Dentrix HIPAA Compliance, Cloud Backup & Encryption Guide (2026)

Dentrix G7 vs. Dentrix Ascend — Who's Responsible for What

This distinction drives almost everything else in this guide. Dentrix G7 is server-based software installed on a computer in your office — your practice owns and is responsible for the server, its backups, its encryption, and its physical security. Henry Schein provides the software; they are not your Business Associate for the data sitting on your own server.

Dentrix Ascend is Henry Schein's cloud-hosted version — patient data lives on their infrastructure, not yours. Henry Schein acts as a Business Associate for Ascend and should provide a BAA covering their hosting responsibilities. But even on Ascend, any third-party tool you connect (imaging software, texting platforms, backup of local files) still needs its own BAA — Ascend's BAA does not extend to your other vendors.

Practices on G7 who assume 'the server is backed up somewhere, that's IT's job' without a signed BAA with that IT provider are carrying 100% of the compliance risk for that backup with no contractual protection if it goes wrong.

Encrypted Cloud Backup — What Dentrix Doesn't Do For You

If you're on server-based Dentrix G7, your patient database is not automatically backed up to an encrypted, HIPAA-compliant cloud location. That backup — whether it's a local backup drive, a cloud backup service, or a managed IT provider's solution — is a separate system your practice chose and is responsible for.

• Encryption at rest and in transit: Your backup solution must encrypt the Dentrix database both while stored and while being transmitted offsite. An unencrypted backup drive, even if physically locked in a closet, doesn't meet the Security Rule's technical safeguard requirements for ePHI leaving your primary system.
• BAA with the backup vendor: Whether it's a dedicated dental IT backup service, a generic cloud backup product, or your managed IT provider running backups — if they touch your Dentrix database, they're a Business Associate and need a signed BAA. Generic consumer cloud storage (personal Dropbox, Google Drive without a Workspace BAA) does not qualify.
• Backup testing and restoration logs: OCR audits increasingly ask not just whether backups exist, but whether they've been tested. A backup you've never successfully restored from is a documentation gap even if the underlying data is intact.
• Dentrix Ascend practices: Backup responsibility shifts to Henry Schein under the Ascend BAA — confirm your Ascend agreement explicitly covers backup frequency and recovery, and get it in writing rather than assuming.

Secure Transmission of X-Rays and Imaging Data

Digital X-rays, intraoral scans, and CBCT images captured through imaging software connected to Dentrix routinely leave your practice — sent to specialists for referrals, to labs for aligners or crowns, or to insurance for claims. Every one of those transfers is a potential PHI disclosure that needs to happen through a secure, BAA-covered channel.

• Imaging software integration: Dexis, Schick, and other imaging systems that plug into Dentrix are themselves Business Associates if they store or transmit patient-linked images. Confirm a signed BAA exists — the imaging hardware purchase agreement is not a BAA.
• Sending images to specialists or labs: Email is not a secure transmission method for X-rays with patient identifiers unless it's encrypted email with a BAA in place. Use the imaging software's built-in secure referral/export feature, or a dedicated secure file-transfer tool with a BAA — not a personal email attachment.
• Cloud-based imaging storage: If your imaging software stores images in its own cloud rather than locally, that vendor is a Business Associate for the imaging data specifically, separate from your Dentrix BAA situation.

Compatible Solutions for Dentrix Practices

Two categories of tool cover what Dentrix itself doesn't: compliance documentation and audit-readiness, and secure patient-facing communication.