Two clocks, one BAA,and no certificate anyone can sell you.
HIPAA applies to your practice as a covered entity and to CyberDental as a business associate. What follows is how this house states the facts. It is not legal advice — have your counsel read the agreements.
Notice of Privacy Practices — February 16, 2026
A real deadline that has passed. Practices were expected to update NPP language, including the Part 2 substance-use-disorder provisions per ADA guidance. If your NPP still predates it, that is a document task, not an IT project.
The Security Rule NPRM
OCR's December 2024 / January 2025 proposal would make many "addressable" specifications mandatory. It is not in effect. Closing those gaps now is still the rational move — but nobody should sell it to you as law.
The BAA
Signed with CyberDental Group LLC — the Wyoming entity, Florida operations at 480 W 84th St, Suite B106, Hialeah, FL 33014. Social profiles may still read CyberDental Corp; the agreement should read the LLC. Have counsel review both the BAA and the service agreement.
Risk analysis vs risk management
One document finds the holes. The other is what you actually did about them. OCR expects both. A vendor score is neither, and no MSP questionnaire substitutes for the analysis.
Two breach clocks
HIPAA has one. Florida's Information Protection Act has another. A Hialeah practice can be on both at the same time. Map them with counsel before an incident — not during one.
"HIPAA-certified" is not a thing
HHS OCR does not certify MSPs or dental offices. What a serious MSP can show you is a BAA, its Security Rule duties as a business associate, and evidence — logs, restore tests, patch records. Not a seal for the front desk wall.
A flashlight, not a diploma.
A structured look at the obvious holes: backups that actually contain images, a current NPP, BAAs with everyone who can touch ePHI, MFA on remote access, a firewall that is more than a brown box in the closet. Run it as the practice — office manager, DSO IT, or compliance. Not a patient, not a front-desk temp on lunch.
This page states dates and duties as this house understands them on 23 August 2026. It is not legal advice, not an OCR determination, and not a substitute for counsel or a formal risk analysis.