Cyber Insurance for Dental Practices

Why Dental Practices Need Cyber Insurance

Dental practices may be smaller businesses, but they hold data that is extremely sensitive under New Zealand law. Patient dental records — including health histories, radiographs, treatment records, prescription documentation, and patient photos — are classified as health information and subject to both the Privacy Act 2020 and the Health Information Privacy Code (HIPC). The Health Information Privacy Code imposes obligations that go beyond the standard Privacy Act framework, including specific rules about who can access patient information and how it must be protected.

Health Information: A High-Risk Data Category

Under the Privacy Act 2020, health information is explicitly recognised as a sensitive data category. A breach of patient dental records is far more likely to meet the serious harm threshold for mandatory notification than a breach of general business contact information. This means dental practices — unlike many small businesses — face a high practical probability of mandatory notification obligations if patient records are compromised. The costs of notification, OPC investigation response, and patient communication can be significant for a practice without dedicated compliance resources.

Practice Management Software: The Critical Vulnerability

Most NZ dental practices rely on a small number of specialised practice management software platforms for patient records, appointment booking, treatment charting, and billing. These platforms hold comprehensive patient data and are connected to both clinical records and payment systems. Ransomware that targets dental practice management systems can simultaneously lock patient records (preventing treatment) and billing systems (preventing revenue collection). Recovery from such an attack typically takes one to two weeks — during which appointments may need to be cancelled and manual backup records used.

Payment Card Data and Health Insurance

Dental practices process significant payment card transactions and interact with Southern Cross and other health insurance funds for claims processing. Compromise of payment terminals or practice management system billing modules can expose patient payment card data. Health insurance credential theft — where criminals use compromised patient information to make fraudulent health insurance claims — is also a growing concern in the health sector.

Ransomware and Patient Care Impact

When ransomware encrypts a dental practice's systems, the impact extends beyond data and financial loss to direct patient care impact. Without access to patient health records, treating dentists cannot safely proceed with complex treatments where knowledge of allergies, medications, and prior treatment history is essential. This creates both clinical risk management obligations and potential professional liability exposure if treatment complications arise in the absence of available records.

Building Patient Trust After a Breach

Patient trust is the foundation of any healthcare practice. A cyber incident that exposes patient health information — or forces a practice to contact patients to notify them of a breach — can cause lasting reputational damage. Cyber insurance includes crisis communications support to help manage patient communication professionally and minimise the reputational impact of an incident.