In Part 1, we explored why cybersecurity can no longer be viewed as a purely technical concern. Dental practices have become attractive targets because they house valuable patient information, rely on interconnected technologies, and depend on continuous system availability to deliver care.
We also introduced the concept of cybersecurity as a parfait: a collection of overlapping layers that work together to protect patient trust, practice operations, and business continuity. The natural question is, what do those layers actually look like in practice?
Start with the data, not the technology
Tasha Dickinson, MBA.
One of the most common mistakes practice owners make is beginning with products instead of risk. Effective cybersecurity starts by identifying the systems and information that are most critical to patient care.
If your practice management system, imaging platform, scheduling software, or cloud-based patient communications became unavailable tomorrow, what would happen?
Understanding where electronic protected health information resides and how it flows through the practice creates the foundation for every security decision that follows.
Layer 1: People
The Verizon Data Breach Investigations Report continues to show that the human element remains involved in the majority of security incidents. That reality makes employee awareness one of the most important cybersecurity controls available to any dental practice. Security training should extend beyond annual compliance requirements.
Team members should know how to identify phishing emails, suspicious text messages, unusual login requests, and fraudulent vendor communications. Most importantly, they should feel comfortable reporting concerns without fear of criticism.
Layer 2: Identity and access
Most attackers no longer break into systems. They log in using stolen credentials. Multifactor authentication should therefore be considered a baseline requirement for email, cloud platforms, remote access, and administrative accounts.
That’s why every employee should have individual credentials, and access rights should be reviewed regularly. When staff members leave the organization, their access should be removed immediately.
Layer 3: Endpoint protection
Every workstation, laptop, server, and mobile device represents a potential entry point into the practice. Traditional antivirus software remains important, but modern threats often require additional visibility.
Endpoint detection and response technologies monitor devices continuously and can identify suspicious activity before it becomes a major incident. Think of antivirus as a lock on the front door and endpoint monitoring as a security camera watching what happens after someone enters.
Layer 4: Network security
Many dental offices operate on flat networks in which every connected device can communicate with every other device. If one computer becomes compromised, the attacker can then move freely throughout the environment.
The solution is segmenting guest Wi-Fi, clinical systems, imaging devices, and administrative functions to help contain potential damage and limit the lateral movement of unauthorized access.
Layer 5: Detection and monitoring
Many organizations do not discover a cyber incident until days or weeks after it begins. That delay dramatically increases the potential impact.
A mature security program includes continuous monitoring and clearly defined responsibilities. Practice owners should ask themselves a simple question: "If an alert occurs at 2 a.m., who receives it and what happens next?"
Layer 6: Backup and recovery
Ransomware has transformed backups from a convenience into a necessity. Yet many organizations assume that because backups exist, recovery is guaranteed.
The truth is that backups must be tested regularly. A backup that has never been restored is not a recovery strategy, it is an assumption. Recovery procedures should be rehearsed just as emergency response protocols are practiced in the clinical environment.
Layer 7: Incident response
Every practice has a plan for medical emergencies and fire evacuations. Far fewer have a plan for responding to a cyberattack.
Before an incident occurs, practices should determine who contacts the information technology provider, the cyber insurance carrier, legal counsel, and other stakeholders. Clear responsibilities reduce confusion and accelerate recovery when time matters most.
A framework that makes sense
The U.S. National Institute of Standards and Technology Cybersecurity Framework 2.0 provides a useful road map for organizations of all sizes. Its core functions -- govern, identify, protect, detect, respond, and recover -- offer a practical blueprint for building a resilient security program.
Similarly, guidance from the U.S. Cybersecurity and Infrastructure Security Agency, the U.S. Department for Health and Human Services' (HHS) Office of Civil Rights, and the HHS 405(d) initiative emphasizes risk-based decision-making, documented procedures, and continuous improvement rather than one-time technology purchases.
The goal is resilience, not perfection
One of the biggest misconceptions about cybersecurity is that success means preventing every attack. That is unrealistic.
Effective cybersecurity acknowledges that mistakes will occur, technology will fail, and attackers will continue to evolve.
Layered security anticipates these scenarios by creating overlapping safeguards so that one error does not become a practice-wide crisis. Just like a parfait, each layer supports the next. Together, they create something stronger than any individual ingredient.
In dentistry, we embrace layered approaches to infection prevention, patient safety, and clinical quality. Cybersecurity deserves the same mindset. After all, the information we protect is more than data. It is patient trust. And protecting that trust has become one of the most important responsibilities in modern dental practice.
Author's note: The topic “Everybody Likes a Parfait. Why Layered Cybersecurity Is Dentistry’s New Standard of Care” is available as a lecture or webinar as part of a continuing education program focused on reducing real-world cybersecurity risk.
Tasha Dickinson, MBA, dentistry’s cybersecurity guide, is the founder and chief technologist of Siligent Technologies, a trusted provider of cybersecurity and IT solutions for dental businesses. She is dedicated to helping dentists protect their data, avoid cyberattacks, and build resilient business operations. Contact Tasha at [email protected] or connect on LinkedIn.
The comments and observations expressed herein do not necessarily reflect the opinions of DrBicuspid.com, nor should they be construed as an endorsement or admonishment of any particular idea, vendor, or organization.
