Medical-Dental Integration Security Risk Assessment Checklist

Connecting medical and dental systems can help authorized teams coordinate care, but it also creates new paths through which electronic protected health information (ePHI) may be accessed, changed, disclosed, or made unavailable. Use this checklist to map those paths, evaluate risks, and track practical safeguards and corrective actions.

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and manage identified risks. The specific safeguards you choose depend on your organization and its environment; this checklist supports that work but does not, by itself, establish compliance. See HHS guidance on Security Rule risk analysis.

Which systems and ePHI data flows should the assessment cover?

Start by defining the boundaries of the medical-dental integration, then trace ePHI from its source to every destination where it is received, used, stored, or transmitted. The assessment should cover all ePHI the organization creates, receives, maintains, or transmits—not just the interface connecting the practices.

• Inventory systems: Include medical and dental electronic health record systems, practice-management and billing applications, imaging and radiology systems, patient portals, scheduling tools, identity services, email and messaging platforms, and backup or archive systems.
• Map connections: Record interfaces, APIs, health information exchanges, file transfers, cloud services, remote-access connections, and manual processes such as staff downloading or re-entering information.
• Trace the data: Identify which information is shared, such as patient identity and contact details, medication and allergy lists, diagnoses, treatment plans, referrals, and dental or medical images. Note the direction, frequency, and purpose of each flow.
• Include endpoints and locations: Account for workstations, laptops, mobile devices, removable media, network equipment, and physical areas where ePHI may be viewed or accessed.
• Identify responsible parties: Document which practice, department, system owner, and vendor handles each component, including where a service provider or subcontractor maintains or transmits ePHI.

HHS risk-analysis guidance calls for identifying where ePHI is stored, received, maintained, or transmitted and documenting the information collected. Review system inventories, vendor documentation, interface specifications, staff workflows, and existing security records to find data flows that may not appear on a network diagram.

How do you document risks to ePHI confidentiality, integrity, and availability?

For each system and data flow, record how a threat could exploit a vulnerability and what the resulting harm could be. Evaluate ePHI confidentiality, integrity, and availability: whether information could be disclosed to someone unauthorized, altered or destroyed without authorization, or become inaccessible to authorized users.

A useful risk register includes the system or data flow, ePHI involved, threat, vulnerability, existing safeguards, likelihood, potential impact, overall risk rating, planned response, owner, and review date. State how you assigned likelihood and impact—qualitative ratings such as low, medium, and high can be useful when the method is applied consistently and explained.

• Confidentiality example: A shared staff account could allow an unauthorized user to view patient records, and the practice may be unable to attribute activity to an individual.
• Integrity example: A mapping error between medical and dental records could associate information with the wrong patient or cause an inaccurate medication list to be displayed.
• Availability example: A failed interface, ransomware event, or unavailable cloud service could prevent clinicians from accessing information needed for care.

Document the reasoning behind each rating and distinguish an observed control from a planned one. A policy alone does not prove that a safeguard is configured, used, and effective. HHS explains that risk analysis must consider potential impacts, assign risk levels, and document the analysis; it does not prescribe one universal scoring method.

The HIPAA Security Rule risk analysis is a required element of the security management process, and risk management requires implementing measures to reduce risks to a reasonable and appropriate level. Consult the HHS risk-analysis guidance and 45 CFR § 164.308.

Which threats and vulnerabilities should medical-dental practices assess?

Consider threats that are reasonably anticipated in your practices’ locations, technologies, workflows, and vendor relationships. HHS describes human, natural, and environmental threats as broad categories; the specific risks to assess depend on the organization and the likely impact on ePHI.

• Human and cyber threats: Phishing, stolen credentials, malicious software, ransomware, unauthorized browsing, accidental disclosure, and mistakes in patient matching or data entry.
• Integration and configuration weaknesses: Misconfigured interfaces, excessive permissions, insecure transfer methods, incomplete testing, outdated software, unmonitored service accounts, and errors in how records are matched or synchronized.
• Endpoint and physical risks: Lost or stolen devices, unencrypted storage, unattended workstations, improper disposal of equipment, and unauthorized access to rooms or networking equipment.
• Availability and continuity risks: Power or network outages, failed backups, unavailable vendors, natural disasters, and a lack of tested procedures for restoring access to records.
• Third-party and workflow risks: Vendor compromise, unclear incident-reporting paths, inappropriate user access, unsupported systems, and staff workarounds that bypass approved safeguards.

Assess vulnerabilities as well as threats: a threat is a potential cause of harm, while a vulnerability is a weakness that could be exploited or triggered. For instance, a phishing attempt is a threat; weak authentication or insufficient user training may increase the chance that it succeeds. HHS provides examples of threats to consider in a Security Rule risk analysis.

Which administrative, physical, and technical safeguards should you review?

Review safeguards across the entire integration, including existing controls and how they operate in practice. The Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards; it does not require every organization to use an identical set of tools.

• Administrative safeguards: Check who is responsible for security, how access is approved and removed, workforce training, security-incident response, contingency planning, periodic evaluations, and procedures for reviewing system activity.
• Physical safeguards: Review facility access, workstation use and security, device and media controls, secure storage, and disposal or reuse of equipment that may contain ePHI.
• Technical safeguards: Examine access controls, unique user identification, authentication, transmission protection, integrity protections, and audit controls that record and allow review of activity in systems containing ePHI.

Check whether role-based access control or another appropriate method limits users and software programs to the ePHI and functions needed for their responsibilities. Verify that accounts are unique where appropriate, privileged access is restricted, access is reviewed, and permissions are promptly changed when roles or employment change.

Review endpoint encryption and protection of ePHI in transit, but do not assume the Security Rule makes encryption an unconditional requirement in every situation. Encryption is an addressable implementation specification: the organization must assess whether it is reasonable and appropriate; if not, it must document that determination and implement an equivalent alternative measure if reasonable and appropriate. Read HHS guidance on encryption under the Security Rule.

For every safeguard, note whether it is implemented, how you verified it, any gaps, and the evidence reviewed. The Security Rule’s activity-review standard includes reviewing records such as audit logs, access reports, and security-incident tracking reports. See 45 CFR § 164.312.

How should you prioritize and document corrective actions?

Turn each material finding into a specific action, then prioritize it using the likelihood of occurrence and the potential impact on ePHI and clinical operations. Consider whether the risk could expose sensitive information, disrupt care, affect multiple locations, or undermine the reliability of medical or dental records.

• Describe the weakness and the risk it creates in terms that system owners and practice leaders can understand.
• Choose a response, such as reducing the risk with a safeguard, changing the workflow, limiting a data flow, or documenting a decision to accept a remaining risk.
• Assign an accountable owner, target date, required resources, and interim protections if remediation will take time.
• Record the evidence used to verify completion, such as configuration review, access testing, backup restoration, or a documented procedure review.
• Reassess the risk after corrective action and record any remaining risk, its rationale, approving authority, and conditions that would trigger another review.

Risk acceptance should be a deliberate, documented management decision—not an assumption that a risk is eliminated or that the organization is automatically compliant. Explain the remaining exposure, why further action is not being taken now, which safeguards remain in place, who approved the decision, and when or under what conditions it will be reconsidered. HHS requires risk analysis documentation but does not require a specific format.

How should you assess business associates and integration vendors?

Determine whether each vendor creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. Where a vendor is a business associate, verify that the required written assurances are in place before permitting the relevant handling of ePHI. A business associate agreement (BAA) is part of that relationship; it does not replace your own risk analysis or review of the vendor’s safeguards.

Review the vendor’s role in the data flow, access model, security practices, incident-response process, continuity arrangements, and the services or subcontractors involved. Ask how the vendor will report security incidents, support investigation, and provide information needed to assess a possible breach. Confirm that contract terms and operational contacts provide a workable escalation path.

When a subcontractor handles ePHI on behalf of a business associate, the business associate must obtain appropriate written assurances from that subcontractor. Check that the agreement chain addresses applicable Security Rule duties and incident reporting, including subcontractor breach notification. A business associate’s breach notification to a covered entity is subject to the HIPAA Breach Notification Rule; the agreement may set an earlier reporting deadline. See HHS guidance on business associates and the HIPAA Breach Notification Rule.

When should you update the security risk assessment?

HIPAA does not set one universal schedule—such as an annual requirement—for completing a comprehensive risk analysis. HHS says the process should be ongoing and the frequency will vary by organization. The Security Rule requires security measures and their documentation to be reviewed and modified as needed to continue providing reasonable and appropriate protection.

Revisit the assessment when a change could affect ePHI or the safeguards protecting it, including:

• Adding a medical or dental practice, system, integration, interface, or vendor.
• Changing what data is shared, where it is stored, or who can access it.
• Experiencing a security incident, repeated access-control problem, or failed recovery test.
• Changing network architecture, remote access, cloud services, endpoint devices, or key security configurations.
• Identifying a new vulnerability, threat, or weakness in a vendor or subcontractor relationship.

Use ongoing monitoring and periodic technical and nontechnical evaluations to identify when the risk analysis or safeguards need attention. HHS states that the Security Rule does not prescribe a fixed risk-analysis frequency; use changes in your environment and documented risk to determine when updates are needed. See HHS guidance on periodic review and updates.

In short, a useful medical-dental integration assessment maps all ePHI flows, evaluates confidentiality, integrity, and availability risks, verifies safeguards, assigns accountable corrective actions, and is revisited when the environment changes. Keep the analysis and its supporting decisions documented as part of an ongoing security-management process.

FAQs

Does a medical-dental integration program require a documented HIPAA security risk analysis?

If the participating organization is a HIPAA covered entity or business associate subject to the Security Rule, it must conduct an accurate and thorough risk analysis covering the ePHI it holds. The analysis must be documented, although HIPAA does not prescribe a specific format. The integration does not remove or replace each regulated organization’s responsibilities. See 45 CFR § 164.308 and HHS risk-analysis guidance.

What systems and data flows should a medical-dental security assessment include?

Include every system and endpoint that creates, receives, maintains, or transmits ePHI, plus the interfaces and workflows connecting them. This may include medical and dental records, imaging, billing, portals, email, cloud services, backups, mobile devices, vendor systems, and manual transfers. Document what information moves, between which systems, for what purpose, and which people or organizations can access it.

How often should practices update their security risk assessment?

HIPAA does not specify a universal interval for repeating a comprehensive risk analysis. The process should be ongoing, and practices should update their analysis when changes, incidents, or newly identified risks could affect ePHI protection. Periodic evaluation is part of maintaining safeguards; annual reviews may be useful for some practices, but they are not a universal federal risk-analysis schedule.

What should be documented when accepting a remaining security risk?

Record the risk and affected ePHI, the likelihood and impact assessment, existing safeguards, why further mitigation is not being taken at that time, the responsible decision-maker’s approval, and the date or conditions for reconsideration. Document any interim protections and reassess the risk if systems, workflows, threats, or vendor arrangements change. Acceptance does not erase the organization’s duty to manage risks under the Security Rule.