A dental practice holds health data: X-rays, diagnoses, treatment plans. The Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, requires it to be protected by measures appropriate to the risk. It names no product: it sets objectives. Here are the essentials, and how we help you meet them.
Dental practices are not a priority target for hackers, but mass attacks reach them too: one click on a fake e-mail is enough. According to the Federal Office for Cyber Security (FOCS), successful attacks mainly come through phishing, through devices or firewalls that have not been updated, and through remote access without two-factor authentication.
It is the practice, its owner or the company that runs it, that is responsible for its patients' data. The ordinance sets minimum requirements: each person only accesses the data needed for their work, systems are kept up to date, and data can be restored quickly after an incident (Art. 8 FADP, Art. 3 DPO). Professional secrecy (Art. 321 of the Swiss Criminal Code) also binds the dentist and their assistants.
An e-mail containing patient data must be sent encrypted: this is what the SSO and the FMH require. In Swiss healthcare, HIN is the reference solution. Proton, which we install, automatically encrypts exchanges between its users; to any other address, you send a password-protected message. Never a patient's name in the subject line, never an X-ray by WhatsApp.
An antivirus blocks what it recognises. Protection known as EDR goes further: it watches how programs behave, can isolate a computer and alerts a professional. Someone still has to handle these alerts: on the computers covered by our monitoring contract, we handle them as soon as they arrive and keep you informed.
This protection is completed by simple measures: systems kept up to date (Windows 10 has no longer received security updates since 14 October 2025, except with a paid subscription), devices that cannot be updated isolated from the rest of the network, two-factor authentication on e-mail and remote access, encrypted drives, and a patient WiFi separate from the practice network.
Your backup remains your last line of defence. The FOCS recommends the 3-2-1 rule: three copies of your data, on two different media, one of them outside the practice. Against ransomware, one copy must also be out of reach. And a backup is only worth anything if it has already been restored successfully: the SSO and the FMH require a test at least once a year; we regularly test the backups we manage.
Technical measures are not enough. A data processing agreement is needed with every provider that processes data on your behalf (Art. 9 FADP). Written rules and regular awareness training for the team are recommended. Every incident is documented, and a leak that poses a high risk for patients is reported to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible. FADP fines, of up to CHF 250,000, target individuals and intentional violations, most often following a complaint.
SELF-ASSESSMENT
Six points taken from our guide, each explained according to your answer. Your answers stay in your browser and carry over to the full check-up.
The assessment requires JavaScript. The explanations for each point remain readable below.
The law requires systems and software that are always up to date in terms of security (Art. 3 DPO). Windows 10 has no longer received security updates since 14 October 2025, except with a paid extended security updates subscription. Any device that no longer receives them is an open door, and one is enough.
Known vulnerabilities are publicly listed, and automated tools exploit them. From one vulnerable computer, an attacker moves on to the server, the backups and the practice software, often at night or at the weekend.
Running Windows 11 is not enough: each version has its end date. Windows 11 24H2, Pro edition, has no longer received security updates since 13 October 2026.
Automatic updates and a restart every week take care of most of it. Think also of forgotten devices: an old server, a printer, the WiFi router. A medical device that can no longer be updated must be isolated from the rest of the network. We recommend replacing computers every five years at most.
Do all your computers and servers still receive security updates, and install them automatically?
In order: your equipment is up to date.
To fix: one vulnerable device puts the whole practice at risk.
To check: this is often where the risks hide.
An antivirus mainly blocks what it already knows, and no one sees its alerts. Protection known as EDR watches what programs do, stops an attack in progress, even an unknown one, and alerts a professional.
If a program starts encrypting folders one after another, the EDR blocks it, isolates the computer and alerts the provider.
An EDR is only worth anything if it is monitored: someone must receive the alerts and react quickly.
Are your computers protected by an EDR solution whose alerts are followed up by your provider?
In order: an attack can be stopped while it is under way.
To fix: an attack could go unnoticed.
To check: this is often where the risks hide.
After the password, a code on the phone: even if the password is stolen, the attacker stays outside. It is the same principle as a bank card and its PIN.
Enable it first on e-mail, remote access, online backups, the dental software if it allows it, and the bank.
A hacked mailbox is often used to deceive your contacts, laboratories and patients included.
Is two-factor authentication enabled on the practice's e-mail, remote access and online services?
In order: a stolen password is no longer enough.
To fix: a single password protects your data.
To check: this is often where the risks hide.
A remote control tool left permanently open, with a weak password, is a classic way in for ransomware.
Every connection must be identified, protected by two-factor authentication, logged and limited in time. The wider the access (server, patient data), the more secure the solution must be.
The free versions of remote control tools are not designed for this.
Does remote access to your computers go only through a professional tool, with two-factor authentication and a record of every connection?
In order: every connection is controlled.
To fix: a door is left permanently open.
To check: this is often where the risks hide.
Not applicable: no remote access.
An X-ray, a diagnosis or any information that identifies a patient is never sent by ordinary e-mail. You need encrypted e-mail, such as HIN within the healthcare network, or Proton.
Gmail, Hotmail or Bluewin do not encrypt the content end to end: the message can be read on the servers it passes through, sometimes outside Switzerland.
With Proton, end-to-end encryption is automatic between Proton users; to any other address, you send a password-protected e-mail, with the password passed on by another channel. The subject line is never encrypted: never write a patient's name in it.
Is the patient data you send by e-mail always sent through encrypted e-mail?
In order: what you send is protected.
To fix: health data is travelling unencrypted.
To check: this is often where the risks hide.
The first minutes count. Everyone in the practice must know what to do, and above all what not to do, if a screen displays a ransom demand:
Is the procedure to follow in the event of an incident displayed in the practice and known to the whole team?
In order: the right reflex is close at hand.
To fix: the team may make things worse.
To check: this is often where the risks hide.
Guide, chapter 16Quick-reaction sheet DS2Template DS5: incident procedureForm DS11: incident documentation
0out of 6 points
Your answers carry over to the full check-up: 22 points, with a summary you can send us.
Take the full check-upThe security of a practice depends on a few measures done well and maintained over time. We put them in place with you, we monitor them and we tell you clearly what remains your responsibility.
First visit free of charge: we analyse your installation on site, discuss it with you and give you a quote if you wish.