Before purchasing a dental practice, buyers must conduct thorough cybersecurity due diligence alongside financial and legal reviews, including assessing HIPAA compliance evidence, data location and access controls, incident history, vendor security agreements, and IT infrastructure to identify hidden risks that could significantly impact the true cost of acquisition.
- Request documented evidence of a HIPAA Security Risk Analysis and remediation rather than verbal assurances of compliance.
- Identify all locations where patient data resides, including cloud applications, imaging systems, backups, and vendor-managed platforms.
- Investigate the practice's incident history in detail, including how past breaches or suspicious activity were investigated and resolved.
- Evaluate vendor security risks by reviewing business associate agreements and determining which third parties have access to patient data.
- Price cybersecurity findings into the deal, accounting for costs of system remediation, equipment replacement, and staff training after closing.
A dental practice up for sale can look terrific on paper. Production is strong, collections are healthy, the patient base is stable, and the numbers support the asking price. Then the buyer takes possession and discovers something that never appeared on the profit-and-loss statement: a cybersecurity problem years in the making.
Patient information may sit on an old server nobody mentioned. A former employee may still have active credentials. A vendor may have remote access to the network. A previous incident may never have been fully investigated. Or the practice may have faithfully backed up its data without ever testing whether those backups can be restored.
Cybersecurity due diligence belongs alongside financial, legal, and operational review. For a buyer, it is risk due diligence, and it can change the economics of the deal.
Ask for evidence, not a HIPAA assurance
Tasha Dickinson, MBA.
“Is the practice HIPAA compliant?” sounds reasonable, but the answer may tell you very little. A seller can sincerely say yes while significant weaknesses remain undiscovered. Ask for evidence that you and your advisors can assess, such as:
- When was the last accurate and thorough HIPAA Security Risk Analysis conducted?
- What risks did it identify, which were corrected, and which remain open?
- What documentation shows that the practice followed through?
The distinction matters. The U.S. Department of Health and Human Services Office for Civil Rights (OCR) continues to focus on risk analysis during cybersecurity investigations. In April 2026, OCR announced four ransomware settlements affecting more than 427,000 individuals; the agency said the resolutions brought its completed ransomware investigations to 19 and its risk analysis initiative enforcement actions to 13.
An old analysis in a compliance binder is far less useful than evidence that identified problems were addressed.
Follow the data
Where is the patient data? The answer may extend far beyond the server in the dental office. Information can live in cloud applications, imaging and billing systems, patient communication software, backups, email, laptops, mobile devices, and vendor-managed systems.
OCR’s risk analysis guidance calls for identifying all electronic protected health information (ePHI) an organization creates, receives, maintains, or transmits, including through external sources such as vendors or consultants. A buyer should know what information exists, where it resides, who can access it, and which outside organizations also possess it. If nobody can answer those questions confidently, pay attention.
Investigate the incident history
“Have you ever had a cybersecurity incident?” also requires more than a yes-or-no answer. Ask about ransomware, phishing, compromised email, unauthorized access, lost or stolen devices, suspicious network activity, and reportable breaches. Then ask what happened next:
- Was the incident investigated and its scope determined?
- Were affected systems remediated and corrective measures documented?
- Were notification requirements evaluated?
The response can be more revealing than the incident itself. The HIPAA Security Rule requires regulated entities to regularly review records to detect security incidents, periodically evaluate the effectiveness of security measures, and reevaluate risks to ePHI. A buyer should identify unresolved incidents or obligations before they surface after closing as a regulator’s inquiry, patient complaint, or newly discovered breach.
Examine the vendor ecosystem
A dental practice can carry risk through organizations the buyer never intended to acquire: IT providers, cloud software companies, imaging vendors, billing services, backup providers, and patient communication platforms. In March 2026, OCR announced a settlement with MMG Fusion, a healthcare software business associate, following a breach affecting approximately 15 million individuals.
Business associate agreements are a starting point. Also determine which vendors have ePHI or network access, which contracts transfer, who controls administrative credentials, and what happens to stored data when a contract ends. These are operational questions with consequences after closing.
Probe the 'IT handles it' answer
A capable IT provider can be an enormous asset. Still, the practice must understand its own risks. Cybersecurity involves policies, access controls, workforce practices, incident response, vendor oversight, and management decisions in addition to technology.
If leadership says, “Our IT company handles all of that,” ask what the provider actually handles, what it does not, and who within the practice is accountable for the gaps.
Price the findings into the deal
Cybersecurity findings should not sit in a separate technical report. Unsupported servers, weak access controls, obsolete workstations, untested backups, or a practice management system requiring major remediation all have costs. The buyer may need to replace equipment, migrate systems, engage specialists, reconfigure networks, train staff, or change vendors immediately after closing.
A practice requiring substantial remediation is not economically identical to one with similar revenue and EBITDA (earnings before interest, taxes, depreciation, and amortization) but a well-managed technology environment. A finding does not automatically mean walking away. It means understanding the true cost of what is being purchased.
Review cyber insurance
Do not assume the seller’s cyber policy protects the buyer, or that the buyer’s existing coverage automatically extends to a newly acquired practice.
Review coverage terms, exclusions, notification requirements, and application representations with qualified insurance and legal advisers, especially when diligence reveals a prior incident or known weakness.
Watch for patterns, not perfection
No single finding necessarily makes a practice a poor acquisition. Several together should prompt closer scrutiny. Red flags include:
- No recent security risk analysis or record of remediation
- No reliable inventory of where ePHI is stored or which vendors have access
- Unexplained previous incidents or shared and generic user accounts
- Unsupported systems still connected to the network
- Repeated answers that “the IT company takes care of that.”
The issue is visibility. A buyer can evaluate and price a known problem. An unknown one is much harder to account for.
Make cybersecurity part of the transaction
Discuss material findings with legal, financial, insurance, and cybersecurity advisers before closing. Depending on the circumstances, they may affect remediation requirements, transaction timing, contractual representations, indemnification, insurance or the purchase price.
Buyers inspect leases, financials, equipment, and clinical operations. They should inspect the information systems with equal care or risk inheriting a costly problem after closing.
Editor's note: References are available upon request.
Tasha Dickinson, MBA, dentistry’s cybersecurity guide, is the founder and chief technologist of Siligent Technologies, a trusted provider of cybersecurity and IT solutions for dental businesses. She is dedicated to helping dentists protect their data, avoid cyberattacks, and build resilient business operations. Contact Tasha at [email protected] or connect on LinkedIn.
The comments and observations expressed herein do not necessarily reflect the opinions of DrBicuspid.com, nor should they be construed as an endorsement or admonishment of any particular idea, vendor, or organization.
