When new technology enters dentistry -- whether via cloud platforms, imaging systems, practice management software, or AI-driven tools -- we usually focus on the problem it solves. What rarely receives the same attention is how that product was built and whether security was part of the design from Day 1.
That question matters more than ever.
Lately, my husband Rich -- a dental practice owner -- and I have been working with students at Dartmouth College through the Cook Engineering Design Center, mentoring early-stage product ideas that may one day support dental practices.
Tasha Dickinson, MBA.
One project involved an audiovisual device designed for use in a treatment room. Rather than focusing only on encrypting stored data, we pushed the students to design a solution that could not easily be tampered with, modified, or hacked in the first place.
That experience sharpened what I now look for when evaluating any new dental technology: Secure by design means security is not added at the end. It is embedded into the architecture, workflows, and technical controls from the beginning.
Several federal agencies now endorse this approach. The U.S. Cybersecurity and Infrastructure Security Agency defines secure-by-design software as products that reduce the burden on customers to protect themselves and place responsibility on developers to deliver secure default configurations and resilient systems.
Similarly, the National Institute of Standards and Technology (NIST) emphasizes building security into the entire software development life cycle. In business terms, this approach is known as DevSecOps. IBM has repeatedly identified it as one of the most cost-effective ways to reduce the impact of cyberattacks.
Most dental software is designed to solve a single operational problem. Too often, it introduces cybersecurity risk in the process -- without anyone realizing it. Because nearly every system now touches protected health information, the consequences of poor design land squarely on dental practices.
Why developers must build security into product design
Vendors serving healthcare markets carry a heightened responsibility. Dental practices operate under HIPAA, state privacy laws, and contractual obligations with insurers and business partners. When developers skip foundational security controls, they transfer risk downstream.
At a minimum, secure-by-design development should include the following:
- Secure default configurations
- Strong authentication and access controls
- Encryption of data in transit and at rest
- Audit logging and monitoring
- Formal vulnerability testing
- Regular patching mechanisms
- Clearly documented security architecture
Regulatory policy is moving in this direction. The U.S. Federal Communications Commission’s Cyber Trust Mark program is designed to help consumers identify connected devices that meet baseline cybersecurity requirements.
Dentistry does not yet have its own certification standard, but the trend is clear: Cybersecurity is becoming a design obligation, not a marketing feature. For dental technology vendors, secure by design is no longer a differentiator. It is a minimum expectation.
What dentists should ask technology vendors, and which questions should be asked
One of the most concerning trends I see is how rarely dentists ask vendors meaningful security questions.
I was recently introduced to an AI product being demonstrated in one of our client practices. When I asked about the company’s security model, I was told I was only the third person who had ever asked such a question.
The founder then walked me through the platform’s architecture, controls, and compliance documentation. Based on that conversation alone, I would recommend the product again.
Here is the unsettling part: The product is already in hundreds of practices. So who is not asking these questions?
Dentists can frame the conversation this way:
- Do you have SOC 2 (System and Organization Controls 2) certification?
- Was security built into the product from the beginning or added later?
- How are patient data encrypted in transit and at rest?
- What access controls prevent unauthorized internal or third-party access?
- Do you follow NIST or similar security frameworks?
- How often do you perform security audits or penetration testing?
- How do you handle vulnerability disclosures and software updates?
- Will you provide a HIPAA Business Associate Agreement?
If a vendor cannot provide clear answers -- or treats these questions as an inconvenience -- that is a red flag. Transparency is not optional. It is due diligence.
What practices must do when technology is not secure by design
Even with the best efforts, many practices use products that were not developed with secure-by-design principles. That does not eliminate responsibility.
HIPAA places accountability for patient data security on the covered entity -- the dental practice -- not the vendor. If a breach occurs, regulators will ask whether the practice performed due diligence, assessed vendor risk, and implemented reasonable safeguards.
The HIPAA Security Rule requires administrative, physical, and technical protections. Failing to evaluate vendor security controls can be considered a compliance failure.
At a minimum, practices should:
- Conduct formal risk assessments of all technology vendors.
- Require HIPAA Business Associate Agreements.
- Implement network segmentation and access restrictions.
- Use multifactor authentication where available.
- Maintain regular patching and software updates.
- Monitor user access logs.
- Train staff on cybersecurity awareness.
- Retain an information technology security partner to vet vendors.
If a product cannot meet modern security standards, compensating controls must be put in place. Ignoring known weaknesses does not reduce liability, it increases it.
Final thought
Secure by design is not an abstract engineering concept. It is a business safeguard.
As dentistry adopts cloud platforms, AI, and integrated digital tools, cybersecurity risks will only increase. Practices that assume vendors have “handled security” without verification are exposing their businesses and their patients.
Ask the hard questions. Demand transparency. And if you do not have the time or expertise, partner with an IT security firm that will ask those questions on your behalf. Because in modern dentistry, security is not optional. It is foundational.
Editor's note: References are available upon request.
Tasha Dickinson, MBA, dentistry’s cybersecurity guide, is the founder and chief technologist of Siligent Technologies, a trusted provider of cybersecurity and IT solutions for dental businesses. She is dedicated to helping dentists protect their data, avoid cyberattacks, and build resilient business operations. Contact Tasha at [email protected] or connect on LinkedIn.
The comments and observations expressed herein do not necessarily reflect the opinions of DrBicuspid.com, nor should they be construed as an endorsement or admonishment of any particular idea, vendor, or organization.
