September 17, 2026 When the System Goes Down: Building a Downtime and Business-Continuity Plan for Your Dental Practice
Picture 8:05 on a Monday morning. The first patient is in the chair, the waiting room is filling, and the front desk clicks into the practice-management software – and nothing loads. The schedule is gone. The charts are gone. The X-rays are gone. The card terminal that talks to the software is dead. In a fully digital dental practice, an IT outage is not an inconvenience; it is a clinical and financial emergency that stops the whole business in its tracks. The uncomfortable truth is that when this happens is far less in your control than how prepared you are for it. That preparation has a name – a business-continuity and downtime plan – and every practice should have one written down before it is needed.
Why every practice is now one outage away from a standstill
A generation ago, a power cut meant you reached for the paper daybook. Today, the schedule, the patient charts, the digital radiographs, the e-claims, the recall reminders, and often the phones all live on computers and networks. That efficiency is exactly why an outage hurts so much: there is no analogue fallback humming quietly in the background. When the system is dark, you cannot see who is booked, you cannot pull a history, you cannot capture or read an image, and you cannot submit a claim. The practice does not slow down – it stops.
Four ways the lights go out
Downtime almost always arrives by one of four doors, and recent months have shown every one of them in the wild:
- A bad patch or update. Security updates are essential, but they occasionally break things. September 2026’s Windows Server update did exactly that, knocking out Remote Desktop and locking staff out of the very server their software runs on.
- Ransomware or a security incident. An attacker who encrypts your files can freeze the schedule and charts in seconds, as the steady stream of firewall-borne ransomware campaigns aimed at small clinics keeps proving.
- A third-party vendor or cloud outage. When your billing company, cloud practice-management host, or imaging provider goes down, so do you – even though your own office is fine. The eAssist/Direwolf attack on an outsourced dental-billing provider was a reminder that your uptime depends on your vendors’ uptime.
- Ordinary hardware, power, or internet failure. The least dramatic and most common cause of all – a dead server drive, a failed switch, a cut internet line, or a power surge.
Notice that all four produce the same outcome: no access to the tools that run the practice. A good plan prepares for that outcome, not for one specific villain.
The two numbers that size your plan: RPO and RTO
Before you buy anything, answer two questions – they turn “we should be more prepared” into a concrete, buildable plan.
Recovery Point Objective (RPO): how much data can you afford to lose? If your backup runs once a night and the server dies at 4 p.m., you have lost a full day of charting, images, and payments. If losing an hour is the most you can stomach, you need backups every hour. RPO sets your backup frequency.
Recovery Time Objective (RTO): how long can you be down before it becomes a serious problem? A four-hour RTO and a three-day RTO call for completely different setups – the first may need standby hardware and near-instant restore; the second can tolerate rebuilding from an off-site copy. RTO sets your recovery method and spare capacity. Put a real number on each, and the rest of the plan almost designs itself.
Backups: the foundation, done properly
Every continuity plan rests on backups – but not all backups are equal. The durable standard is the 3-2-1 rule: keep three copies of your data, on two different types of media, with one copy off-site. In the ransomware era, add one more word to that off-site copy: immutable (or at least offline). Modern attackers deliberately hunt for and delete backups before they trigger the encryption, so a backup sitting on an always-connected drive can be destroyed alongside everything else. A copy they cannot reach or alter is what lets you say no to a ransom.
And the single most overlooked rule of all: an untested backup is not a backup – it is a hope. Backups fail silently more often than anyone expects. Schedule periodic test restores so that the first time you recover real data is not the day you are relying on it.
The cloud does not remove your responsibility
Many practices have moved to cloud practice-management software or outsourced billing, and assume continuity is now the vendor’s problem. It is not – it is shared. The servers may be off-site, but the duty to keep the practice running, and to safeguard patient information, stays with you. Practically, that means three things: know your vendor’s promised recovery time and read the service-level agreement; keep your own exportable copy of your data wherever the platform allows it, so you are never wholly locked inside someone else’s system; and have a paper fallback for the day the vendor is simply unreachable. This is the same vendor-and-data discipline we set out in our guide to PHIPA, HIPAA, data governance, and vendor risk – continuity is one more reason to know exactly who holds your data and how you get it back.
The downtime kit: keeping the chairs running when the screens are dark
Restoring the systems is the IT half of the job. The other half is keeping the practice moving during the outage, and that comes down to a simple, printed downtime kit and runbook the front desk can reach for without thinking:
- A printed daily schedule – generated automatically each morning and kept on paper, so you always know who is coming even when the software is down.
- Paper charting, medical-history, and consent forms to capture the day’s clinical notes and signatures for later entry.
- A manual card-payment fallback (a standalone terminal or phone-based option) so you can still take payment when the integrated terminal is offline.
- A one-page runbook: who to call first, in what order, and who does what – the step-by-step for the first thirty minutes, written before the stress of the moment.
- Key contacts and a communication plan: your IT provider, your PMS and billing vendors, plus ready messages for patients and staff so the practice communicates calmly instead of going silent.
Assign an owner and practise it
A plan filed away and forgotten fails at the worst moment. Name an incident owner – the person who takes charge, works the runbook, and coordinates the team – and make sure a backup person can step in if they are away. Then walk the staff through it at least once, so that when a monitor really does stay dark on a Monday morning, the front desk is executing a familiar routine rather than improvising in a panic.
What this means for your practice
Downtime is not a question of if but when – a patch, a vendor, an attacker, or a failed drive will eventually take a fully digital practice offline. What separates a bad hour from a lost week is entirely down to preparation: sized backups you have actually test-restored, an off-site copy ransomware cannot touch, a realistic RTO, and a printed runbook the team knows how to use. Compudent Systems builds and tests business-continuity plans for dental practices across the GTA and Ontario – assessing your backups, hardening them against ransomware, defining your RTO and RPO, assembling your downtime kit, and providing the rapid recovery that turns a potential catastrophe into a manageable interruption. If you cannot say with confidence how long you would be down after an outage – or whether your last backup would even restore – contact Compudent for a business-continuity and backup review. The best time to build the plan is on an ordinary Tuesday, long before you need it.
Sources & further reading:
Related Reading
- Ransomware Is Now a Patient-Safety Issue: What a 38% Hospital Mortality Study Means for Your Dental Practice
- Your Billing Company Is on a Leak Site: The eAssist/Direwolf Attack and Outsourced-RCM Risk
- The FBI Just Refreshed Its Medusa Ransomware Warning for Healthcare: The Real Lesson for Your Dental Practice