Hurricane IT Plan for Houston Dental Offices: Before, During and After the Storm

Late August, a Tuesday huddle in Cypress. The hurricane center's cone covers Galveston Bay, the practice server sits on a closet floor beside sterilization, the phones run over the internet, and Thursday is fully booked.

Nobody in that huddle knows whether the last backup was ever restored anywhere, and that is the usual starting point. Everything below turns it into tables you can print, tape inside the closet door and hand to the front desk: a countdown from five days out, a shutdown and restart order, a matrix of what still works under five kinds of outage, a set of patient-contact steps, the questions to put to your IT provider, and what storm-ready IT costs at Legend Networking. It is written for the owner or office manager of a one- or two-site practice in Greater Houston, from Cypress and Katy to Fort Bend and Pearland, with a server in the building or a mix of on-site and cloud systems.

When does a Houston practice's storm season really start for its IT?

For IT purposes a Houston practice's season starts in May, because the plan has to be tested while nothing threatens. NOAA's National Hurricane Center dates the Atlantic season from June 1 to November 30 and puts its peak on September 10. The weeks your plan most needs to be current are mid-August to mid-October.

The National Hurricane Center's own wording: "The official hurricane season for the Atlantic basin is from June 1 to November 30", and "The peak of the Atlantic hurricane season is September 10", with most activity between mid-August and mid-October. A practice that tests its plan in May and rechecks it in early August is ready for the weeks that matter.

Hurricanes are not the only reason Houston offices go dark, and the last five years make the case better than any forecast:

• • February 2021, winter storm Uri. In its Feb. 18, 2021 update, CenterPoint Energy counted, at the storm's worst, "approximately 1.4 million total customers" affected across its territory. Writing on the AADOM blog about that freeze, Jennifer Randall, who served as president of AADOM's Austin chapter, said her office stayed shut for ten days. Her post never says which city the office is in, so read it as a Texas account rather than a Houston one; the point for a Houston plan is that a closure can run to days, not hours.
• • May 16, 2024, the derecho. The National Weather Service's Houston/Galveston office said the May 16th derecho "brought a swath of 100+ mph winds down through the Houston Metro", causing widespread damage and a couple of tornadoes. A derecho is a line of severe thunderstorms, not a hurricane: there is no cone to watch for days ahead.
• • July 2024, Hurricane Beryl. CenterPoint's July 13, 2024 bulletin said the storm hit its "entire 5,000-square-mile service area" and that crews had by then "restored more than 1.6 million customers". For scale, the utility compared it with Hurricane Ike in 2008.

Three events, three different kinds of warning: a winter freeze, a thunderstorm line with no cone, and a hurricane tracked for days. One plan has to serve all three, which is why the runbook below keys each step to time before impact rather than to a named storm. Storm planning is one chapter of a wider picture covered in our Greater Houston dental IT guide.

What has to be true before June 1?

Before June 1, a Houston dental office needs five things in place: an offsite copy of practice and imaging data that someone has restored, server and network gear off the floor, battery backup sized for a clean shutdown, a printable schedule with patient phone numbers, and phone forwarding the front desk can switch on.

Each of those is a decision that takes an afternoon in May and is close to impossible in the 48 hours before landfall, when every electrician, carrier and IT provider in the metro is busy. Work down this list with your provider, and sign each line off with a name and a date.

Pre-season list for a Greater Houston dental office (complete by June 1, recheck in early August)

1. 1. A restored copy, not just a running backup. Ask for one patient chart and one image set to be restored from the offsite copy to a different machine, and for the date it was done to be written down. A green tick in backup software proves the job ran; only a restore proves the data comes back.
2. 1. Know where the offsite copy lives. Write down which building, city or cloud region holds it. An "offsite" copy on a device in the same strip center, or at the owner's house five miles away, shares the same storm.
3. 1. Server, network equipment and backup device off the floor. Shelving or a wall-mounted rack in the closet, with power strips mounted rather than lying on carpet. That manager's checklist puts it plainly: "Turn off computers and servers; make sure electrical equipment is not on the floor."
4. 1. Battery backup (UPS) on the right devices, for the right reason. A UPS on the server, firewall, switch, carrier box and phone equipment exists to ride through flickers and to give the server time to shut itself down cleanly. It does not keep a practice open for days. Confirm the server is set to shut down on its own when battery runs low, and that the UPS batteries were tested this year.
5. 1. The next two weeks of schedule, printable. The same manager's advice, written after Uri, was to print the coming weeks' schedules with each patient's home and cell numbers, just in case. Decide now who exports it, where the copy is kept and who holds it securely.
6. 1. Phone forwarding and the closure message, rehearsed. Know how to forward the main number to a cell phone and how to change the recorded greeting, and have the closure wording drafted.
7. 1. An equipment inventory with photographs. Serial numbers, purchase dates and a photo of the closet and each operatory as it stands today. Your insurer will ask, and the photographs are worth more than the memory.
8. 1. Contact sheet on paper. Your IT provider, your internet and phone carriers with account numbers, your landlord, your insurer and your imaging vendor's service line, printed and in two people's cars.

The federal baseline sits behind this list. The HIPAA Security Rule's contingency-plan standard, 45 CFR 164.308(a)(7), lists a data backup plan, a disaster recovery plan and an emergency mode operation plan as "Required" implementation specifications, and periodic testing and revision as "Addressable" (45 CFR 164.308 at Cornell LII). Reading those words against your own practice is work for a compliance adviser; here they are only quoted.

The service side, meaning how the copies are built, watched and brought back, sits with backup and disaster recovery for dental practices. If you want to grade the backup you have today, the 12-question backup checklist walks through it, and the guide to dental backup basics explains what a tested backup is.

What should happen in the 72 hours before landfall?

In the 72 hours before landfall a Houston dental office should confirm a good backup exists offsite, export or print the schedule, contact the patients who will be affected, move equipment up, set phone forwarding, make the closure decision by a set time, and shut the server, imaging and network down in order before anyone leaves the building.

The runbook below starts earlier than 72 hours, because the National Hurricane Center's cone often gives Houston several days of notice, and the cheapest steps are the early ones. It ends a week after the lights come back, because that is when the damage nobody noticed on day one turns up.

Table 1: landfall-countdown runbook for a Houston dental office

Two lines matter more than the rest. The closure decision needs a named owner and a deadline, because a practice that has not decided by T-minus 48 hours ends up making phone calls and shutting the closet down in the same rushed hour. And nobody should start equipment until someone has walked the building: an office that took in water and is switched on wet turns a recoverable situation into a replacement.

In what order should the server, imaging and network be shut down, and started again?

Shut down from the edges inward: workstations and imaging PCs first, imaging units per the manufacturer, then the practice software's services, the server, the backup device, the network and, last, the carrier's box. Start up in reverse, carrier's box first, checking each layer before the next. Your provider should confirm the order for your equipment.

The order below is a planning example for a typical one-closet office with an on-site practice server. It is not any vendor's procedure. A CBCT, panoramic unit, intraoral camera or milling unit is shut down exactly as its manufacturer's documentation says, and that documentation wins wherever it differs from this table. If your practice software is cloud-hosted, the server rows shrink to whatever is still local, usually an imaging database.

Table 2: power-down and power-up order (planning example)

Two habits make the table work. Unplug what the table shuts down from the wall, not just from a power button, if there is any chance of surge or water when power returns. And leave a printed copy in the closet with the carrier's account number and your IT provider's number on it, because the person restarting the office may not be the person who shut it down.

Where the closet's layout makes this order hard to follow (cables nobody can trace, a server under a sink, no labels), the fix is a planned rework in the off-season. Server and workstation setup for dental offices is where that work is scoped.

What keeps working when the office is dark?

When a Houston dental office is dark, cloud-hosted practice software and Microsoft 365 email keep working only for staff who have power and internet somewhere else. Imaging stays tied to the office. An on-site server is unreachable until power and internet return. The offsite backup copy survives, but it protects the data, not the day.

The honest answer to "will cloud keep us open?" depends on which outage you are having. The matrix below separates five of them, because they fail differently and a Houston practice should plan for each of them.

Table 3: what still works, by outage (typical one-site practice)

Read across the "wide-area" row and the cloud question answers itself. Cloud-hosted software and Microsoft 365 move the data out of your closet, which helps a great deal when the office is the only thing broken: a front desk can rebook from a kitchen table. When the whole area is dark, cloud does not open the office; it means the data is waiting when the office reopens. Imaging stays local either way, because the sensors, pan and CBCT are physically in your building.

That is still a good reason to consider moving some systems. Practices that keep an on-site server should have it backed up offsite and restorable; practices weighing a move should compare the trade-offs with cloud options for dental practices and the decision guide on whether to replace the server or move to the cloud. The storm is one factor in that choice, not the whole argument.

How do patients still reach the practice when the phones are down?

Patients reach a closed Houston practice through three things set up before the storm: the main number forwarded to a cell phone that someone is answering, a recorded greeting that says what is happening and when it will be updated, and a printed list of the next two weeks' patients with phone numbers so the practice can call out.

Phones are usually the first thing patients notice. An internet phone system goes silent when the office internet or power fails, unless the line is forwarded to a cell or the system has an app on staff phones. Older analog lines may keep ringing on a dead desk. Either way, the patient hears nothing useful unless someone prepared the message.

After Harvey left four feet of water in his office in a northeast Houston suburb, orthodontist Dr. Ian Healy told AAO about rescheduling his patients: "And of course, not all of them have been easy to reach." That is the human side of the outage, and it is why the patient-contact steps belong in the IT plan rather than on a sticky note.

Patient-contact steps for a Houston dental office

• • Forward the main number to a named cell phone (and a backup person) at T-minus 24 hours. Test it from an outside phone.
• • Change the greeting to say the office is closed because of the storm, when the next update will be recorded, and how to reach someone for an emergency. That manager's post-Uri list included changing the message to say the office is closed and, when reopening, changing it back to say the office is open.
• • Update the greeting at the times it promised, even if the news is "no change yet".
• • Use the printed schedule to call or text patients from a cell phone, and keep a list of who could not be reached.
• • Post the same update on the practice website and social profiles if someone has access from a phone.
• • Change the greeting back only after the restart checks below have passed, not when the lights come on.

If your phones run over the internet, ask your provider or phone vendor how forwarding and the greeting change are done from outside the office, and write it down. Dental VoIP phone systems explains the options, and how dental phone systems connect to practice software covers what else depends on the phone line.

What if the building floods?

If the building floods, leave every piece of equipment off and unplugged, photograph everything before anyone touches it, call the insurer, and have the IT provider plan a restore from the offsite copy instead of trying the old server. Equipment that sat in water should not be powered on to "see if it works".

Flooding changes the plan from restart to rebuild. Dr. Healy had bought his office the day before the water came in. His summary of that week, as AAO published it: "overnight, Harvey erased it." Nobody can make a building flood-proof with an IT plan, but three choices made in calm weather decide how much is lost.

• • Height. Server, network equipment, backup device and UPS on a rack or shelf rather than the floor. Workstations under front desk counters are the most exposed; know which ones hold anything that is not also on the server.
• • Room choice. If you are building out or renovating, put the closet away from exterior walls, below-grade spaces and restrooms or plumbing walls. Ask your landlord or insurer about your suite's flood history; this page makes no claim about which parts of Houston flood.
• • Where the data lives. If the only copy is in the building, a flood takes the records with it. An offsite copy that has been restored at least once turns a flooded closet into a hardware problem rather than a records problem.

After a flood, the order is the insurer's documentation first, then a decision on what to replace, then a restore to new or cleaned hardware, then the restart checks below. Keep the damaged drives until your provider and insurer agree they can go, and keep them secure, because they still hold patient data.

What should the IT provider check when power comes back?

When power comes back, the IT provider should bring the office up in the planned order, confirm the server and database started cleanly, check that last night's backup ran or run one now, test UPS batteries and any internet failover, and then run one full patient workflow from imaging to claim before the schedule is reopened.

A Houston office usually gets power back before it gets a clean morning. Drives that were spinning when power failed, UPS batteries that ran flat and carrier equipment that came back in a strange state show up in the first hour of the first patient day. A short, fixed check list catches them before a patient is in the chair.

Restart checks before the first patient

1. 1. Walk the building before anything is switched on: water, burning smell, damaged ceiling tiles over equipment.
2. 1. Start up in the Table 2 order, waiting for each layer.
3. 1. Server health: no disk warnings, practice and imaging database services running, correct date and time.
4. 1. Backup: the date of the last good backup, and a new backup started once the server is up. If the last one failed, say so in writing.
5. 1. UPS: batteries that ran down to empty may not hold a charge again; test them or replace them.
6. 1. Internet: speed and stability from one PC; if you have a second connection or cellular failover, confirm the office switched back to the main line.
7. 1. Phones: desk phones registered, forwarding turned off, greeting changed back (only after the test below passes).
8. 1. First-patient test: take an intraoral image in one operatory, confirm it appears in the patient's chart, open the chart from the front desk, and create and send a test claim or eligibility check.
9. 1. Write up what failed, so the next storm's plan is better than this one.

If the problem is the office connection rather than the building, the steps in what to do when the office internet is down take over from here.

Does a storm plan also cover ransomware and other outages?

Mostly, yes. A storm plan and a ransomware plan share the same recovery core: an offsite copy that has been restored, a known restart order and a way to keep reaching patients. What differs is the trigger. A storm gives warning and leaves data intact; ransomware arrives without notice and may also involve stolen patient information.

The part a storm plan does not cover is the second half of a cyber event. Where sensitive personal information is involved, Texas Business and Commerce Code §521.053 gives a 60-day outer limit for telling affected individuals, counted from when the business determines a breach occurred; how it applies to a given incident is a question for counsel. The Houston view of those rules is in the Houston dental cybersecurity guide, and the technical side of getting back up is in recovering a dental practice from ransomware.

What does storm-ready IT cost?

Two published numbers frame the budget: Legend Networking's plans are "Starting at $360 per month", with "Backup protection from $39.99 per month (storage-dependent)". Hardware procurement, major cabling projects and software licensing are quoted separately, so a new rack, UPS or server for storm readiness is a separate quote, not part of the monthly figure.

What each number covers depends on the practice, which is why this page does not list it: the number of workstations, how much imaging data needs protecting and whether the practice software is on site or cloud-hosted all change the answer. The fixed points are the published ones above. On the service side the published lines are 24/7 monitoring; a staffed 24/7 helpdesk at 1-800-794-1588; "In-house engineers; no outsourced first-level triage"; and "Onsite dispatch by appointment across served dental markets; remote-first nationwide". Ask how that onsite line applies to your Houston-area office; during and right after a storm, onsite visits are something to schedule, not something any provider can promise on a timetable.

For context on the company behind those numbers: headquartered in Dallas; 22+ years in dental IT (since 2004); "Served over 3,500 practices since 2004"; 4.8 rating · 173 Google reviews. Named on Legend's own site: Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps. Practices Legend has worked with across Greater Houston are listed in the projects section of the Houston guide linked above; none of them is described here as a storm recovery.

What to ask your IT provider before hurricane season

Put these to whoever supports your office now, in writing, in May. A provider who has thought about a Houston season will answer most of them in one email.