IT for Dental & Medical Practices (HIPAA)
Practice management that stays up through a full schedule, imaging that's backed up, and HIPAA paperwork that matches what your systems actually do. Local IT support for dental and medical offices across Central Oregon.
A local team based in Redmond. Same business day response. A real person answers texts during the business day.
A practice can't stop for IT
When the front desk can't open the schedule, or an operatory can't pull up last year's X-rays, the day backs up fast. Patients wait, hygienists wait, and someone ends up on hold with a software vendor. A dental or medical office also carries more risk than most small businesses: it holds health information that the law says you must protect, and you have to be able to show how you protect it.
Evolution IT Services keeps the technology in small practices running and documented. We work alongside your practice management and imaging vendors, not in place of them, and we write things down so your HIPAA binder reflects reality.
HIPAA basics, in plain English
If your practice bills insurance electronically, it's almost certainly a HIPAA covered entity. The Security Rule doesn't hand you a product list. It asks you to understand your risks and take reasonable, documented steps. The parts that land on IT:
- A risk analysis is required. A written look at where patient information lives, what could go wrong and what you're doing about it, updated when things change. Many small practices have never done one, and it's the first document an investigator asks for.
- Business associate agreements. Every vendor that creates, stores or transmits patient information on your behalf signs a BAA: your IT provider, backup service, practice management and imaging vendors, and email. Microsoft offers a BAA for commercial Microsoft 365 plans through its standard licensing terms. Consumer and personal accounts don't qualify.
- Access controls. Every person has their own login, staff see only what their job needs, and accounts are shut off the day someone leaves. Shared front-desk passwords are a finding waiting to happen.
- Audit logs. Your systems should record who opened what and when, and someone should be able to pull that record when asked.
- Encryption. Full-disk encryption on every laptop and workstation (for example BitLocker on Windows, FileVault on Mac), encrypted backups, and encrypted email when patient details go outside the practice.
- Breach notification. If patient information is exposed, HIPAA requires notice to affected patients without unreasonable delay and no later than 60 days after discovery, plus notice to HHS (and to the media when more than 500 residents of a state are affected). Oregon's breach law, the Oregon Consumer Information Protection Act (ORS 646A.600 and following), can apply too. Your attorney decides what notices go out; we make sure you have the logs and facts to decide quickly.
We don't give legal advice, and we can't make a practice "HIPAA certified" (no such certification exists). We can run the technical side of your risk analysis, fix what it finds and keep the evidence organized.
Practice management and imaging systems
Your practice management system is the center of the office. On the dental side that's usually Dentrix, Eaglesoft or Open Dental installed on a server in the office, or a cloud system such as Curve Dental or Dentrix Ascend. Medical practices run an EHR, either hosted by the vendor or on a local server. Imaging adds its own software for sensors, intraoral cameras, panoramic units and sometimes cone beam CT.
On-premises systems
A reliable server with UPS power, a fast wired network to every operatory, updates applied on a schedule your vendor supports, and database backups that are actually tested.
Cloud systems
Dependable internet with a backup connection, locked-down workstations, multi-factor sign-in for every user and a plan for exporting your data if you ever switch vendors.
Imaging
Large files, specific driver and version requirements, and a bridge into the patient chart. We coordinate upgrades with the imaging vendor so a Windows update doesn't break a sensor mid-morning.
Operatory and front-desk workstations
Operatory computers get used by several people a day, often with gloves on and patients in the chair. We set them up for that:
- Screens that lock automatically and fast user switching, so staff aren't tempted to share a login
- Monitors positioned so patients can't read someone else's chart
- Cleanable keyboards and mice, or covers that work with your infection-control routine
- The same standard build on every machine, so a failed computer is swapped and back in use quickly
- Front-desk card readers and payment terminals kept on their own network segment, away from guest Wi-Fi
Backups that include your imaging
A common gap: the practice management database is backed up, but the imaging folder isn't, or it was never test-restored. We back up the database, the imaging store and Microsoft 365, keep an encrypted copy off-site, and test restores on a schedule. Microsoft 365's built-in retention is short-term and not an independent backup, so email and shared files get their own. See backup and disaster recovery for how we plan around Central Oregon power outages and winter storms.
Records retention is part of this. The Oregon Board of Dentistry requires dental records to be kept for at least seven years (OAR 818-012-0070). Medical record retention is set by state rules and depends on the record and the patient; we'll help you document yours and make sure your backups and archives keep records for as long as your policy says.
Common questions
Do we really need a written HIPAA risk analysis?
Yes. The HIPAA Security Rule requires covered entities to perform one and keep it current. It doesn't have to be long, but it has to be real: what systems hold patient information, what the risks are and what you're doing about them. We can run the technical portion and give you a plain-English report.
Will you sign a business associate agreement?
Yes. If we can access systems that hold patient information, we sign a BAA with your practice before we start. We'll also help you list the other vendors that need one.
Is Microsoft 365 HIPAA compliant?
Microsoft offers a BAA for commercial Microsoft 365, but no software makes you compliant by itself. It has to be configured properly: multi-factor sign-in, encryption for outgoing patient email, audit logging turned on and an independent backup. We set that up and document it.
Can you work with our practice management or imaging vendor?
That's part of the job. We handle the server, network, workstations and backups, and we work with your vendor's support team on updates and problems so you aren't stuck in the middle.
What happens if we think patient data was exposed?
Text or call us right away. Don't power off affected computers; disconnect them from the network. If you have cyber insurance, call your insurer before hiring an incident response firm. We help preserve logs and evidence so you and your attorney can decide which notices are required.
Keep reading
Looking for general managed IT services in Redmond? That page covers how our monthly plans work for every kind of office.
Get a straight answer about your practice's IT
Book a free 30-minute consultation. We'll look at your practice management setup, backups, workstations and Microsoft 365, then give you a quote and a one-page, plain-English list of what's fine and what needs fixing. Managed plans are priced per user per month.