How DSOs Can Evaluate Third-Party Cybersecurity Risk

By Jigar Shah, Chief Information Security Officer at Medusind

Recent cybersecurity developments in the dental services industry have once again brought an important issue to the forefront: organizations are only as resilient as the ecosystem they operate within.

For growing dental practices and DSOs, that ecosystem is increasingly complex. Practice management systems, payer portals, cloud applications, insurance verification workflows, partners, and vendors all play a role in keeping the organization running. These connections are central to creating business value, but they also create risk.

As practices grow and DSOs expand, cybersecurity can no longer be viewed solely as an internal IT responsibility. The security practices of third-party organizations are increasingly a fundamental part of the DSO’s own risk environment.

That means cybersecurity should carry meaningful weight when evaluating a strategic partner alongside performance, technology, service, and cost. The question is not simply whether a prospective partner says it takes security seriously. DSO leaders should look for evidence that security is fundamentally embedded into how that organization operates.

Cybersecurity Is a Business Issue for DSO Leadership🔗

Cybersecurity was once viewed as the responsibility of the technology organization, with issues that could be isolated within its own technology stack. Today, cyber risk can quickly spill beyond the partner into your organization’s finances, operations, regulatory and compliance obligations, and patient relationships.

That is particularly important when a partner handles patient information, including protected health information (PHI), personally identifiable information (PII), financial information, or other sensitive data. A dental billing company, for example, may need access to practice management systems, payer portals, and patient information, while providers supporting dental insurance eligibility verification may depend on additional applications and integrations.

For DSO leadership, the security of those relationships should always be part of any new partnership evaluation. Leaders need to understand what information a partner will access, how it will be protected, and what would happen if that partner experienced a cybersecurity incident.

Look for Evidence of Cybersecurity Maturity🔗

Fundamentally, a mature security program should be able to demonstrate more than basic compliance.

Certifications and independent assessments can provide an important starting point. Prior to any serious discussions, DSOs should understand which recognized frameworks and certifications a potential partner follows and whether the organization can provide appropriate evidence of its security practices.

Independent penetration testing is another useful indicator. Rather than simply asking whether testing occurs, leaders should understand whether critical vulnerabilities have been identified, whether any remain unresolved, and how quickly issues were remediated.

The same applies to foundational controls. Sensitive information should be appropriately protected through measures such as encryption, multifactor authentication, and well-governed access. A partner should be able to explain how credentials are protected, how users are authenticated and authorized, and how access to sensitive systems is managed.

These may sound like technical questions, but the business issue is straightforward: can the organization clearly explain – and demonstrate – how it consistently protects the information and systems entrusted to it?

Understand What Happens When Something Goes Wrong🔗

Strong cybersecurity programs do not assume every incident can be prevented. Resilient cybersecurity means preparing for what happens when defenses are tested.

When evaluating an outsourced dental billing company or another critical partner, DSOs should clearly understand the organization’s incident response process, including:

• How would an incident be identified and escalated?
• How quickly would clients be notified?
• Could affected connections or access be contained to help limit exposure?

Business continuity and disaster recovery are equally important. A cyber incident does not only create a data-security concern; it can interrupt critical business processes. DSO and practice leaders should understand how a partner plans to continue serving clients and recover operations if its environment is disrupted.

Past incidents can also provide useful information. The important question is not simply whether an organization has experienced an issue, but how it responded, what it learned, and what changes were made in response.

Mature Security Is Proactive, Not Reactive🔗

Another important distinction is whether a security program is designed primarily to respond to problems or to continuously look for them.

A mature program should monitor emerging risks, identify vulnerabilities, and address them before they become larger issues. In early discussions, it’s revealing to ask potential partners about the practical measures of that discipline:

• Do they continuously monitor their environment?
• How quickly are critical findings remediated?
• Are security controls regularly assessed?

People matter as well. Phishing, impersonation, and other forms of social engineering continue to target employees and help desks. Security awareness, employee training, and strong processes around credentials and access are important indicators of an organization’s security culture and commitment to client safety.

AI adds another consideration. As organizations introduce AI into healthcare and revenue cycle workflows, leaders should understand what information is being used by those systems, how that information is protected, and what governance is in place around AI applications and agents. Security and responsible AI cannot be treated as separate conversations.

Ultimately, the strongest cybersecurity comes from layers: people, processes, technology, governance, monitoring, and accountability working together. However, the larger philosophy matters more than any individual control. A realistic approach assumes that every layer will eventually be tested, so understanding how they work together and support each other is crucial. This is defense in depth - not as a technical concept, but as an operating philosophy.

Questions DSOs Should Ask Their Strategic Partners🔗

Although digging into technical details around cybersecurity can be intimidating, dental practice and DSO leaders don’t need to be cybersecurity experts to start a meaningful discussion. A few practical questions can reveal a great deal about a partner’s maturity. Here are some we recommend asking:

• What security certifications, independent assessments and penetration testing results can you provide?
• How do you encrypt sensitive information and manage authentication, access and credentials?
• How quickly do you identify and remediate critical vulnerabilities?
• How do you monitor your environment for emerging threats?
• What is your incident-response process, including procedures for notification when required or appropriate?
• What business continuity and disaster recovery plans are in place?
• How do you assess the cybersecurity posture of your own vendors and subcontractors?
• If you use AI, what data is being used and what governance is in place to protect it?

The goal is not to find a partner that claims risk can be eliminated. Instead, the answers to these questions and the discussions they initiate should help determine whether the organization can demonstrate a disciplined, proactive, and continuously improving approach to security.

At Medusind, we recognize that clients entrust us with more than revenue cycle processes. They entrust us with access to information and systems that matter to their organizations and the patients they serve.

That responsibility has driven continued investment in people, processes, and technology. Medusind operates with 24/7 security monitoring and has strengthened areas including identity and access management, governance and compliance, endpoint protection, network and application security, employee awareness, and continuous cybersecurity assessment. This emphasis on layered protection, defense in depth, governance, and continuous monitoring is also reflected in Medusind’s broader security program.

For DSOs evaluating technology providers, outsourced dental billing partners or other critical vendors, cybersecurity deserves a place in the strategic conversation from the beginning. Look beyond assurances and ask for evidence of how security is governed, tested, monitored, and continuously improved.

Because today, a DSO’s cybersecurity posture is shaped not only by what happens within its own walls, but by the strength of the organizations it trusts to operate alongside it.