Where PHI Hides in a Small Practice: 14 Places Nobody Thinks to Check

The intraoral camera has a hard drive

The office manager of a six-operatory dental practice in Abu Dhabi is preparing the practice's information security risk assessment and begins with the sentence she has said for years: "All our patient data is in the practice-management system." Then she walks the building with a clipboard.

Operatory three has the intraoral camera laptop. It stores every image it has ever taken, with patient names, on a local drive that has never been backed up or encrypted. The recall texting tool holds names, mobile numbers and the reason for the next visit. The fax-to-email inbox has eleven years of referral letters and insurance pre-authorizations, searchable by anyone with the password, which is written on a sticky note under the keyboard.

The front-desk WhatsApp group is where the hygienists share photos of a patient's swelling so the dentist can decide whether to come in early. The old panoramic X-ray unit runs on a computer that stopped receiving updates in 2020. The billing clerk's desktop holds a spreadsheet named "outstanding balances" with dates of birth in column C.

By lunch there are fourteen places on the clipboard. The practice-management system is one of them. A risk analysis that looked only at that one system would have missed thirteen doors. The auditor would not. Neither would the attacker.

What this means in plain words

PHI, protected health information, is the shorthand for any information that identifies a patient and relates to their health, their care or the payment for it. That covers the obvious chart and the less obvious: an appointment reminder, a photo of a molar with a name attached, an invoice with a procedure code.

Most of it now lives in electronic form, and the electronic copies are what a security standard like ADHICS v2, with 692 controls across 11 domains, is written to protect.

A data inventory, sometimes called data mapping, is the list of every place PHI is created, stored, sent or received. It is the first step of a risk analysis. It is also the step most practices skip, because they assume they already know the answer.

An identifier is anything that ties a record to a person: a name, a date of birth, an Emirates ID number, a photograph. Leave one on the record and it is still patient data.

In Abu Dhabi this information falls under ADHICS v2 from the Department of Health, and in Dubai under the Dubai Health Authority's NABIDH policies, which require a complete audit trail on every patient record. Whichever regulator you answer to, the inventory starts with the same clipboard.

The numbers that matter

In the United States, the HHS Office for Civil Rights (OCR) announced its 11th and 12th Risk Analysis Initiative settlements in February 2026, and it names the failure to conduct an accurate and thorough risk analysis as the root finding in nearly every recent Security Rule action (HHS OCR, 2026). You cannot analyze the risk to data you have not found.

There were 21 OCR settlements in the US in 2025 (HIPAA Journal, 2026). Most were with providers the size of the practice in this story, not health systems with a legal department.

The median US healthcare breach in the first half of 2026 affected 2,451 individuals (HIPAA Journal, H1 2026). That is a dental practice's active patient list. It is no longer the hospital that gets breached; it is you.

In Abu Dhabi, ADHICS v2 requires the Department of Health to be told of a breach within 24 hours. A practice that has not found its fourteen places cannot say in that time which records were exposed.

What to do this week

1. Walk the building with a clipboard, every room, and write down each device that has ever displayed or stored a patient's information: the camera laptop, the X-ray computer, the tablet at check-in, the manager's home laptop. (CIS 1 Inventory and Control of Enterprise Assets)
2. List every application and service the same way: practice-management system, recall texting, fax-to-email, cloud imaging, the messaging app the hygienists use, the payment terminal software. Note who at the practice can log in to each. (CIS 2 Inventory and Control of Software Assets)
3. For each of the fourteen, decide whether PHI needs to be there at all. Move the intraoral images to the managed server and wipe the local drive. Delete the balances spreadsheet and run the report from the system when it is needed. (CIS 3 Data Protection)
4. Close the WhatsApp group by Friday and replace it with the secure messaging built into your practice-management system, or a healthcare messaging tool whose contract covers patient data. Tell the team why, in one sentence: those photos are patient records. (CIS 3 Data Protection)
5. Encrypt every device that stays on the list, starting with the laptops that leave the building. Turn on the built-in disk encryption and record the recovery keys somewhere other than the device. (CIS 3 Data Protection)
6. Date the clipboard list and file it as the data-inventory page of your risk analysis. Repeat the walk when you buy a device, add a vendor or open a room. (CIS 1 Inventory and Control of Enterprise Assets)

Where AccuSights fits

Our assessment begins with the walk, not the software. We find where patient data actually sits, then check whether each place is encrypted, logged and covered by an agreement, and give you a prioritized list a practice manager can act on. The Cyber Hygiene Test takes three minutes. A 30-minute call with your Risk Assessor turns the clipboard into a plan that fits the way a clinic runs.

We map the assessment to DoH ADHICS and DHA NABIDH, and our read-only compliance agent shows where patient data sits and which controls have drifted, so you prioritize the right things and keep an eye on them. We have no access and do not remediate; you or your IT partner fix, and we show you where.

A surgeon counts the instruments before closing. Count the places your patients' records live, and the risk analysis writes itself.