Dental IT, HIPAA, and cybersecurity for independent practices. Handled.
Arch Dental Secure gives 1–3 office dental practices around Lakeland, Tampa Bay, and the Orlando area a 24/7 help desk, CrowdStrike protection on every computer, and a fractional CTO who already speaks dental. We sign a BAA on day one, US-based engineers handle escalations, and the pricing is on this page.
Book a free 15-minute Dental Cyber Checkup
- Signed BAA with every practice
- US-based escalation and a named fractional CTO
- A team with deep dental IT and DSO experience
Small dental offices are now a regular target. The paperwork caught up too.
If you run an independent practice, you've probably handled IT the way most offices do: a local IT person or a patient's nephew, antivirus on the front-desk PCs, and a backup that you're pretty sure runs. That setup used to be enough. It isn't now, for three reasons.
Practices like yours are on the breach list.
Independent dental offices keep showing up on the HHS Office for Civil Rights breach portal. In 2025–26 that includes Pecan Tree Dental in Texas (about 13,300 patients, claimed by the Sinobi ransomware gang) and Hawaii Family Dental (45,853 patients, claimed by Qilin). These weren't hospital systems.
Your cyber insurer is asking harder questions.
Renewal applications now ask about MFA, 24/7 monitored EDR, immutable and tested backups, an incident response plan, an annual risk assessment, and BAAs. If you check "yes" on something that isn't really in place, the insurer can deny a claim when you need it most.
HIPAA already requires a risk analysis.
The HIPAA Security Rule requires a documented security risk analysis today. It isn't a future rule or a nice-to-have. If you can't find yours from the last year, you're not alone, but it needs to get done.
None of this needs a big IT department. It needs the right basics done well, written down, and checked regularly. That's what Arch Dental Secure does.
Everything a small practice needs, in three parts
You don't need to piece this together from four vendors. One team, one BAA, one monthly bill.
Your people are supported and protected
Help desk and Microsoft 365, per user
- 24/7 help desk by phone, email, or portal
- Microsoft 365 administration: accounts, MFA, licenses, shared mailboxes, new hires and departures
- Email security to filter phishing, spoofing, and malicious attachments
- Security awareness training and phishing practice for your team
Every computer is locked down and watched
Endpoint security, per computer
- CrowdStrike EDR with 24/7 monitoring, which watches for attacker behavior and stops it
- Windows and third-party patching
- Remote monitoring and management so problems get fixed before they turn into calls
- Front-desk, operatory, and imaging PCs plus the doctor's laptop
Your office network and your HIPAA program
Network per office, plus a fractional CTO
- Firewall, switch, and Wi-Fi management (up to 4 network devices per office)
- Guest Wi-Fi kept separate from clinical systems
- A fractional CTO for your annual HIPAA risk assessment, policies, BAA and vendor tracking, and cyber-insurance questionnaires
- One point of contact for your imaging and practice-management vendors
How support actually works, in plain words
Someone answers, any hour.
When a printer stops, a password locks, or your practice software won't open at 7:15 a.m., you call or email our help desk. It's staffed 24x7 by our offshore team, so someone always picks up, including before your first patient and after your last.
Harder problems go to US engineers.
Anything complex, sensitive, or urgent, like a security alert, a server problem, or an imaging system down, escalates to our US-based engineers. CrowdStrike alerts are monitored around the clock.
A fractional CTO who knows your practice.
You get a named fractional CTO from our in-house team, matched to your practice-management software (Dentrix, Eaglesoft, Open Dental, Denticon, and others) and your office's needs. Every quarter we review what's working, what's at risk, and what's coming up.
The plain answer about offshore support and HIPAA
We use an offshore help desk because it lets us answer 24x7 at a price small practices can afford. Here's how we protect your patient data while doing it:
- Arch signs a Business Associate Agreement (BAA) with every practice. Our support partner is bound by a signed subcontractor BAA with Arch.
- Access only as needed. Help desk staff get the access a task requires and no more, through our managed support tools.
- US escalation. Complex problems and security issues escalate to our US-based team.
- Ask us anything. Your quarterly review is the place to ask who supports you and how your data is protected.
HIPAA doesn't ban offshore support. It requires the right agreements and safeguards, and we put both in writing.
Simple, public pricing
Most IT companies won't show prices until a sales call. Here are ours. Your total depends on three numbers you already know: how many people, how many computers, how many offices.
Help desk & Microsoft 365
- 24/7 help desk
- Microsoft 365 administration
- Email security
- Security awareness training
Endpoint security
- CrowdStrike EDR, 24/7 monitored
- Patching
- Remote monitoring
Office network
- Firewall management
- Switch & Wi-Fi management
- Up to 4 network devices
Fractional CTO
$999 / month, 2–3 offices
- Annual HIPAA risk assessment
- Policies, BAA & vendor tracking
- Cyber-insurance questionnaire help
- Quarterly review
- Vendor point of contact
No long-term contract. It's a 30-day rolling agreement, and you can cancel anytime with 30 days' notice, no reason needed. There's no onboarding fee either.
What a typical office pays
A single-office practice with 8 team members and 10 computers. Change the numbers to see yours:
| Help desk & Microsoft 365 | ||
| Endpoint security (CrowdStrike) | ||
| Office network | ||
| Fractional CTO | ||
| Total |
Plus Microsoft 365 licenses at cost, and a separate quote for any server. For a lot of practices, this costs about the same as a part-time IT person, with 24/7 coverage, security monitoring, and your HIPAA paperwork included.
A fractional CTO: the IT leader a small practice never had
A large group practice has an IT director who handles the risk assessment, reads the insurance application before anyone signs it, and calls the imaging vendor when an update breaks something. An independent practice usually has nobody in that role, so the office manager ends up doing it on top of everything else.
Your fractional CTO fills that role. They're assigned from Arch's in-house team and matched to your practice-management software and your office's needs. It's a flat monthly fee: $499/month for one office, $999/month for 2–3 offices.
- Annual HIPAA security risk assessment, done properly and documented.
- Written policies and an incident response plan that match how your office runs.
- BAA and vendor tracking for every vendor that touches patient data.
- Cyber-insurance questionnaire help so every answer is accurate.
- Quarterly review of risks, projects, budget, and what's coming up.
- Vendor point of contact for imaging, practice-management, phone, and other tech vendors.
Arch Dental Secure is led by founder Andrew Rowlands and a team with deep dental IT and DSO experience.
Try the Dental Cyber Checkup scorecard
15 yes/no questions. "Not sure" counts as a no, and that's fine. Most offices have several. Questions marked ★ are critical. Nothing you click here is sent anywhere.
Book your free 15-minute Dental Cyber Checkup
Fill in the short form and our team will email you within one business day to schedule. In 15 minutes on the phone or Teams, we'll go through the scorecard covering what matters for HIPAA and cyber insurance. Before the call, we'll also look at what your practice exposes to the public internet. You get a one-page red/yellow/green results sheet afterward, and you keep it whether or not you work with us.
- A 15-question security and HIPAA scorecard, in plain English
- Your email authentication (SPF, DKIM, DMARC)
- Exposed remote access open to the internet
- Breach exposure for your practice's email addresses
- Your top 3 fixes, in priority order
No hard sell. If you're in good shape, we'll tell you.
Questions dental practices ask us
You use an offshore help desk. Is that HIPAA compliant?
Yes, when it's done right. HIPAA doesn't prohibit offshore support. It requires Business Associate Agreements and reasonable safeguards. Arch signs a BAA with every practice, Help desk staff get only the access a task needs, and complex problems and security issues escalate to our US-based team. If a payer contract or other agreement limits offshore access for your practice, let us know on the checkup and we'll go over how to handle it.
Will you sign a BAA?
Yes. Arch signs a BAA with every practice before we access any of your systems, and our support partner is bound by a signed subcontractor BAA with Arch. It's part of onboarding, not something you have to ask for. As part of the fractional CTO service, we'll also help you track BAAs with your other vendors.
We already have an IT person or company. How does switching work?
We handle the transition: collecting passwords and documentation, replacing old antivirus with CrowdStrike, taking over Microsoft 365 and the network, and making sure nothing breaks. If your current IT person is staying on in some role, we're happy to work alongside them.
Do you support Dentrix, Eaglesoft, Open Dental, and our imaging software?
We support the computers, network, servers, and Microsoft 365 those systems run on, and we're your point of contact with the software vendors: we open the ticket, give them remote access when needed, and follow up until it's fixed. The vendors still own their software, but you won't be stuck in the middle anymore.
What are the contract terms and how does onboarding work?
No long-term contract. Arch Dental Secure runs on a simple 30-day rolling agreement. If it's ever not the right fit, you can cancel anytime with 30 days' notice, no reason needed and no hard feelings. We'd rather earn your trust every month than lock you in.
There's no onboarding fee. Occasionally an office needs significant cleanup before we can support it properly, such as computers past end of life or a network that has to be rebuilt. If so, we'll scope it with you and quote it up front before any work starts, so there are no surprises.
Onboarding usually takes 2–4 weeks, planned around your patient schedule.
Do you come on-site?
We serve practices within about 50 miles of Lakeland, which covers Polk County, Tampa Bay, and the Orlando edge. Most issues are fixed remotely. On-site support is decided clinic by clinic, based on your location and what your office needs, and we'll go over it with you before you sign up.
Can you help with our cyber insurance application?
Yes. Insurers now ask about MFA, 24/7 monitored EDR, immutable and tested backups, an incident response plan, an annual risk assessment, and BAAs. Arch Dental Secure covers most of those, and we'll go through the application with you so every answer is accurate. We don't sell insurance.
Is the HIPAA risk assessment really required?
Yes. The HIPAA Security Rule already requires covered entities, including dental practices, to do a security risk analysis and act on what it finds. Your fractional CTO handles it every year and keeps the documentation.
What about our server and backups?
Servers are quoted separately because every practice is different. We'll look at yours on the checkup. Insurers increasingly expect immutable, tested backups, and we'll tell you plainly whether yours qualify.
We're small, just one office and a few computers. Is this overkill?
No. Pricing is per user, per computer, and per office, so a small practice pays a small-practice price. Small offices are exactly who this was built for.
Find out where your practice stands in 15 minutes
Bring your rough computer count and your insurance renewal month. We'll do the rest. You'll leave with a one-page scorecard, a look at your public exposure, and your top three fixes, whether or not we ever work together.
Book my free Dental Cyber Checkup
Serving independent dental practices within 50 miles of Lakeland, FL: Polk County, Tampa Bay, and the Orlando area.
Questions before then? Call (860) 590-9105 · andrew.r@archservicing.com