Security-Awareness Training & Phishing Tests for Dental Prac

A dental reception workstation receiving a hooked phishing email, a shield forming around the cursor at the moment before a click

October 15, 2026 The Breach Almost Always Starts With a Click: How to Run Security-Awareness Training and Phishing Tests in a Dental Practice

Posted at 06:32h in IT Security by Raymond

Read back through the dental data breaches of 2026 and a pattern emerges that has nothing to do with sophisticated malware. A staff member opened an attachment. Someone typed their password into a convincing fake login. A receptionist, trying to be helpful, approved a login prompt or gave a “technician” on the phone the access they asked for. The expensive firewall was never the problem. A person was persuaded.

Verizon’s 2026 Data Breach Investigations Report puts a number on it: the human element was involved in 62% of breaches, with phishing responsible for a large share on its own. For a dental practice, that statistic points to the single most cost-effective control you can add — and it is not a product. It is a security-awareness program: recurring training plus realistic phishing tests that teach your team to recognise the lure before they click.

The common thread in 2026’s dental breaches is a person

We have documented the year’s incidents on this blog, and the root cause is remarkably consistent. The Hawaii Family Dental breach that exposed 45,853 patients traced back to a single compromised account. Attackers have called front desks directly, impersonating IT to walk a trusting employee through handing over a Microsoft login. Across the string of dental breaches already reported this year, the breach rarely began with a flaw in the software. It began with a flaw in the moment — a busy person, a plausible message, and no pause to verify.

That is not a criticism of your team. It is the design of modern attacks. Phishing and social engineering are engineered to exploit exactly the instincts a good dental employee has: be responsive, be helpful, open the attachment the “insurer” sent, answer the “colleague” who needs something urgently. You cannot patch that instinct. You can, however, train it.

What security-awareness training actually is (and is not)

The phrase conjures a dreaded hour-long video watched once a year with the sound off. That version does almost nothing, and the research is blunt about why: people forget, attacks evolve, and a single session cannot build a reflex. Effective awareness training looks different in three ways.

Short and frequent beats long and annual. A few minutes a month — a two-minute clip on gift-card scams, a one-screen refresher on spotting a spoofed sender — keeps the topic alive without stealing clinical time. Habit, not homework.
Specific to dental work. Generic “don’t click suspicious links” advice slides off. Training that uses the lures your staff actually see — a fake lab invoice, a bogus insurance EOB, a “patient” email with a malicious form, a text claiming to be the practice owner asking for gift cards — sticks because it is recognisable.
Role-aware. The front desk faces inbound email and phone pretexting all day; the office manager handles invoices and payroll changes that wire-fraud scams target; clinicians use personal phones and cloud logins. Each role needs the slice of training that matches its real exposure.

A faded once-a-year training video beside a bright recurring cycle of short micro-lessons feeding a dental team — Awareness is a habit, not an event: short, frequent reinforcement beats a single annual video everyone forgets.

Phishing simulation: testing, not punishing

A phishing simulation is a safe, fake phishing email your IT provider sends to your own staff to see who clicks, who enters credentials, and who reports it. Done well, it is the single best way to turn abstract advice into a measured, improving skill. Done badly, it breeds fear and resentment and teaches people to hide mistakes — which is the opposite of what you want.

The difference is culture. The goal is never to catch and shame the person who clicks. It is to create a teachable moment: someone who clicks a simulated lure lands on a short, friendly page that explains the exact tell they missed, and that is the end of it. Meanwhile the real win is the report button — a one-click way to flag a suspicious message to IT. You want to measure two numbers over time: the click rate falling, and the report rate rising. A team that reports a real attack within minutes is worth more than a team that merely avoids clicking, because reporting is what lets you contain the one message that does get through.

A simulated phishing email being safely reported with a report button, a teaching card appearing instead of an alarm — A good phishing test ends in a teachable moment and a clicked report button, not a public telling-off.

Building a program that fits a small practice

You do not need an enterprise security department. A workable program for a practice of five to forty people looks like this:

Baseline first. Run one quiet simulated phishing test before any training, so you know your real starting click rate. It is almost always higher than owners expect — and that honest number is what justifies the effort.
Train monthly, test quarterly. Short monthly micro-lessons, a simulated phishing email roughly once a quarter, with the scenarios rotating so no one memorises a single “trick.”
Onboard new hires on day one. New staff are a favourite target precisely because they do not yet know who is who. Awareness belongs in onboarding alongside the PHIPA privacy briefing, not months later.
Give everyone the report button and a rule. One simple, repeated rule closes most of the gap: verify unexpected requests through a second channel before acting. An email asking to change banking details? Phone the known contact. An “IT” caller asking you to approve a prompt? Hang up and call your provider’s real number.
Track and share the trend. Celebrate the falling click rate and the rising report rate in a team meeting. Visible progress is what keeps a program alive past month two.

A simple dashboard showing a falling phishing click rate, a rising report rate, and each practice role checked off — Measure two things over time: fewer people clicking, and more people reporting. Both are signs the program is working.

It is also a compliance and insurance requirement

Security-awareness training is not only good practice — increasingly it is expected of you. Workforce security training is an explicit expectation under HIPAA, and a reasonable safeguard under Ontario’s PHIPA; a regulator reviewing a breach will ask what training your staff received, and “none” is an answer that compounds the penalty. Cyber-insurance underwriters have moved the same way: as we covered when examining the security controls that decide whether a claim gets paid, carriers now commonly require documented, recurring awareness training and will question a payout if it was absent. A training program you can evidence is both a defence against the breach and a defence against having the claim denied after one.

A layer, not a replacement

None of this displaces your technical controls. Multi-factor authentication, timely patching, and tested backups remain non-negotiable — and awareness training makes each of them stronger. A trained employee is far less likely to approve the fraudulent MFA prompt that defeats multi-factor authentication through sheer fatigue, and far more likely to report the intrusion early enough that your backups never have to be used. The human layer and the technical layer are not alternatives; they are two rings around the same practice, and attackers only need one of them to be missing.

A dental office protected by two concentric rings, an inner technical-controls ring and an outer trained-people ring glowing together — Training is the outer ring, not the only ring: it works with multi-factor authentication, patching, and backups, not instead of them.

How Compudent Systems can help

At Compudent Systems, we run managed security-awareness programs built for dental practices across the GTA and Ontario: a baseline phishing assessment so you know where you stand, short recurring training tuned to the lures your team actually faces, periodic simulated phishing with teach-don’t-punish follow-ups, a one-click report button wired to our team, and the documented records your PHIPA and HIPAA obligations — and your cyber insurer — expect to see. Contact Compudent Systems for a security-awareness assessment, and turn the weakest link in most breaches into your practice’s most reliable line of defence.

Sources & further reading:

The Breach Almost Always Starts With a Click: How to Run Security-Awareness Training and Phishing Tests in a Dental Practice