9 Signs A Company is Ready for Dental Billing Cybersecurity Incident
A billing vendor breach can expose patient data, stall claims, freeze payment posting, and leave your practice as the HIPAA covered entity holding the compliance bag. The September 2026 DireWolf listing of eAssist remains an unverified claim, but it raises security concerns. To counter that, there are nine signs that separate a prepared billing partner from an unprepared one: documented proof like SOC 2 Type II or penetration tests, a BAA with notification windows shorter than 60 days, MFA and tightly scoped access, encryption with defined retention, tested immutable backups, a rehearsed incident response plan, clear breach communication protocols, oversight of subcontractors and staff, and security treated as routine rather than a one-time project. Practices should audit vendor accounts, read their BAA, enable MFA, and prepare a response plan. TransDontics meets these standards.
Most practice owners never think about an outsourcing company’s dental billing cybersecurity measures. You hand over claims, fee schedules, insurance logins, and patient balances, and you expect the money to show up. It’s a reasonable arrangement right up until the vendor gets hit.
Your billing partner holds a lot of what a criminal wants: names, birth dates, addresses, insurance IDs, treatment histories, and sometimes Social Security numbers or payment details. Outsourcing the work doesn’t outsource the responsibility. Under HIPAA, your practice is the covered entity and the billing company is a business associate. If their systems fail, patients still look to you, and regulators do too.
This isn’t a hypothetical anymore. A recent incident involving a well-known dental billing vendor has a lot of practices asking questions they should have asked a long time ago. Here’s what’s known, and then nine signs that tell you whether your own billing company would hold up. This isn’t for your claim submission but the overall protection of your dental revenue cycle. These 9 signs are the ultimate guide to choose the best dental billing and coding solutions provider that protects your patient information and data.
How Does eAssist Incident Make Dental Billing Cybersecurity Important in 2026?
Here’s the short version, and it’s worth being careful about what is and isn’t confirmed.
On September 6, 2026, a ransomware group called DireWolf listed eAssist Dental Solutions as a victim on its dark web leak site. eAssist is a Utah-based company that provides outsourced dental billing, insurance claims processing, patient billing, insurance verification, credentialing, and revenue cycle management services for dental practices across the United States. It is majority-owned by Henry Schein.
A listing on a leak site is a claim made by the attackers. Several trackers point out that it isn’t a verified breach report and should be treated that way. What the company itself has said is narrower. On September 8, eAssist told customers it was investigating a potential information security incident and had brought in outside experts. It also advised customers to change system passwords and remove old or inactive user accounts. As of mid-September reporting, the company hadn’t confirmed that any customer or patient information was accessed.
So the honest position is this: an investigation is underway, the attackers’ claims are unverified, and no one outside the company can say yet what, if anything, was taken. Things may have moved since this was written, so check for updates before you rely on any of it.
Whatever the final answer turns out to be, the episode is a useful reminder. The advice eAssist gave its patients- change passwords and clean up dormant accounts- is basic housekeeping. It’s also exactly what a well-run practice should already be doing. The 9 signs below are meant to help you find out whether your own vendor and your own office are ready for a day like this.
Secure Your Dental Revenue With TransDontics Billing Services. Don’t Let a Generic Vendor Compromise Your Data.
9 Signs: Your Billing Company is Prepared for Cybersecurity
Sign 1: They can Show Proof, Not Just Promises
Anyone can write “we take security seriously” on a website. Ask for evidence instead.
A vendor that’s serious will usually have some mix of the following: a recent SOC 2 Type II report, a HITRUST certification, results from an independent penetration test, and a written HIPAA security risk analysis that’s been updated in the last year. They won’t all apply to every company, and a smaller billing shop may not have the full set. But they should have something outside their own walls vouching for them.
Pay attention to how they react when you ask. A confident vendor sends a summary or offers a call with their security lead. A vendor that gets vague, changes the subject, or says “that’s confidential” for everything is telling you something too.
Ask when the last test happened, what it found, and how quickly problems were fixed. A clean report is nice. A report that shows problems were found and closed quickly is better, because it proves the process works.
Sign 2: The Business Associate Agreement has Real Teeth
Every dental billing company that touches patient information needs a signed business associate agreement with your practice. Most do. The difference is in the details.
Read yours. Does it spell out how fast the vendor must tell you about a security incident? Under HIPAA, a business associate has to notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach. Sixty days is the outer limit, not a good target. A stronger agreement sets a much shorter window for the first alert, often a matter of days, and requires the vendor to keep sharing details as they learn them. Look for these points too:
- Who pays for notification, credit monitoring, and forensic work if the vendor is at fault
- Whether the vendor carries cyber liability insurance, and at what level
- What happens to your data when the contract ends, and how deletion gets confirmed
- Whether you can request security documentation or audit their practices
If your agreement is a one-page template you signed years ago and never reopened, it’s worth another look.
Sign 3: Access is Tightly Controlled
A lot of real-world breaches start small. A password gets reused, an old account never gets shut off, or someone clicks a bad link, and the attacker walks in on a valid login.
Ask your billing company about a few basics. Do they require multi-factor authentication on email, the billing platform, and any remote access? Do staff only see the accounts they actually need for their job? When someone leaves the company, how fast does their access disappear, and who checks?
That last one matters more than it sounds. The advice eAssist gave practices to remove old or inactive user accounts points to one of the most common weak spots in any organization. Dormant accounts are easy to overlook, and attackers love them because nobody’s watching.
Turn the question around on your own office as well. The billing company may log into your practice management software, and your team may log into theirs. Every one of those connections is a door. Make sure someone on your side owns the list of who has a key.
Sign 4: Data is Encrypted and not Kept Forever
Ask whether patient data is encrypted when it sits on a server and while it moves between systems. Encryption doesn’t make a breach impossible, but it can turn stolen files into unreadable noise, and under HIPAA’s breach rules, properly encrypted data can change whether an incident counts as reportable.
Then ask a question most practices skip: how long do they keep it? Old claim files, scanned EOBs, and closed accounts pile up. Data a billing company no longer needs is data an attacker can still steal. A sensible vendor has a retention schedule, follows it, and can tell you what gets deleted and when.
The same principle applies to what you send them. If your team emails full patient records when a claim number would do, that’s a habit worth breaking. Less data in transit means less to lose.
Sign 5: Backups can Survive a Ransomware Attack
Ransomware works by locking up systems and demanding payment. The best defense against the lock-up part is a backup the attackers can’t touch.
Ask how the vendor backs up client data. You want to hear about copies stored separately from the main network, some kind of offline or immutable storage, and, above all, that they’ve tested restoring from those backups. A backup nobody has ever restored is a hope, not a plan.
Then ask the follow-up that reveals a lot: how long would it take to get your billing running again if their main systems went down tomorrow? A prepared company has a number, or at least a range, and a plan for what happens to your claims in the meantime. An unprepared one starts guessing.
While you’re at it, think about your own cash flow. If your billing partner were offline for two weeks, could you cover payroll and supplies? Knowing that answer beforehand is part of being ready.
Sign 6: There's a Written Incident Response Plan that People have Practiced
A plan that lives in a binder does nothing at 2 a.m. when something looks wrong. Look for a vendor that has a written incident response plan, named roles, and a habit of rehearsing it; in short, dental billing company cybersecurity protection.
Rehearsals are often called tabletop exercises. The team sits down, walks through a made-up attack, and finds out where the plan falls apart. Who decides to shut a system down? Who talks to outside counsel? Who calls customers? A company that runs these a couple of times a year will handle a real event far better than one that has never tried.
Good signs also include relationships already in place with outside forensic experts and legal counsel, so nobody’s shopping for help in the middle of a crisis. It’s telling that eAssist said it had engaged outside experts. That’s the right instinct, and the practices that get through incidents best are the ones whose vendors line up to help early.
Sign 7: They have a clear plan for telling you
When something goes wrong, the first question from a practice owner is usually simple: what do I tell my patients, and when?
Ask your billing company how you’d hear about an incident. Who would call you? Would it be a phone call, an email, or a portal message? Is there a 24-hour contact? Would you get regular updates, or one message and silence?
Your own obligations kick in fast once you learn about a breach. As the covered entity, you generally need to notify affected individuals within 60 days of discovery, and for breaches affecting 500 or more people, the notice goes to HHS and often to the media too. You can’t do any of that if your vendor sits on the news.
It also helps to agree ahead of time on who speaks for whom. Patients get confused and angry when they hear about a problem from three different places. A clear communication plan, agreed in advance, keeps the message consistent and the trust intact.
Sign 8: They Keep Tabs on Their Own Vendors and Staff
Your billing company has vendors too: cloud hosting, software platforms, clearinghouses, email providers, sometimes overseas support teams. Each one is another place where your patients’ data could end up.
Ask who else touches the data. Does the billing company use subcontractors? Do any of them work outside the United States? Are those parties bound by the same security and privacy commitments, and does the billing company check on them?
Staff matters as well. Background checks, confidentiality agreements, and role-based training are basic for anyone handling protected health information. If the vendor uses remote workers, ask how those laptops and home networks are secured. Company-managed devices with encryption and remote wipe are a good sign. Personal computers with no controls are not.
The larger the vendor, the more layers you’ll find. That isn’t automatically bad, but it does mean the question “who has my data?” needs a real answer.
Sign 9: Security is a Routine, not a Project
The last sign is about culture. Security that only happens after a scare fades fast.
Look for signs of steady habits. Staff get security awareness training at hire and again every year, ideally with simulated phishing emails so people practice spotting the real thing. Systems are monitored around the clock, or at least by a service that watches for unusual activity. Software patches get applied on a schedule, not whenever someone remembers. Logs are kept so that if something does happen, investigators can figure out what happened.
Ask how they learn about new threats and how they respond when a vulnerability is announced in software they use. A team that can answer in specifics, with names and timelines, is paying attention.
You can also watch how they behave day to day. Do they warn you about phishing attempts aimed at dental offices? Do they tell you when they change how they handle logins? A vendor that treats you as a partner in security is a vendor that’s thinking about it regularly.
What you can do this week
You don’t need to wait for a vendor incident to act. A few steps take an afternoon and pay off quickly:
- Pull your business associate agreement and read the breach notification section. Note the timeline.
- Send your billing company a short security questionnaire covering the nine areas above. Keep it plain and ask for documents where you can.
- Audit your own accounts. List everyone with access to your practice management system and billing portals, and remove anyone who has left or no longer needs it.
- Change shared passwords and turn on multi-factor authentication anywhere it’s available.
- Write down your own response plan. Who calls the vendor, your attorney, your insurance carrier, and your patients?
- Check your cyber insurance. Know what it covers and whether it expects specific security controls.
None of that is glamorous, but all of it helps.
If Your Vendor does have an Incident
Stay calm and stay organized. Ask the vendor for written details on what happened, what data was involved, and what they’re doing about it. Document every conversation. Change passwords and revoke any access the vendor holds to your systems. Loop in your attorney early, since notification rules depend on the facts and on your state. Watch for scam emails and texts that pretend to come from the vendor, since criminals often follow a public incident with fake “security alerts.”
And don’t assume the worst before the facts are in. A listing on a leak site isn’t proof of stolen data, and a company investigating an incident hasn’t necessarily been breached. What you can control is how ready you are to respond either way.
eAssist Incident: Critical Cash Flow & Compliance Risks
A vendor’s bad week has a way of becoming your bad month. Even without a confirmed breach, an incident like the one reported at eAssist touches two things practice owners care about most: whether the money keeps moving and whether their compliance obligations are covered.
Start with cash flow. If a billing partner’s systems go down or get locked, claims stop moving in both directions. Submissions get delayed, payment posting slows, and insurance follow-up stalls. None of that shows up on day one. It shows up three or four weeks later, when a practice manager notices accounts receivable creeping up and can’t quite explain why. A short outage at a billing vendor rarely wipes out revenue outright, but it can quietly stretch out the time it takes to get paid, and that gap has to be covered by cash reserves or a credit line in the meantime.
Then there’s compliance, which is a separate question from whether the claim went through. Your practice is the HIPAA covered entity no matter who handles the billing. If a business associate has an incident that involves patient information, the notification clock is yours to manage, not just theirs. That’s why the business associate agreement matters so much here: it sets how fast the vendor has to tell you something happened, and a vague or slow notice from a vendor turns into a vague or slow notice from your practice to your patients. These are also important considerations when switching to a company such as TransDontics as a dental billing partner.
None of this means every practice using an outsourced billing company should panic over one leak-site listing. It means the eAssist situation is a decent stress test for questions worth asking regardless of outcome.
- Has your vendor told you how they’d notify you if something similar happened on their end?
- Does your agreement give you enough time to meet your own notification deadlines?
- Could your practice absorb a few weeks of slower collections without real strain?
Those two threads, cash flow and compliance, are really one question in disguise: how exposed is your practice to a problem that starts somewhere you don’t control? The nine-point checklist above is the practical way to find out before an incident forces the answer on you.
The Bottom Line
Every billing company is one bad click away from a hard week. What separates the ones you can trust is preparation: proof of testing, contracts with clear obligations, tight access, encrypted and limited data, backups that work, a rehearsed plan, honest communication, watched vendors, and habits that don’t fade.
Run through the nine signs with your own billing partner. If they clear most of them, good. If they stumble on several, it’s better to find out now, over a calm conversation, than in the middle of an incident. And if you’re shopping for a dental billing partner, put these questions on the list before you sign anything.
To Maximize Revenue, Your Dental Billing Partner Must Be HIPAA Compliant. Shift to TransDontics Billing Services.
