Dental Cybersecurity in Houston: Who Holds the Keys, and the Texas Clocks That Start When Something Goes Wrong

Tuesday, in a Cypress dental office. A new assistant started Monday and her login still isn't set up. Now the imaging company wants remote access to the DEXIS workstation for an update. The office manager has to say yes, no or "not yet".

This guide is written for that office manager, at the moment the job stops being abstract. Maybe a breach story has been going round the study club. Maybe the cyber-insurance renewal is on your desk, or maybe it's simply a new hire's first week. You won't find a product list here, and you won't find a control-by-control checklist either, because Legend's statewide Texas checklist already covers that. What you get instead is a map of who holds access in a Houston dental office, the Texas statute lines that start a clock, the records worth keeping, and the questions to put to whoever runs your IT. The legal sections quote the statutes and link to the official text. They don't tell you what the law means for your practice. That call belongs to your counsel.

What does dental cybersecurity mean for a Houston practice, in practice?

For a dental practice in Houston, cybersecurity means controlling who can open patient records, from which devices and through which vendors. It also means proving you've done it, with training statements, access lists and notice records that Texas statutes tie to deadlines. A firewall and an antivirus licence help, but most of the work is people, access and paperwork.

Here's a way to see it. Picture every route by which patient information leaves the chair. It goes into the practice-management system, whether that's Dentrix, Eaglesoft, Open Dental or a cloud product. It goes into the imaging software and the sensor workstation. It travels by email to a specialist and through a clearinghouse to an insurer. It sits in a backup copy, a scanned referral letter or a screenshot attached to a support ticket. Each route has people at both ends, and each of those people has a password, a device and a reason for access that was true at some point.

Security incidents in small practices rarely begin with a stranger defeating a firewall. They usually begin with a door that was never closed. Sometimes it's a former employee's account that still works. Sometimes it's a vendor's remote-access tool that anyone can reach, or a front-desk login shared by three people so nobody can tell who did what. Sometimes it's a convincing email that asks someone to "verify" their Microsoft 365 password.

So the work for a Houston office manager falls into three questions. Who holds a key? What records prove the keys are managed? What scams are your people likely to see? The rest of this guide takes them in that order. If your practice wants a provider to run the technical side, dental cybersecurity services explains what Legend offers. For the broader picture of running technology across a Houston practice, see the Houston practice owner's IT guide.

Two terms come up again and again below:

• • Access is any route by which a person or a system can read, change or copy patient information: an account, a shared password, a remote-control tool, a mapped drive, a cloud portal.
• • Evidence is a record that shows a safeguard happened, not just that someone intended it: a signed statement, a dated report, an export, a ticket.

Who holds the keys in a Houston dental office?

In a typical Houston dental office, keys to patient data sit with more people than the staff list suggests. The owner, office manager, front desk, clinical team, practice-software and imaging vendors, the IT provider, the billing service or clearinghouse, and the specialists and labs who receive records all hold some.

Read the table as a prompt. Ask, for each row, whether you could name the actual people and accounts today. The last column names the Texas statute line that mentions that kind of person or relationship. It is there so you know which official text to read with counsel. It isn't a reading of what that text requires of you.

Pages referenced in this table: Texas Attorney General's data breach reporting page.

Three patterns are worth looking for when you fill this in for the first time.

Vendor access outnumbers staff access. Most offices can name every employee. Far fewer can name every vendor tool installed on their machines. Imaging and practice-software support often needs remote access, and that's legitimate. The difference that matters is whether the session is invited for a job or left open all the time. If a vendor or tool can connect without anyone in the office clicking "allow", write that down. It's the first thing to raise with your IT provider. For help on the software and imaging side, see imaging and practice-software support in Houston.

Shared logins hide who did what. A front desk that shares one practice-software login can't tell you who opened a record. And if anyone leaves, the password has to change for everyone. Personal logins cost a little time at setup and save a great deal when something needs explaining.

The owner's account is the biggest target. The account that can do everything is the one attackers want. In many small offices it's also the one used for daily email. Keeping admin rights on a separate login, with multi-factor authentication, closes the riskiest key on this map.

Which Texas rules start a clock, and when?

Two Texas statutes set these clocks. Health and Safety Code chapter 181 sets a 90-day training deadline and a six-year record. Business and Commerce Code §521.053 sets notice deadlines after a breach: immediate notice from a vendor to the data's owner, 60 days for individuals and 30 days for the Attorney General at 250 Texans.

The table lays these out as an operating calendar: the event that starts each clock, the clock itself, who the statute addresses, and the record that shows the date. Use it to see which dates your office should be able to find later, not as a reading of which rules apply to your practice.

One plain sentence per rule, each with its official link (the Legislature's text files at tcss.legis.texas.gov for chapter 521 and for chapter 181 carry the same wording if the official pages are slow):

• • Health and Safety Code §181.101(b): a new employee of a covered entity finishes the required privacy training within 90 days of starting. Read §181.101.
• • Health and Safety Code §181.101(d): each employee signs a statement confirming the training, and the entity retains it for six years from signing. Read §181.101.
• • Health and Safety Code §181.154: patients are given notice that their information may be sent electronically, and each electronic disclosure carries its own authorization unless a subsection (c) exception covers it. Read §181.154.
• • Business and Commerce Code §521.053(b): whoever owns or licenses the data sends notice to each affected person within 60 days of determining a breach happened. Read §521.053.
• • Business and Commerce Code §521.053(c): an outside party holding someone else's data tells that owner at once when it discovers a breach. Read §521.053.
• • Business and Commerce Code §521.053(i): a breach touching 250 or more Texans is also reported to the Attorney General within 30 days of that determination. Read §521.053.
• • Business and Commerce Code §521.053(j): the Attorney General publishes a list of the reports it has received. Read §521.053.

The breach section's definition in §521.053(a) also counts encrypted data when the person accessing it has the decryption key. Penalties for each chapter are set out in §181.201 and §521.151. The Attorney General's own reporting page summarizes the timing as "no later than 30 days after the discovery of the breach". The statute's word is "determines", so this guide quotes the statute.

This is a summary of the statute text, not legal advice; your counsel decides what applies.

What does HB 300 training look like for a new hire in a Houston office?

HB 300 is the 2011 Texas bill that added the training rule now in Health and Safety Code §181.101. As onboarding, that means a hire date, a training course completed within 90 days of that date, and a signed statement (paper or electronic) kept for six years. Retraining follows a material change in the law.

The history notes on the official text show the rule was "Added by Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300)", effective September 1, 2012, and amended by S.B. 1609 in 2013. Chapter 181 defines "covered entity" broadly. Its list runs from business associates, health care payers and information or computer management entities to clinics, health care providers and people who maintain an Internet site (§181.001). Whether and how that definition reaches your practice and your vendors is a question for counsel, not for this page.

What it looks like as office routine, if your counsel confirms it applies:

• • Day one. The new hire's start date goes into the HR file. Their practice-software and email accounts are personal, created with the role they need and nothing more.
• • Within the first weeks. They complete training on state and federal law on protected health information "as necessary and appropriate for the employees to carry out the employees' duties" (§181.101(a)). In a dental office, that duty-based wording points the training at real tasks. Think checking in a patient, sending a referral, answering a records request or reading a suspicious email.
• • On completion. They sign the statement, on paper or electronically, and it's filed somewhere that will still open in six years. A folder on the front-desk PC is a poor home. A practice-management system you might replace in three years can be one too. A dated PDF in a controlled HR folder that's backed up, with a simple log (name, hire date, training date, statement date), is easy to produce when asked.
• • When the law changes. If a change in state or federal law affects someone's duties, they're retrained within a year of the change taking effect, and a new statement is signed.

In an office with heavy front-desk turnover, the 90-day clock is the easiest one to miss. It isn't neglect. Training gets scheduled "after things settle down", and things don't settle. Putting the course on the new hire's first-week calendar, before the clock matters, is the simplest fix. Practices running several Houston-area offices face a second problem: training records scattered across sites. Running IT across several Houston-area dental offices covers keeping them in one place.

When does sending X-rays or records to a specialist need a separate authorization?

Health and Safety Code §181.154 says patients get notice that their information may be disclosed electronically, and each electronic disclosure carries a separate authorization. The exceptions: sending to another covered entity for treatment, payment, health care operations or an insurance function, or a disclosure another law authorizes or requires.

That is the statute, stated. The parts as written:

• • Notice (§181.154(a)). A covered entity can give general notice by posting a written notice at its place of business, on its website, or anywhere else patients are likely to see it.
• • Authorization (§181.154(b)). No electronic disclosure to any person without "a separate authorization" from the individual or their legally authorized representative "for each disclosure". The authorization can be written, electronic, or oral if documented in writing.
• • Exceptions (§181.154(c)). No authorization is needed for a disclosure to another covered entity for treatment, payment, health care operations, or performing an insurance or health maintenance organization function, or a disclosure "as otherwise authorized or required by state or federal law".
• • The form. The section directs the Attorney General to adopt a standard authorization form.

Houston is a referral-heavy place to practise. General dentists send images and charts to oral surgeons, endodontists, periodontists, orthodontists, imaging centres and labs, many in the orbit of the Texas Medical Center. This page doesn't sort those workflows into "exception" and "not an exception". That's exactly the reading the statute leaves to counsel. What it can do is help you list them, so the question to counsel is specific.

A useful inventory has one line per way records leave the office electronically:

Bring that table to counsel. Ask which of your workflows fall under an exception, which need a separate authorization, and what the authorization record should look like. Then ask your IT provider whether each route leaves a record you can find. Imaging and email audit trails are often switched off by default.

What phishing are Houston dental teams actually seeing?

Houston dental teams have been warned about two very local kinds of scam. One is fake vendors selling attendee contact lists for the Star of the South Dental Meeting. The other is utility and government impostors after storms like Hurricane Beryl. Both work by borrowing a trusted name. Both make good training scenarios, alongside fake Microsoft 365 and insurance emails.

The dental meeting scam. The Star of the South Dental Meeting, hosted by the Greater Houston Dental Society, carries this notice on its website (read October 16, 2026): "Unknown scammers/solicitors are sending out emails selling attendee contact lists" for the meeting. It adds that those solicitors have neither permission nor authorization from the GHDS or the meeting. (starofthesouth.org). For a dental office, the lesson is less about buying lists. It's that a local dental event's name is being used in cold email. If one name can be borrowed, so can a study club's, a supply house's or a payer's.

The post-storm impostor. On July 10, 2024, the Federal Trade Commission published a consumer alert as Houston recovered from Hurricane Beryl. It warned that scammers "pretend to be utility companies restoring power, workers making repairs, or even government agencies". It also said that "Scammers and unlicensed contractors often appear in recovery zones" (FTC alert). The alert was written for households. The same pattern reaches an office inbox as "your power restoration account", "storm damage claim update" or "SBA disaster assistance" emails, sent when staff are tired and the office is short-handed.

Turn these into training scenarios, not fear. A short session for the front desk and clinical team might use four realistic messages:

• • The borrowed local name. An email "from" a Houston dental meeting, society or study club offering a list, a sponsorship or a registration "correction" with a payment link.
• • The storm-week impostor. A message from a "utility" or "restoration" company asking the office to confirm an account, or a "disaster assistance" offer that asks for a fee.
• • The vendor update. An email that looks like it comes from the practice-software or imaging vendor, asking someone to install a remote-access tool or "re-verify" a login. This is exactly the request in the Cypress scenario at the top of this page. The test is whether the office can confirm it through a phone number it already has, not one in the email.
• • The insurance or payroll change. A "new remittance address" from a payer, or an employee asking to change their direct-deposit account, with urgency built in.

The habit worth building is the call-back. Verify any request involving access, money or patient data through a channel the office already trusts. Then report anything odd to whoever runs your IT, without embarrassment. For a deeper look at how phishing turns into ransomware, see Legend's guide to dental phishing and ransomware.

What should a Houston practice be able to show, not just say?

A Houston practice should be able to produce, on request, a short stack of dated records. These include training statements, a current access list, offboarding confirmations, vendor access approvals, a backup restore result, an MFA coverage export, a disclosure record and an incident contact sheet. A dated record is something others can check.

The table pairs each claim with the evidence that backs it up. The full control list, with set-up steps, is in the Texas dental cybersecurity checklist. This table is only about what you can hand over when an insurer, auditor, counsel or new owner asks.

A blank row is where to start: list it for your IT provider and counsel, and agree who will produce that record from now on.

Where Legend fits: Legend Networking is headquartered in Dallas and has served over 3,500 practices since 2004. It states 24/7 monitoring, a staffed 24/7 helpdesk at 1-800-794-1588, and in-house engineers with no outsourced first-level triage. Public reviews: 4.8 rating · 173 Google reviews. The executive named on its pages is Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps. Which security services Legend runs for a practice is set out on its dental cybersecurity services page, not here.

If something goes wrong, what happens first?

If a Houston office suspects an incident, the first moves are to call the IT provider, call counsel and the cyber-insurance claim line, and preserve evidence rather than wipe machines. Note the times, too, because the Texas notice clocks run from when a breach is discovered or determined. The full first-day sequence is in the Texas checklist.

That sequence is set out in the Texas checklist's first-24-hours section, and recovery from ransomware is covered in Legend's dental ransomware recovery playbook. Federal rules may apply alongside the Texas ones: the HIPAA Breach Notification Rule is summarized, with its HHS link, in the same checklist.

How does storm season change the security picture?

Storm season changes security in two ways. Recovery after a hurricane and recovery after ransomware lean on the same backups, contact sheet and restore order, so one plan serves both. And impostor emails rise after storms, as the FTC's Beryl alert noted, just when staff are stretched and checks get skipped.

The power, flood and connectivity side is in the Houston hurricane IT plan for dental offices. Before peak season, add one storm-week phishing message to the team's training.

What does cyber insurance ask a Houston practice to prove?

Cyber-insurance applications and renewals often ask a dental practice to confirm controls, such as multi-factor authentication, backups, endpoint protection and training. Some ask for evidence rather than a yes. The safest answer is one you can back with a dated record, which is why the evidence table above matters.

Questions and carrier expectations vary by policy. Legend's guide to dental cyber insurance requirements walks through the controls insurers commonly ask about. Read your own application with your broker before answering.

What to ask your IT provider about security

Use these alongside the questions in the Texas checklist, not instead of them. Three tie directly to the Texas statute lines above.