Lightning and Surge Protection for Orlando Dental Offices: Where Surges Get In and Who Fixes Each Layer

Picture a Thursday, 3:40 p.m., in July, at a practice off Osceola Parkway in Kissimmee: one close crack of thunder, and the front-desk phones lose dial tone. Two operatory PCs will not boot. The server in the closet is humming, but the switch beside it is dark.

Nothing visibly hit the building, and that is the usual pattern. The surge came in on a wire, not through the roof. This guide is for the owner, or the office manager standing in for the owner, who is looking at the damage from the last storm and wants three answers: how the surge got in, what else it reached, and who should fix which part so it does not happen again next July. It names the paths, maps each piece of dental equipment to its exposure, separates the electrician's work from the IT provider's, and ends with a triage table your team can use the next time the lights flicker.

How often does lightning threaten an office in Central Florida?

Often, and on a predictable clock. In NWS Melbourne's phrase, central Florida is the "Lightning Capital" of the United States, and over 90% of this area's lightning arrives from May to October, between noon and midnight. For a dental office, that lands on the afternoon schedule for half the year.

NWS Melbourne's lightning facts page (undated, accessed 19 October 2026) also names the band running from Tampa Bay across to Titusville "Lightning Alley" and says it gets more lightning each year than any other part of the country. Orlando sits between those two ends, so a practice in Winter Park, Sanford, Altamonte Springs, Clermont or Kissimmee is inside the corridor the weather service is describing.

The human toll comes first. An NWS-hosted compilation of NOAA Storm Data (Vaisala, updated May 2018) counts 498 lightning deaths in Florida from 1959 to 2017, the most of any state. NWS Melbourne adds that, on average, "lightning is responsible for more weather-related deaths in Florida than all other weather hazards combined." Staff and patient safety is the reason the office has a storm routine at all; the equipment comes second.

What the timing means for IT:

• • Summer afternoons carry the risk. If your practice runs a 7 a.m. start, most of the season's lightning falls after lunch, during the busiest restorative and hygiene blocks.
• • Planned work belongs in the morning. Server updates, firewall changes and imaging software upgrades scheduled for a June or August afternoon compete with storm cells. Ask for morning or weekend windows from May through October.
• • The off-season is for fixing. November through April is the time to replace UPS batteries, add data-line protection and have the electrician look at the panel, before the next wet season starts.

A practice does not need a direct strike to lose equipment. A strike on a pole down the street, on the cable plant or on a neighbouring building can push a surge through the wires your office shares with everyone else on the block. The next section follows those wires.

How does a surge reach equipment that was never struck?

Through any conductor that runs from outside the building to the device. NIST's surge guide lists the paths as "power, telephone, cable, or antennas" and warns that equipment connected to two systems at once, such as a computer on both power and a network line, can be damaged by the voltage difference between them.

NIST's Surges Happen! (SP 960-6, May 2001) was written for homes, but the physics carries straight into a dental office. Its key line: "Each of these connections offers a path for a surge to come in, something that might be overlooked when the cause of damage is explained as a 'power surge.'" The guide names two origins, "lightning surges and switching surges", and notes that "A surge will last only a few millionths of one second", which is why nobody in the office sees anything happen.

In a dental office, the paths look like this:

• • The utility feed. Power arrives at the meter and panel and travels on every circuit in the building. A surge here reaches anything plugged into a wall.
• • The internet line. A coaxial cable from the cable company is a copper conductor from outside to your modem. A fiber service usually ends in a terminal (an ONT) that has its own power supply and a copper Ethernet port into your firewall.
• • Phone and analog lines. Copper phone lines still serve fax machines, alarm panels, elevator phones and some card terminals in older Central Florida plazas.
• • Long data runs. Ethernet cable to an outdoor camera, a gate controller, a sign or a detached sterilization or storage building leaves the building and comes back in, carrying whatever it picks up outside.
• • Antennas. A rooftop cellular booster or satellite dish brings a cable down into the building.

The idea that catches most offices out is what NIST calls the two-link appliance: a device connected to both power and a communications line. A surge "coming in from one of the two systems - power or communications - can damage the appliance, because of a difference in the voltage between the two systems when the surge occurs. This can happen even when there are surge protectors on each of the systems." NIST's answer is a protector that "incorporates, in the same package, a combination of input/output connections for the two systems."

Almost everything in a modern dental office is a two-link device. An operatory PC has power and a network cable. A VoIP desk phone takes power and data on the same Ethernet line from a switch that is itself plugged into the wall. An intraoral sensor hangs off a PC that is on the network. That is why the switch can die while the server next to it survives: the surge took the data path, not the power path.

Two more NIST lines matter for the conversation with your electrician. First, "lightning rods are intended to protect the structure of the house and avoid fires. They do not prevent surges from happening in the wiring." Second, "The best surge protector in the world can be useless if grounding is not done properly." Grounding and bonding are the electrician's job, not something staff should touch or an IT provider should improvise.

Which equipment in a dental office is most exposed, and how should each be protected?

The most exposed equipment is whatever connects to a line that leaves the building: the internet terminal, the firewall, the network switch that powers the phones, and anything on long cable runs. Each device needs protection on every path it uses, installed by the trade that owns that path.

Use the table below as an exposure map. Walk the office with it, find each device, and write down what currently protects it. Blank cells are your work list.

Two notes on the table. First, imaging equipment comes with its own installation requirements from the manufacturer, and those win over any general advice here; the IT provider's job is the computer, the network link and the software side, which is where dental software and imaging support in Orlando comes in. Second, "who installs it" is about trade, not blame. A panel device is electrical work. A UPS with shutdown software is IT work. A camera run is often the security contractor's. If nobody in your office knows which trade did what, that gap is the first thing to close.

Practices running DEXIS, Vatech, Carestream, Planmeca/Romexis or Dolphin Imaging on acquisition PCs, and Dentrix, Eaglesoft, Open Dental or Archy on a local server, have the same pattern: the clinical software is only as available as the PC, switch and server underneath it. The server and workstation side is covered in more depth on our dental server and workstation setup page, and the cabling and switch layout on dental office network design.

Surge protector, UPS or whole-building protection: what's the difference?

They do different jobs. A panel surge protective device diverts large power-line surges before they spread; a point-of-use protector guards one device and its data line; a UPS bridges a sag or short outage and gives the server time to shut down. An office with a server and imaging usually needs all three.

The confusion comes from the products. A power strip with a surge rating, a UPS with surge outlets and a panel device all get called "surge protection". The table separates them by what each does and does not do, using NIST's guide and Schneider Electric's UPS white paper (the manufacturer's own description of UPS types, cited as a source, not as a product recommendation).

Where the layers meet is where gaps hide. The electrician who fits a panel device may assume the IT provider handles data lines; the IT provider who installs UPS units may assume the panel is protected. A short written note that lists each layer, the date it went in and the trade responsible is worth more than any single product.

Two practical points for an owner. First, a UPS is not a surge protector by default; read its specification or ask your IT provider whether the outlets you are using are surge-protected, battery-backed or both. Second, consumer power strips get swapped, daisy-chained and moved around operatories over time. If a strip has no label, no date and nobody knows where it came from, treat it as unknown and replace it to a standard.

How long should the batteries last, and what should shut down first?

Long enough to ride through flickers and give the server a clean shutdown, not to keep seeing patients through a long outage. NIST describes a UPS as power "across a sag, or for the first portion of an extended outage." Runtime depends on the load and the battery's age, so measure it rather than assume it.

Central Florida's summer pattern is many short events rather than one long one: a flicker as a cell passes, a two-second drop, a minute-long outage while the utility's equipment recloses. A UPS earns its keep on those. It keeps the server, switch and firewall up, so a half-second blip does not reboot the practice management database mid-transaction or drop every phone call at the front desk.

For a longer outage, the goal changes. The server should not run until its battery is flat and then lose power hard. Ask your IT provider to set up the UPS so that, after a set time on battery or at a set charge level, it signals the server to save and shut down by itself. That is what "a clean shutdown" means in practice, and it is the step most often missing in offices that already own a UPS.

The principles for deciding what goes down first, without a fixed script:

• • The server goes down on a signal, not on a person's memory. Shutdown software connected to the UPS handles it whether or not anyone is in the building.
• • Network gear stays up while the server finishes. The switch and firewall are what let the server's final writes, and any alert about the outage, get out.
• • Workstations save and close first. Front-desk and operatory PCs on small UPS units should give staff enough time to save the chart and close the imaging software.
• • Imaging capture is finished or paused safely. Nobody should be cutting power to an acquisition PC while an exposure is in progress; let the procedure reach a safe stopping point.

What to log, so the battery is not a guess:

• • the date each UPS was installed and the date of each battery replacement;
• • the result and date of the last self-test, and the runtime it reported;
• • which devices each UPS feeds (labelled on the unit, not only in someone's head);
• • the replacement interval in the manufacturer's guidance for that model.

A UPS that beeps every morning is not "fine"; it is reporting a failed self-test or a weak battery. Batteries age whether or not the power ever goes out, and Florida closets that run warm in August do them no favours. Decide on replacement with the manufacturer's guidance and your self-test log, not on how long the unit has been quiet.

What do Duke Energy Florida and OUC outages look like for an Orlando practice?

Which utility serves your building decides whom you call, whose updates you watch and what the utility says it will and will not cover. OUC and Duke Energy Florida both publish storm outage figures, and OUC's business guidance puts the job of protecting a customer's own equipment on the customer, not the utility.

Start by checking the practice's power bill. It names the utility for your service address, and that, not a neighbour's account or a map, decides which reporting line and which updates apply to you.

What each utility has published:

• • OUC, Hurricane Milton. OUC's July 1, 2025 reliability release says: "When Hurricane Milton hit Florida in October, more than 89,000 OUC customers lost power," and "crews completely restored electricity within 72 hours."
• • Duke Energy Florida, Hurricane Milton. Duke's October 12, 2024 update reports: "Outages have decreased from over 1 million immediately post-storm to approximately 580,000," and lists Lake, Orange, Osceola and Seminole among the counties that "will be restored by 11:59 p.m. ET on Sunday, Oct. 13." Duke's October 17, 2024 release is headed "Duke Energy Florida restores power for over 99% of customers impacted by Hurricane Milton."
• • OUC on equipment protection. OUC's business power-quality page: "Customers are responsible for properly protecting their electrical equipment because, as infrequent as they are, power interruptions do occur." The same page suggests you "Have a licensed electrical contractor inspect your three-phase equipment and install added protection if needed."
• • Duke on damage at the building. In the same October 17 release, customers "who cannot receive power as a result of damage to the property's meter base, breaker panel or customer-owned electrical wiring should contact their local municipalities for guidance."

The hurricane figures are here because they are what the utilities publish; a summer thunderstorm outage on your block is a smaller event, but the wet season brings that risk back every year. Named-storm planning is a separate job, and Florida's hurricane and cybersecurity guide for dental offices is where it lives on this site.

How to report an outage:

• • OUC lists three channels on its storm center page: "Call our 24-hour reporting line at (407) 423-9018," "Text OUT to 69682 (myOUC)," or log in to myOUC and fill out the outage form.
• • Duke Energy Florida customers should use the outage reporting options on Duke Energy's own website and keep the account number for the practice's service address where the front desk can find it.

Put the right utility's reporting details on the same laminated card as your IT provider's helpdesk number, so whoever is at the front desk at 4 p.m. does not have to search for them.

What should the office do while a storm cell is overhead?

People first. NWS Melbourne's indoor advice is to "Avoid contact with corded phones" and "Avoid contact with electrical equipment or cords," and "If you plan to unplug any electrical equipment, do so before the storm arrives." Leave protected equipment on its UPS, and bring procedures to a safe stopping point before anyone reaches for a plug.

During clinic hours, the useful rules are short:

• • No one crawls under desks pulling plugs while thunder is overhead. That is the moment NWS says to stay away from cords. The protection you installed beforehand is what works during the storm.
• • Leave the server, switch and firewall on their UPS. They are meant to ride through. Pulling them by hand risks the very hard shutdown the UPS exists to prevent.
• • Clinical work reaches a safe stopping point. If power is unstable, the dentist decides when to pause an imaging capture or a procedure. Unplugging chair-side equipment mid-treatment is not a surge plan.
• • One person watches the front desk systems. If phones drop, that person moves to the call-forwarding step in the triage table below.

When a storm is forecast and the office is closing for the day, the guidance changes. FEMA's power-outage sheet says: "Unplug appliances, equipment and electronics to avoid damage from electrical surges. Use surge protection devices." Ready.gov's thunderstorm page (last updated 05/11/2026) adds: "Consider buying surge protectors, lightning rods or a lightning protection system to protect your home, appliances and electronic devices."

For a dental office, that becomes a closing-time decision you agree in advance with your IT provider:

• • workstations, printers and anything not on a UPS can be shut down and unplugged at close;
• • the server, firewall and switch usually stay on their UPS so that overnight backups and monitoring keep running, unless your IT provider advises otherwise for that night;
• • imaging acquisition PCs and sensors follow the imaging manufacturer's guidance.

Write the agreed list down. In the middle of an August afternoon, nobody should be deciding it from memory.

After a strike, how do you find what was damaged?

Work from symptoms to components, check the simple things staff can safely see, and call the IT provider before restarting the server or reinstalling anything. Surge damage is often partial: one port, one power supply, one sensor. A methodical first look saves hours and stops a healthy device from being replaced.

An editorial by Michelle C. Dziurgot in the Journal of the Michigan Dental Association (November 2025) described an August 2025 direct strike whose "all-out power surge" "fried equipment including dental chairs, computers, and HVAC", and advised offices to "Document all damage with photos and receipts." A Dentalcompare clinical director wrote in 2012, after a surge "ended up bouncing half of computers in the office", that "the power supply got fried, and the rest of the machine was fine." Both point the same way: find the failed part before replacing the whole machine, and photograph everything.

Legend's helpdesk is part of that last column for Legend clients: Helpdesk staffed 24/7 at 1-800-794-1588, alongside 24/7 monitoring, and Legend works with in-house engineers; no outsourced first-level triage. When a part has to be swapped in the building, Legend's model is onsite dispatch by appointment across served dental markets; remote-first nationwide. For phones specifically, our dental phone systems page and the dental helpdesk page describe those services.

Once the office is running again, two follow-ups matter. First, confirm that the last backup completed and can be restored, because a surge that hit the server's power may also have hit its disks; the dental backup and disaster recovery checklist is a good structure for that check. Second, add what failed to a running list. Two storms that each killed the same switch port are telling you where protection is missing.

What does surge and power protection cost, and who pays for what?

Costs follow the trades. Panel protection is quoted by the electrician; UPS units, point-of-use protectors and their setup are hardware and IT work. At Legend, "Hardware procurement, major cabling projects and software licensing are quoted separately." Whether a policy covers surge damage is a question for your insurer and, for the building's wiring, your landlord.

There are no honest universal figures for this. A one-room closet with a server, firewall and switch needs a different UPS from a three-provider office with CBCT and a dozen operatories, and the electrician's quote depends on the panel and building. What an owner can do is get each layer quoted by the right trade, in writing, with the device list attached.

Who usually carries which cost:

• • The practice: UPS units, point-of-use protectors, replacement batteries, and the IT time to install and configure shutdown.
• • The electrician's quote: panel surge protection, and any electrical work the inspection finds.
• • The landlord, depending on the lease: the building's electrical service and panel in many multi-tenant plazas. Read the lease before booking an electrician for a panel you may not own.
• • The utility: OUC's surge protection programs are described as "Designed to protect a renter's or homeowner's electrical appliances and electronic devices", so ask OUC directly before assuming any business coverage. Duke points customers with damage to the meter base, breaker panel or customer-owned wiring to their local municipality.
• • Insurance: ask your insurer what your policy says about surge and lightning damage to equipment and data, and keep the photos and receipts the Michigan editorial recommends.

The data matters as much as the hardware. Replacing a server is a purchase; rebuilding a patient database without a backup is a different problem. Legend's backup is priced separately: "Backup protection from $39.99 per month (storage-dependent)". Our dental backup and recovery page describes the service, and it is the right place to start if the storm left you unsure whether last night's backup ran.

What to ask your IT provider about storms and surges

Put these to the provider you have now, or to any provider you are weighing up. Clear answers include names, dates and a written device list, not reassurance.

Where the facts on this page come from

Every weather, utility and equipment fact above comes from its publisher, quoted or closely paraphrased, with the date the publisher shows: NWS Melbourne's lightning pages (undated; accessed 19 October 2026) and the NWS-hosted 1959–2017 fatality compilation (May 2018); NIST SP 960-6 (May 2001, written for homes); Schneider Electric's UPS white paper (April 2024); FEMA's power-outage sheet (December 2023) and Ready.gov (updated 05/11/2026); OUC's business power-quality page, storm center and July 1, 2025 reliability release; and Duke Energy Florida's October 12 and October 17, 2024 Milton releases. No figure on this page is an estimate of ours. Closer to home, Legend helped create the technology foundation behind Sapphire Dental Studio, which launched in Winter Garden, west of Orlando, with a brand-new facility. For the wider picture of practices across the metro, read our Orlando and Central Florida dental IT guide, and for specialty and provider questions, technology for a pediatric practice in Orlando and a scorecard for choosing a managed IT partner in Orlando.