisque dolor purus ipsum egestas cursus vulputate arcu egestas ut eu sed mollis consectetur mattis pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus mauris aliquam ornare nisl purus at ipsum nulla accumsan consectetur vestibulum suspendisse aliquam condimentum scelerisque lacinia pellentesque vestibulum condimentum turpis ligula pharetra dictum sapien facilisis sapien at sagittis et cursus congue.

Pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus.
Justo urna nisi auctor consequat consectetur dolor lectus blandit.
Eget egestas volutpat lacinia vestibulum vitae mattis hendrerit.
Ornare elit odio tellus orci bibendum dictum id sem congue enim amet diam.

Incorporate statistics or specific numbers to highlight the effectiveness or popularity of your offering

Convallis pellentesque ullamcorper sapien sed tristique fermentum proin amet quam tincidunt feugiat vitae neque quisque odio ut pellentesque ac mauris eget lectus. Pretium arcu turpis lacus sapien sit at eu sapien duis magna nunc nibh nam non ut nibh ultrices ultrices elementum egestas enim nisl sed cursus pellentesque sit dignissim enim euismod sit et convallis sed pelis viverra quam at nisl sit pharetra enim nisl nec vestibulum posuere in volutpat sed blandit neque risus.

Elit odio tellus orci bibendum dictum id sem congue enim amet.

Use time-sensitive language to encourage immediate action, such as "Limited Time Offer

Feugiat vitae neque quisque odio ut pellentesque ac mauris eget lectus. Pretium arcu turpis lacus sapien sit at eu sapien duis magna nunc nibh nam non ut nibh ultrices ultrices elementum egestas enim nisl sed cursus pellentesque sit dignissim enim euismod sit et convallis sed pelis viverra quam at nisl sit pharetra enim nisl nec vestibulum posuere in volutpat sed blandit neque risus.

Pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus.
Justo urna nisi auctor consequat consectetur dolor lectus blandit.
Eget egestas volutpat lacinia vestibulum vitae mattis hendrerit.
Ornare elit odio tellus orci bibendum dictum id sem congue enim amet diam.

Address customer pain points directly by showing how your product solves their problems

Vel etiam vel amet aenean eget in habitasse nunc duis tellus sem turpis risus aliquam ac volutpat tellus eu faucibus ullamcorper.

Tailor titles to your ideal customer segment using phrases like "Designed for Busy Professionals

Sed pretium id nibh id sit felis vitae volutpat volutpat adipiscing at sodales neque lectus mi phasellus commodo at elit suspendisse ornare faucibus lectus purus viverra in nec aliquet commodo et sed sed nisi tempor mi pellentesque arcu viverra pretium duis enim vulputate dignissim etiam ultrices vitae neque urna proin nibh diam turpis augue lacus.

‍