Every dental practice we take over has a backup. Almost none of them have a recovery plan — and those are not the same thing. A backup is a copy. A recovery plan is the proven, written answer to “the server is gone at 7:40 on a Tuesday, first patient is at 8 — now what?” This guide walks through the five pieces a dental practice needs, what each looks like in a real office running Dentrix, Eaglesoft or Open Dental, and the failures we find most often. (For what it is worth, the five pieces are also exactly what HIPAA’s contingency-plan standard names — but you should want them because they keep the practice open, not because a regulation lists them.)
It is written for the practice owner and office manager, not the IT vendor. If your IT provider cannot show you each of the five items below in writing, you do not have a recovery plan — you have hope.
The five pieces of a recovery plan
These map one-for-one to the five items HIPAA’s contingency-plan standard (45 CFR §164.308(a)(7)) names — which is useful, because it means building the plan that keeps your doors open also produces the evidence your compliance advisor will ask for. The five:
- Data backup plan (required) — retrievable exact copies of ePHI.
- Disaster recovery plan (required) — procedures to restore any loss of data.
- Emergency mode operation plan (required) — how the practice keeps critical operations running, and protects ePHI, while systems are down.
- Testing and revision procedures (addressable) — periodic testing of the plans and updating them.
- Applications and data criticality analysis (addressable) — which systems and data matter most, so recovery happens in the right order.
Two of the five are labelled “addressable” in the regulation; in a dental office that runs its schedule, charts and imaging on computers, all five are simply necessary. Your compliance advisor can speak to the regulatory nuance. This guide is about the infrastructure.
1. Data backup plan — what a real dental backup covers
A backup you cannot restore is not a backup. In practice, a dental backup plan that will actually save you covers:
- The PMS database — the Dentrix, Eaglesoft, Open Dental or Curve data. On-premise systems need an application-aware backup (SQL-consistent), not a file copy of a folder that is open and changing all day.
- Imaging — radiographs, CBCT volumes, intraoral photos. This is usually the largest data set in the practice and the one most often left out because it lives on a separate server or a workstation under the pano.
- Documents — scanned consents, insurance cards, referral letters, anything attached to charts outside the database.
- Configuration — the server itself, so a restore does not mean rebuilding Windows and reinstalling the PMS from scratch before you can even begin.
- Email — if patient communication happens in Microsoft 365, that mailbox contains ePHI too.
The design that survives real incidents is 3-2-1 with one copy immutable: three copies, on two different media, one off-site — and at least one copy that cannot be altered or deleted by anyone on your network, including an attacker who has taken over the server. Ransomware operators delete or encrypt backups first, on purpose. An immutable off-site copy is what makes ransomware a bad day instead of a closed practice; see what the first 72 hours of a dental ransomware event actually look like.
Encrypt the backups. A backup drive that walks out of the office in a bag is a data breach if it is not encrypted, and a non-event if it is.
2. Disaster recovery plan — the restore procedure, written down
The DR plan answers: if the server is gone, how do we get the practice back, in what order, and how long does each step take? It should exist as a document someone other than your IT provider can read, and it should name:
- Recovery time objective (RTO) — how long the practice can be down before it starts cancelling patients. For most dental offices this is measured in hours, not days.
- Recovery point objective (RPO) — how much data you can afford to lose. If backups run nightly, the RPO is a full day of charting and payments. Many practices decide that is too much once they see it written down.
- The restore sequence — network first, then server, then database, then imaging, then integrations — with who does each step and the credentials they need (stored securely, not in the plan itself).
- Hardware — where a replacement server or workstations come from, and how fast. A cloud-hosted standby or a spare on the shelf changes RTO from days to hours.
- Vendor contacts — PMS support, imaging support, ISP, and your IT provider, with account numbers.
The single most valuable line in a DR plan is the honest RTO. If the answer is “we’d call the IT guy and see,” that is the finding.
3. Emergency mode operation plan — running the practice while the system is down
This is the piece almost every dental practice is missing entirely. Emergency mode means the systems are unavailable — for an hour, a day, a week — and patients are still in the chairs. The plan covers:
- The schedule — how the front desk knows who is coming today if the PMS is down. A printed or exported next-two-days schedule every evening is a legitimate control. So is a cloud PMS reachable from a phone.
- Clinical documentation — paper charting templates for the duration, and the procedure for entering them into the system afterward.
- Imaging — can sensors capture to a local workstation if the imaging server is down? Where do those images live until the system is back?
- Payments and insurance — a standalone card terminal that does not depend on the PMS; a procedure for eligibility checks by phone.
- Protecting patient data in emergency mode — safeguards do not lapse because you are on paper. Where do the paper charts go at night? Who has access?
- Communication — who tells the team, who tells patients, and what they say. This matters doubly if the cause is a security incident, because what staff say to patients can become part of the breach narrative.
An emergency mode plan is usually two pages. Its value is that the team has read it before the day they need it.
4. Testing and revision — proving it works
A plan that has never been tested is a plan that has never been shown to fail. Testing, in a dental practice, means:
- Restore tests on a schedule — quarterly is defensible — where the backup is actually restored to a test machine and a chart is opened, an image displayed, a ledger checked. Document the date, what was restored, how long it took, and what broke.
- A tabletop walkthrough of the emergency mode plan once a year: “the server died at 7:40 this morning, first patient is at 8. Go.” Twenty minutes, whole team, and you will find the gaps.
- Revision triggers — the plan gets updated when the PMS changes, when you move to cloud, when you add a location, when a key vendor changes, and after any real incident. Switching practice-management software is the most common trigger practices forget.
Keep the test records. They are what turns “we have a plan” into “we have a plan that works” — and they are the evidence your compliance advisor will want.
5. Criticality analysis — what to bring back first
This one is short and practices skip it because it feels obvious. Write it down anyway: rank your applications and data by how quickly the practice needs them back. For a typical general practice the order is schedule and patient demographics first, then clinical charting, then imaging, then billing and claims, then everything else. For an oral surgery or implant practice, imaging moves up. That order drives the DR sequence and tells you where to spend money on faster recovery.
Where dental practices most often fail
- Backups that back up the wrong thing. A job configured years ago for a folder that moved, or for the old PMS after a conversion. Green light, empty backup.
- No off-site or immutable copy. Everything on a NAS in the closet, on the same network the ransomware will encrypt.
- Never restored. The backup has run every night for four years and no one has ever opened a file from it.
- Imaging excluded. The database is protected; ten years of radiographs are on a workstation with a single drive.
- Nothing written. The plan lives in the IT provider’s head. When that relationship ends, so does the plan.
- No emergency mode at all. The first time the team thinks about running on paper is the morning they have to.
Frequently asked questions
Is a cloud PMS a recovery plan?
It is part of one. Cloud platforms handle the server and database backup, which removes several failure modes. It does not cover your imaging if that stays local, your documents, your internet dependency, or emergency mode operations. And you still need the vendor’s recovery commitments in writing.
How often should a dental practice test backups?
Quarterly restore tests are a defensible cadence for most practices, with a documented result each time. Test more often after any change to the PMS, server or backup system.
How long should we keep the plan and the test records?
Keep them for as long as your compliance advisor specifies for policy records — HIPAA’s general retention figure is six years — and treat the restore-test logs as part of that record.
Does this need to be in our security risk assessment?
Whoever maintains your risk assessment will want to reference the backup and recovery plan as the control for data loss. We provide the technical documentation; the assessment itself belongs with your compliance advisor.
Who is responsible — the practice or the IT provider?
The practice, always. The IT provider builds and operates the infrastructure; the practice owns the plan and the obligation. That is why the plan must be a document the practice holds, not something that lives only with a vendor.
Getting it built
ClearMax builds and runs the infrastructure side of this as part of dental managed IT — the backup design with an immutable off-site copy, the written restore procedure, the quarterly restore tests with logs, and the emergency-mode kit (printed schedules, local imaging capture, standalone payments). It is the first thing we do on a new account, because it is the thing most likely to be missing. The policy layer — the risk assessment and the formal contingency policy — stays with your compliance advisor; we give them clean evidence to point at. See dental business continuity in Houston or dental IT support in Louisville for how it looks by market, start at Dental IT Support, or call (833) 306-3168. If you want the number that makes the case internally, the breach cost calculator puts one on a week of downtime.