Terri Lively

Choosing the teeth your patient will use in their denture is essential. Our experts share their considerations regarding this vital decision.

	Selecting teeth for your patient's denture is a modern task. The earliest dentures did not have many options. The first denture teeth were not even human, but instead the teeth of wolves, horses, and donkeys. Others were carved out of ivory.

	Human teeth soon replaced the animal ones. In the 19th century, denture teeth were extracted from fallen soldiers on the battlefield at Waterloo. Some early denture teeth were the product of grave robbing, while others were paid for, purchased from the poor who were short on cash but long on healthy incisors. 

	Luckily, choosing denture teeth is far less barbaric today. Dentists and labs have an assortment of teeth sizes, shapes, and shades that can accommodate all types of patients, and not one of them comes from a cadaver-human or otherwise. 

	With all these options available, how should dentists choose denture teeth for their patients? What are the essential considerations you should employ and mistakes you should avoid? We asked a few experts and here's what they had to say.

	Choosing denture teeth is a team effort, chairside or at the lab

	Shirin Khoynezhad, DDS, a prosthodontist and the Director of Second-Year Pre-Clinical Dentistry at the University of Alabama, says she involves her patients in the decision. Dr. Khoynezhad handles the size, the occlusal schemes, and the material, and then gives the patient choices on the shade and shape. 

	 Another essential consideration is the patient's edentulous ridge. If they have a good one, Dr. Khoynezhad will choose more sophisticated anatomical teeth. If not, then she says those types of teeth would drive the patient crazy. 

	Freedom in centric is an essential concept for denture teeth and the occlusal scheme. It means that when the patient holds their teeth together, they can move their teeth around a little. Denture teeth with freedom in centric designed into them look like teeth but with a flatter table, which gives the patient room to grind back and forth without dislodging the denture due to interferences. Dr. Khoynezhad prefers to use denture teeth that have flatter cusps and allows for freedom in centric for patients who have a flatter edentulous ridge. 

	"If you go with anatomical teeth, the denture will move too much. There will be more interferences," Dr. Khoynezhad explains about patients who have a worn-down ridge. 

	Patient expectations also come into play when selecting denture teeth. Dr. Khoynezhad likes to give patients a couple of options to choose from when selecting denture teeth. She finds that their involvement in the decision increases her patient acceptance of the prosthesis. 

	She also asks patients what they want from the denture. Some say they wish to eat comfortably while others want no one to know they are wearing dentures.

	"All of these expectations are super important and play a role in what we can choose," Dr. Khoynezhad says. 

	When it comes to shape, Dr. Khoynezhad says she starts with the guides. However, nature has many variables, and this variety makes it difficult to stick to the guidelines. 

	"So, a lot of times, I ask the patient to bring me some old photos to show me what their natural God-given teeth looked like," Dr. Khoynezhad says. "And then I start from there."

	Raymond Choi, DDS, an implant dentist and educator for Glidewell Laboratories, has a different take on this subject. He says many dentists don't choose the teeth at all. Instead, they have the lab do it. 

	However, Dr. Choi thinks that if you do have a mould guide in your office, you can show patients the teeth available for their dentures. He sees it as a way to get the patient involved in the process. Most patients (and even most doctors) have no idea what kind of teeth they want, Dr. Choi says. They do know, however, the shade they want.

"Picking the shade can be an issue," Dr. Choi says. "Some people want a white shade, a light one. So then, we order a bleaching shade and send it to the lab to choose from there."

	Dr. Choi says that when working with a good lab, he also likes to take a photo of the patient smiling. When the technician sees the patient's face and compares that with the ridge size revealed from the impression, the technician has an easier time picking the proper teeth as far as shape and size. 

	"I think for most dentists, they just take a picture and send it to the lab, and the lab can take it from there," Dr. Choi says.

	Improved materials make it easier to avoid common mistakes

	A common mistake that can occur when selecting denture teeth is choosing the wrong material. In the occlusal scheme, the dentist should be aware if the opposing teeth are natural or if they are crowns, particularly porcelain fused to metal (PFM) crowns. Purely acrylic denture teeth will wear down quickly against PFM crowns. 

	Josh Gall, General Manager of Axi Dental Laboratory in Tustin, Calif., says that revolutions in materials have improved the choices you have for denture teeth materials for longevity and esthetics. In the past, porcelain was the best option for both. Unfortunately, it was hard on the opposing teeth. 

	"It's probably not the best thing to do to put something that is more abrasive than your natural teeth against your natural teeth," Gall says. "Also, trying to process plastic dentures was challenging with porcelain teeth. There was always a little concern about retention. The weakest link theory is that the porcelain is going to break the plastic."

	Gall says that polymers today, particularly the composite-reinforced denture teeth, not only make it easier to have a denture tooth with the longevity and esthetics you need but also more "user-friendliness" as far as the denture construction. The many premium lines of composite polymer denture teeth use the same moulds as their porcelain teeth, so the teeth made from the new materials look precisely the same as porcelain but without wearing down the opposing teeth, he says. Some brands that he likes include Bioform

 (Inter-penetrating polymer network) from Dentsply Sirona and Physiodens

	Studies have shown that porcelain teeth can contribute to ridge resorption because of the forces involved. This is why Dr. Khoynezhad does not like porcelain teeth as much as the composite reinforced acrylics.

	"Something needs to give, and if the teeth are not giving, then the ridge will resorb underneath," Dr. Khoynezhad explains. "My favorite material that I use a lot is SR Phonares

 II (Ivoclar Vivadent), which is a composite nanohybrid reinforced acrylic. They are esthetic, and they are harder than regular acrylic teeth."

	The range of price is vast for denture teeth when it comes to synthetic resins. However, the increase in price usually concerns how they will wear in the patient's mouth and resist the loss of vertical dimension that is prevalent in long-time denture wearers, according to Dr. Choi, who believes there is another reason that dentists prefer acrylic denture teeth.

	"Plastic teeth can be adjusted easier to make up for the dentist’s poor bite record," Dr. Choi says. 

	In addition to improved wear properties, Gall says that the new denture teeth are easier to shade match than in the past. Before the advances in materials for denture teeth, dentists would have to change from the teeth you wanted to use because they didn't come in the shade that was needed. However, the new materials allow for more shade options at both the affordable and premium ends of the denture-tooth spectrum.

	Plus, the new materials teeth can mimic the inconsistencies and contours that natural teeth have better than porcelain does, Gall says. This feature is useful for patients that would like to disguise the fact that they are wearing dentures. 

	"You can't quite tell that people are wearing dentures these days if you pick the right shape and size that fits that patient's mouth," Gall says. "Some patients even have us set it up in such a way that it has more character. You might mimic a snaggletooth appearance to throw people off."

	One common mistake is that dentists do not communicate enough with the lab technician, Dr. Choi notes. Some cases he knows of have had little more than shade information attached to the impression. However, communication is essential to getting a high-quality denture back. 

	"Make sure that your lab knows what they are doing and then give them some data, including pictures and study models of the old denture, among others, so they can do what they do well," Dr. Choi says. "They will do good things for you."

	What the Lab does when choosing denture teeth

	When choosing denture teeth, he starts with the patient's photo, Gall says. Also, he wants his clients to remember the "measure twice, cut once" guideline and to get as much information as possible about the case. Gall recommends taking a facebow articulation to capture the patient's natural midline, as well as how much inter-occlusal space the patient has. 

	"So, between width based on the midline and the size of the teeth that they have or had, and then height, those help us determine what size to use for the denture," Gall says. 

Once the size is figured out, Gall looks at the photo for other features that help him choose the details of the denture teeth, like the shape. Some of these choices have their foundations in Dentogenics.

 concept was developed by Dr. John Frush and Dr. Roland Fisher in 1959. It called upon prosthodontists to replace lost dentition using the patient's sex, personality, and age as a guide.

	Dr. Frush examined many corpses to find patterns, Dr. Choi explains. He determined that men tended to have straight lines in their teeth, where women had more curves to them. Moreover, Dr. Frush saw that active people had masculine-looking teeth, and less active people had more feminine-looking teeth. Finally, he saw that older patients had teeth that were more worn at the edges. 

	From these observations, Drs. Frush and Fisher developed six moulds. While few labs or dentists use these six moulds today, Dr. Choi believes that Dentogenics influences the shape of denture teeth today, as well as veneers and other prosthetics.

	Gall does not use the six moulds, either, but he does follow some of the principles when choosing denture teeth for a prosthesis. For example, if the patient has a masculine look, Gall might choose more square teeth, and for a feminine look, more ovoid or tapered teeth.

	Another factor that goes into choosing denture teeth is the vertical dimension. When a patient has been wearing dentures for a long time, they lose some of the height in their jaw, which gives them a sunken-in look when they remove the prosthesis, Gall says. If the right teeth are chosen, you can help restore that vertical dimension lost over the years. 

	"You get somebody with a brand-new set of dentures and reopen those five or six millimeters if they can tolerate that, then all of a sudden they've got this full face again. It's a dramatic change to their overall appearance, not just the teeth themselves. All those factors come into play when you're picking your size or shape of denture teeth," Gall explains. 

	The beauty of the customized denture is that at the try-in appointment, you can ensure that you have the correct teeth for the patient, as far as size and shape, Galls says.

	“The more information the dentist gives you, with photos and such, then you get a much better feel for which tooth you're picking and why you're picking it," he says. "You increase your chances at the first try-in and going well and being the right one."

	However, with traditional try-ins and setups, you will likely still have a bit of back and forth with the tooth selection, Gall adds. Digital dentures, on the other hand, can do a lot to eliminate the trial and error inherent in the tooth selection process for conventional dentures. Labs can produce digital mockups that include the patient's face, which can complete the case without a physical try-in. This method is particularly helpful for the fully edentulous patient. 

	"A lot of times when people who have no teeth get teeth, anything is going to look great," Galls says. "However, since you do have the ability, given a chance to customize it, to make sure patients are super happy with teeth made to fit them and not just happy to have teeth again, that's what gets more fun and rewarding."

			Frush, John P. et al. "Dentogenics: Its practical application

, Volume 9, Issue 6, 914 – 921. Accessed via the web. 18 November 2019. < 

https://www.thejpd.org/action/showCitFormats?pii=0022-3913%2859%2990149-0&doi=10.1016%2F0022-3913%2859%2990149-0

Articles

Denture Teeth: How to select the best for your patient

	There are essential considerations when relining dentures. We spoke to two experts who share their expertise for relining dentures.

	The human body is always changing. The intraoral tissue that fits up against a denture change, too. That means even the best fitting denture is likely to need some maintenance to restore the fit after some time in use to extend its longevity.

	Relining serves as crucial maintenance for a denture prosthesis. When you reline a denture, you resurface the tissue side of the denture so that it fits better in the patient’s mouth.

	Today we take a closer look at relines and how you can improve their outcome for your patients. We will also explore some common problems that occur with this crucial maintenance of dentures. Finally, we share some ways to set proper expectations to ensure you deliver an excellent patient experience. 

	What the Clinician Can Do to Improve Relining

	Shirin Khoynezhad, DDS, is a prosthodontist and the Director of Second-Year Pre-Clinical Dentistry at the University of Alabama. Dr. Khoynezhad says that a soft reline handled chairside can provide temporary relief from dentures that do not fit like they once did.

	“When the denture is slightly ill-fitting, I use the soft reline so that in a year or six months, we can do the hard reline of the denture,” Dr. Khoynezhad explains. “It’s intermediate treatment.”

	Raymond Choi, DDS, an implant dentist and educator for Glidewell Laboratories, uses soft relines when the patient has delicate or irritable gums, and usually on the bottom denture. Often, he says the irritation occurs when the patient has lost a lot of bone, and the pressure of eating causes the tissue to react.

	“A soft reline can be done chairside or through the lab, but the lab reline will last longer and be cleaner,” Dr. Choi says.

	When it is time for the hard reline with the lab, it is critical to check how worn the denture is, Dr. Khoynezhad says. She recommends checking the flanges or the borders of the denture because if they are too ill-fitting, a new reline is not going to be as effective without border molding.

	“You need to readopt all the borders and then do the reline impression inside the denture,” Dr. Khoynezhad says. “Usually, if the dentures are over two years old, I do the border molding.”

Dr. Khoynezhad also activates all the muscles around the mouth in function so that when the patient is using the prosthesis, the denture will be stable in their mouth. Also, when the fit of the denture is off significantly, she will use a tripod method with medium or heavy body materials to stabilize it during the border molding process.

	“Next, I do border molding, and then I do a reline wash impression with the light body inside the dentures. That will give me a more stable reline,” Dr. Khoynezhad says. 

	Dr. Khoynezhad will also take a bite registration before relining. So, if the denture is rocking, she finds the correct position for occlusion and takes the patient’s bite registration before taking the relining impression.

	“It’s going to be even pressure in the correct position for the impression. That will help me save a lot of time adjusting the denture afterward,” Dr. Khoynezhad says.

	Dr. Choi does not always take a vertical dimension because he can sense when the bite is off in a denture from doing so many of them, he says. However, for dentists that work on dentures less regularly, he would also recommend taking a bite registration and vertical dimension before and after the reline impression.

	Dr. Khoynezhad also sees a lot of flabby tissue underneath the dentures, especially old dentures. If she sees it, she puts a ventilation hole before taking the impression.

	“It will decompress the pressure from that spot, and the tissue will be in a relaxed position while taking the impression instead of pressing against it when I am is taking the impression,” she says.

	On the clinician side, Dr. Khoynezhad says the common problem is that the dentist does not stabilize the ill-fitting denture enough when they take the impression. As a result, when they get the prosthesis back from the lab, it needs a lot of adjustments. 

	“When the denture is rocking back and forth, and you just jump into impression material, you will not get the correct position of that denture,” she explains. 

	Dr. Choi says a problem he often sees during relining is overextending the border of the denture, which will cause the prosthesis to drop. To prevent overextending the borders, he recommends doing a border mold for relines.

	Another common problem Dr. Khoynezhad sees is not paying enough attention to the health of the tissue underneath the denture. If it is distorted or not healthy enough, Dr. Khoynezhad says you should not go for the reline until the tissue heals. 

	“If it is distorted, that means there is too much pressure on the tissue. If we jump to a reline, the new denture will continue to do whatever it was doing to the oral tissues, and it will not relieve it,” Dr. Khoynezhad says. 

	Dr. Choi says another challenge with relines is that if you don’t get the patient back into the original position of the denture, you can change the complete denture’s three-dimensional position. The resulting relined dentures are different than what the patient had before. Early in his career, he says this happened to him. 

	“I got floored once. I did my relining, and on that patient, I could see the front teeth a lot more than I used to. I had changed the position of the whole denture,” Dr. Choi remembers. “There’s no going back, by the way, once that happens. You cannot go back to where you were. Relining can be a very serious business.”

	To avoid this problem, Dr. Choi recommends using the vent holes, particularly in the upper denture. The vent holes allow the material you use for the relines, whether chairside material or impression material for the lab to do the reline, to escape if needed. 

	“You won’t end up with lumps here or there that could change the position of the denture in three dimensions,” Dr. Choi says.

	Setting Expectations about the Reline is Critical to Patient Experience

	One of the most common problems with a reline is not meeting patients’ expectations for the fit afterward. Setting a proper expectation for the amount of improvement the patient can expect is a vital part of relining success. Dr. Khoynezhad tells patients that while she will do everything in her power to readopt the tissue to the base, a reline won’t be like a new denture. 

	“I tell them that the worn teeth on the other side won’t be replaced, so the bite may not be ideal,” Dr. Khoynezhad says. “It will fit better, for sure, but the bite will be almost the same.” 

	“Doing dentures successfully for a dentist is all about managing patient expectations. I don’t mean that in a manipulative sense at all. You have to let the patient know the realities of where that patient is,” Dr. Choi says. 

Dr. Choi says that in the interest of making the experience more pleasant, sometimes dentists will not tell the patient the whole truth about what wearing dentures will be like. The same goes for relining. Dr. Choi says that relining a relatively new denture will benefit the patient. However, if the denture is old and worn, he would not do a reline because it will not solve the problem.

	“By then, the vertical dimension has changed, the teeth have worn, and the occlusal plane has changed. So, a reline will not correct those issues,” Dr. Choi says. “A reline will only fill in those potential gaps that had occurred since the last reline or when the denture was made between the hard denture surface and the delicate gum surface.”

	Instead, in those situations, particularly when the patient has lost vertical dimension, Dr. Choi would encourage patients to get a new denture. A new denture restores the esthetics of the smile and restores the temporomandibular joint and all the supporting musculature as well. 

	“For some patients, relines can be a quick fix,” Dr. Choi says. “But patients that are having major issues, usually a reline is not going to solve those problems.”

There are essential considerations when relining dentures. We spoke to two experts who share their expertise for relining dentures. 

Relining: What Every Dentist Should Know

	The Cloud-Based system you outsourced data security is more vulnerable than you might think. Here’s what you can do to protect your patients’ information and your practice’s longevity.

	Attacks on health care providers’ managed service providers (MSPs) are on the rise this year. Hackers realize the efficiency of attacking IT MSPs that handle multiple dental practices and getting all the MSPs clients’ electronic Protected Health Information (ePHI) rather than targeting one practice at a time.

	“Cybercriminals now are going after your IT companies because it's easier to knock one of them out and hit 100, 200, or 500 dental offices, all in one clean sweep,” says Demetrios Andritsogiannis, founder and CEO of Aspida, a technology solutions company that specializes in HIPAA compliance.

	Hackers get into the MSP system through security lapses, which include weak passwords and networks that are not using two-factor authentication.

 Another way is through vulnerabilities in the software that allows MSPs to remotely monitor and manage your computer updates and other IT services, especially when the MSP hasn’t updated the system with the latest security patches.

 One security expert described these remote management tools like the golden keys to distribute ransomware.

	“Your number one threat is your IT provider,” Andritsogiannis says. “They have access to everything. The question you have to ask yourself is, does that company have all the security measures in place to make sure that they don’t have a problem that will become your problem?”

	Dental practices need to understand what your MSP for the cloud-based system is doing to protect themselves from attack from a technological point of view. You should understand their policies and procedures, or what the MSP can and would do in the face of an attack.

	We spoke to experts in data security and compliance to get an idea of how dentists can do that. Here’s what they had to say.

	While HIPAA regulations are the same, details might differ

	The Health Insurance Portability and Accountability Act of 1996 (HIPAA) set the national standards for protecting ePHI. Dental practices are considered a “covered entity” under this law, which means compliance to the HIPAA rules is essential.

	“HIPAA is all about securing your patient data. You want to be able to identify who has viewed it, who has touched it, and the steps that were taken to safeguard that information as well,” says Laura Miller, compliance manager for Aspida. “It all comes down to being able to identify those items.”

The regulations are the same for a cloud-based system and a server-based system for data security, says David Broom, senior director of product management for TechCentral by Henry Schein One. That said, there are some specific cloud-based considerations the practice should acknowledge. For example, with a cloud-based system, he recommends ensuring that you have regular backups, that the cloud-based system you are using is backing up the correct data, and that the backups work.

	“Moreover, if you choose not to have a local backup and only back up on the cloud,” Broom says, “you need to understand how the restores work.”

	Mike Uretz, Executive Director of Dental Group Partners and founder and editorial director of dentalsoftwareadvisor.com, says that while groups and practices focus on the evaluation of potential software vendors they are interested in, they infrequently go the next step-evaluating the actual data center that will host the cloud application. That’s where the vulnerabilities will lie. Uretz says cloud-based dental software vendors don’t run their own data centers and contract this function out most of the time. Although they have a lot of control over the operating of their software within these data centers, the software vendors don’t do the bulk of data center management.

	The recent cyber-attacks in Wisconsin on the MSP PerCSoft affected 400 dental practices around the country, who lost access to their electronic files. However, it wasn’t PerCSoft that was hacked; it was their third-party vendor Digital Dental Record that handled the backups for PerCSoft clients.

“You want to make sure that the data center itself has various policies and procedures that dictate how they manage HIPAA compliancy including how they will handle a data breach if it occurs,” Uretz says.

	When it comes to protecting yourself, it’s important to ask the potential cloud-based system host if the data center they use has experience with medical and dental regulations and if they are HIPAA compliant, Uretz says. Also, you want to ensure that the data center is in the US because it isn’t, the data center might not be subject to the HIPAA regulations.

	“If your ePHI is in another county, there is not much you can do if it gets breached because they can’t go after the data center in Montreal or wherever,” Uretz says.

	Practices need to understand how the MSP is protecting themselves, Broom says. In other words, what measures do they have in place to ensure they don’t get hacked? From vetting employees and partners to policies and procedures in case there is an issue with the insurance they have, Broom says you should ask about all of it.

	“You must vet your third parties tightly on this,” Broom says.

	Practices should also discover how their MSP minimizes client risk for a data breach, Broom adds. The way the MSP manages the day-to-day tasks will affect the amount of vulnerability you have for a violation.

	For example, one of the ways Henry Schein One manages some of their client’s risk is segmenting their back-end management of client data. Henry Schein One separates the passwords from the backups, managing them for the client through separate portals in order to protect their clients, Broom says.

	“It also protects me,” Broom says. “If I have a rogue employee, I know for sure they can only damage a portion of the business. They can’t damage everything.”

	Multifactor authentication is essential for data security on the MSP side for either type of system and on both the client and MSP side of logging in. Multifactor authentication refers to an extra step of verification for who is logging in, e.g., a text message to a mobile number or entering a PIN code. In some cases, it is biometric, like a voice prompt or fingerprint.

	Broom suggests practices always work with MSPs that require multi-factor authentication for the MSP employees who work with their accounts.

	“If I were a practice interviewing an MSP, I would ask how their employees log in. It is a straightforward question,” Broom says. “If they say, ‘username and password,’ and they are not using multi-factor authentication, I would be looking for another partner.”

Another area to consider when researching an MSP is to have the company clarify their procedure to permanently delete data. It could be necessary if you ever leave the vendor or switch to a different system.

	“You want to make sure that if the time ever comes that they have to delete all your data, it’s gone,” Uretz says.

	Another critical area for consideration with your MSP is how they handle staff education pertaining to HIPAA laws. Asking an MSP how they handle staff HIPAA and security education and ongoing training is another essential part of the conversation, Uretz says.

	“Every day there is potential for a new problem. You want to make sure that your people are educated consistently. That’s the responsibility of the data center to make sure that people are educated constantly how to prevent problems and handle issues should they occur,” Uretz says.

	Whichever partner you land on, it’s important to ensure your agreement of what the MSP provides is in writing, Uretz adds. Otherwise, if there is a problem, you could end up with no help from the MSP.

	Five questions to ask about cloud-based system security

	When it comes to data protection for cloud-based systems, Andritsogiannis says there are five questions to ask yourself about your compliance:

		Do you have a Business Associate Agreement with whomever your cloud-system provider is? The HITECH Act of 2009 elevated the responsibilities of anyone who works with your ePHI as an MSP. In other words, 

 are subject to the same standards as the practice for ePHI, as stated by the 

. They need to commit to it in writing, or the practice is responsible for any issues. Per the HHS, 

 (BAA) is required for either a person or a company that is not employed by the practice directly, but works on their behalf or provides services to a dental practice. HIPAA requires that you have them with any vendor that handles IT for you to ensure that they will do everything they should to protect your patients’ ePHI.

		Are they storing the data encrypted, and do they have redundancy for it? Data Encryption, per Miller, is recommended to be AES (Advanced Encryption Standard) 256 to meet the standards set by the National Institute of Standards and Technology. 

 Andritsogiannis recommends that the redundancy is Redundant Array of Independent Disks (RAID) enabled, which means where the redundancy stores copies of the files on a series of disks. The idea is if one fails, then one of the other drives will kick in and provide uninterrupted service.

		Are you accessing that data in the cloud securely? Secure access to the cloud seems like a no-brainer, but according to Andritsogiannis, 99.9 percent of the time, that is not a given.

		Do you have multi-factor authentication when you are logging in to the system? Multifactor authentication is vital for cloud-based data security. 

, it adds an extra layer of protection, which means that hackers need more than your username and password to get into your ePHI.

		Can you ensure that you only allow access from the static IP? Static IP stands for static Internet Protocol and is a permanent number assigned to a computer by an Internet Service Provider. Limiting access to the static IP, rather than from outside the system, helps keep hackers from using remote access to get into the server.

	Using the cloud does not exclude local security

	Most practices do not realize that even with a cloud-based system handling much of the ePHI, there still might be other data stored on the practice’s hardware. For example, 3D images can be difficult and costly to upload and store in the cloud, which means you still need a server-based data security system at your location where they’re stored, Andritsogiannis says.

	“Most of the time, most people don't realize that they're deciding between cloud and local for their practice management solution, but not necessarily their whole business solution,” Andritsogiannis says. “There are a lot of moving parts, and you usually need a technology consultant that understands everything, not just the software, to help you make a wise decision on the total cost of ownership.”

	Sometimes, using a cloud-based practice management software program leads the practice to believe they don’t need to worry about security at the local network as much, Broom says. He says this assumption is a mistake.

	“The same challenges you have with usernames and passwords on the server-based system are the same challenges you are going to have with a cloud-based system as well. You need to have the same security measures in place,” Broom says.

	Broom says that he also often hears that practices think they do not need to worry about the firewall as much with a cloud-based system. However, this belief also isn’t true. Controlling how people come onto the network is crucial.

	“As an example, if you have wireless access points in your practice, which everybody does, you still want the side the patients use, the public side, to be separate from the business side,” Broom says.

	Uretz says you also want to ensure that along with having appropriate credentialing for logging into the system-the software should have a robust auditing system which records every change to the ePHI and who made the change. If there is a data breach, Uretz says that one of the first things the Office of Civil Rights (OCR) is going to want to know is if the practice and the data center had done everything possible in terms of security and HIPAA compliance to prevent the breach.

“In order to try to understand and recreate the issues, a detailed auditing system is immensely valuable,” Uretz says.

	How the OCR responds to a breach depends on a lot of factors. Typically, the OCR employs an action plan, tasking the practice with fixing the problems, Miller says. However, if they don’t fix the problem, there could be fines.

	“The fines could be in the millions upon millions of dollars, depending on the circumstances,” Andritsogiannis says.

	“Sometimes, the fines are minimal compared to the damage you get from it being out in the news,” Miller says. “Some offices say their reputation is so tarnished patients don't want to come there anymore, especially if they had a breach or something along those lines. They end up having to close the doors.”

	True compliance is the best data protection for the cloud-based system, Andritsogiannis says. Maintain your BAAs, participate in an annual risk assessment, fix the vulnerabilities you discover, and repeat the process will be your best defense.

	“Every year, a new risk will arise,” Andritsogiannis says. “So, every annual assessment will help you find those risks, and then, hopefully, you'll knock some off the list the following year. Then, you'll find new ones added to the list. It's a never-ending process.”

 Dudley, Renee. “The New Target That Enables Ransomware Hackers to Paralyze Dozens of Towns and Businesses at Once.”  Propublica.org. 12 September 2019. Web. 25 November 2019. 

https://www.propublica.org/article/the-new-target-that-enables-ransomware-hackers-to-paralyze-dozens-of-towns-and-businesses-at-once

 McGee, Marianne Kolbasuk. “Ransomware Attack Impacts Hundreds of Dental Practices: After Vendor Systems Crypto-Locked by Malware, Practices Await File Restoration. 30 August 2019. Web. 25 November 2019. < 

https://www.bankinfosecurity.com/attack-on-vendor-affects-hundreds-dental-practices-a-13002

 McGee, Marianne Kolbasuk. “Ransomware Attack Impacts Hundreds of Dental Practices:

			After Vendor Systems Crypto-Locked by Malware, Practices Await File Restoration. 30 August 2019. Web. 25 November 2019. < https://www.bankinfosecurity.com/attack-on-vendor-affects-hundreds-dental-practices-a-13002>.

 Lloyd, Craig. “Backups vs. Redundancy: What’s the Difference?” howtogeek.com. 30 March 2018. Web. 25 November 2019. < 

https://www.howtogeek.com/346907/backups-vs.-redundancy-what%E2%80%99s-the-difference/

 Kovacs, Nadia. “The importance of two-factor authentication.” Us.norton.com. Web. 25 November 2019. 

https://us.norton.com/internetsecurity-how-to-importance-two-factor-authentication.html

The Cloud-Based system you outsourced data security is more vulnerable than you might think. Here’s what you can do to protect your patients’ information and your practice’s longevity.

Data Protection for the Cloud-Based System: Protecting your patients and your practice

Protecting your patients’ data on your local server requires a lot of considerations. Our experts share their insight on what you can’t afford not to know.

	Dental practices have valuable information for treating patients and running their business stored on servers and computers in the practice. However, your practice’s patient information is a virtual gold mine for the bad guys-and hackers will get to it if they can. 

	For practices that have a local data-storage solution, there are numerous considerations for keeping it out of the bad guys’ hands. We spoke to several experts on data security about what they think is essential for dental practices to know about protecting their local data storage, and here’s what they had to say. 

Have an enterprise-level data-risk assessment

	Steve White, Vice President of Sales and Marketing for DDS Rescue, says the best place to start for security of the electronic protected health information (ePHI) is a proper data-risk assessment. This risk assessment needs to be more than a question or answer-type that you find in do-it-yourself assessments. White says the risk assessment should have an IT process associated with it to find the answers and you should have it on file in the practice.

	“It's the starting point to, ‘what is my IT network now and what should it be?’ ” White explains. “Not only for regulatory reasons of HIPAA, but also just best practices for preventing data breaches and downtime.”

	White says the risk assessment gets the team together and organized. It defines who is working on what to get the network as safe as possible. It also ensures that you actually do whatever is discovered in the risk assessment, something that White says doesn’t always happen. 

	White also says that your risk assessment is not a one-and-done exercise. Moreover, you are never “done” with risk or becoming HIPAA compliant. When you change hardware or software, or employees leave or come on board and need their logins terminated or added, or you add new vendors with new Business Associate Agreements, you should have another risk assessment. 

	“Compliance is not a certification. It’s an ongoing process,” White says. “You assess, correct, and continue. That’s why HIPAA says the risk assessment must be done at least once a year.”

	Many times, practices have patients’ ePHI spread out on devices all over their local network, which makes it more challenging to protect from hackers and maintain compliance per HIPAA regulations. Demetrios Andritsogiannis, Founder and CEO of Aspida, a compliance technology solutions company that specializes in Secure Solutions for HIPAA, says it is a best practice to centralize your ePHI on one server. He compares it to having all your children in a playpen. 

	“If you put all your children inside the playpen and they can't get out, they're all in the playpen at the end of the day,” Andritsogiannis says. “But if you take them out and let them run around, now you have to keep up with every one of them and make sure they're not all over the place.”

	White says that a common mistake risk assessments discover is that people have ePHI on a workstation, like a downloaded image or patient record, and forgot it was there. White says his team advises the practice to delete it from that workstation or properly protect that workstation as you would your server.

	“If it’s in your practice management software, you don’t need it there on that workstation,” White says. “Get rid of it.”

	Per HIPAA, any ePHI data must also be secure from a technical standpoint. White says that can be proper antivirus, anti-spyware and encryption.

	“If any protected health information, specifically ePHI, leaves your office voluntarily or involuntarily, it must be protected at the levels specified by the government. The most common way is encryption and at the right level,” White says. “If it leaves your office without encryption and it is lost or stolen with over 500 files, it is a major data breach.”

	While there are many different ways and levels you can use to encrypt data, Laura Miller, Compliance Manager for Aspida, says the National Institute of Standards and Technology (NIST) released the appropriate algorithms. It isn’t enough to have 64-bit encryption, or even 128. Miller says it does need to be a NIST-level of encryption.

	“They recommend AES 256 encryption as a minimum,” Miller explains. 

	David Broom, Senior Director of Product Management for TechCentral by Henry Schein One, also emphasizes the essential nature of encryption. He explains that encryption takes the data and uses an algorithmic calculation to convert it into nonsensical characters, meaningless to someone who doesn’t have the key. 

AES stands for Advance Encryption Standard

 and is the NIST’s standard block cipher algorithm.

 The higher the number of the encryption, the more difficult it is for someone to break the code. 

	“At 256, it would take somebody, depending on what kind of build you had, multiple years for them to be able to break that code,” Broom explains.

	Broom says in addition to proper encryption, every practice should have a hybrid back-up system, meaning a local copy and a copy somewhere else. In most cases, this means a local back-up and one on the cloud.

	“Typically, cloud, which is the best thing to do, would be encrypted and would have incrementals, so that practices can recover back-ups from prior days and prior times,” Broom says.

	Broom says the reason for the second off-site back-up is in case the local back-up is no longer available to you. Maybe you lose it to theft or a natural disaster. Then, you can’t restore your data. The incrementals, which are a type of back-up that only saves data that has been added or changed since the last back-up, ensure that you don’t lose a days’ worth of data.

	Pricing for back-up in the cloud is less than in the past. However, the amount you pay depends on how much data you have to back up and how many incrementals you have available at any given time. 

	“It gives you an extra level of protection,” Broom says. “It is very smart business-wise and recovery-wise to make sure you have a cloud and a local back-up.”

	It is essential to ensure that your back-up system takes all the files. Most systems will back up Microsoft Office files, and Excel spreadsheets, but they do not always back up the specific software used by an application, like your practice management software. With Henry Schein’s hybrid back-up, the system backs up everything. 

	“It’s just simpler, and it makes it easier for the client and because the pricing structure that the cost of the hardware appliances and the cloud back-up are less expensive, it’s just so much better,” Broom says. 

	Furthermore, Broom says there is more than practice management files that need back-up that other systems might miss. There are business filings, accounting files, and communication with the lab that are important to have also. 

	“That’s why we always recommend that everyone puts everything on one server, so everything backs up to the server,” Broom explains. 

	Broom also advises practices to have automatic backups. Look for a system you can “set and forget.” If you use a managed service provider, make sure they actually check the back-up and that it’s happening as it should. 

	“Make sure it occurs automatically,” Broom says, “so you don’t have to think about it.” 

	John Flucke, DDS, and Technology Editor for DPR, says it is imperative to update the operating systems of your software with all the security patches. It is essential to be “up to speed” on things like a firewall that will keep people out of your system. Dr. Flucke says it is crucial to make it as hard on hackers as possible so they will give up and find an easier target. 

	“It’s like parking your car in the parking lot. You know if somebody really wants a car, they are going to steal it. But if the guy parked next to you has the windows down and the keys in the ignition, which one are they doing to go for?” Dr. Flucke says. 

	Another area our team of experts says is critical to data protection for the server-based system is the physical location of the server. In other words, where do you keep the server? Andritsogiannis says that it should be locked up with access controls and a sign-in sheet for entering and leaving that physical location in the practice. 

	White says DDS Rescue got into the business of data security because thieves robbed one of his customers. The thieves threw a brick through a window, went to the basement, picked up the server, and were gone in less than 90 seconds. 

	White says the office had done nothing wrong; they simply got robbed. However, the physical server was not protected. White explains that part of the HIPAA-mandated risk assessment specifies that all devices that carry any electronic protected health information (ePHI) must be physically protected. That stipulation includes thumb drives, laptops, old computers, and, of course, the server. 