For Houston dental offices that want security, backups and HIPAA and Texas HB 300 compliance handled by specialists. Our engineers in Coimbatore and Chennai, India, monitor, harden and document your systems remotely. We do not send technicians on site, so keep a local technician for hardware and cabling.
Dental IT work splits into jobs someone has to touch and jobs that can be done over a secure connection. We take only the second kind, and say so in writing up front.
Configuration, not hardware, holds most of the risk:
We do not offer on-site visits or break-fix repair. Keep a local technician for:
When a fix needs hands, we send that technician written steps and stay on the call.
Every task on that first list is handled from Coimbatore and Chennai, India, through monitoring, video calls and written reports; we have no Houston office or field staff. The security work draws on our threat intelligence and incident response service.
| Aspect | Xcodefix, remotely | Your local technician, on site |
|---|---|---|
| Failed server or workstation | Reads logs and monitoring data, then sends written repair steps | Replaces the part and brings the machine back |
| Backups | Sets up encrypted daily backups, a copy outside Houston and scheduled restore tests | Swaps any local backup drives you keep |
| Email and logins | Phishing filtering, MFA, account and forwarding-rule reviews | Usually not involved |
| HIPAA and HB 300 paperwork | Risk analysis, policies, training and signed records | Usually not involved |
| Ransomware or suspected breach | Same-day response, containment guidance, forensics, notification timeline | Unplugs or reimages machines on our instructions |
| Sensors, cabling, Wi-Fi, phones | Not offered | Installs and repairs |
No local technician yet? Line one up before you need one. Remote work can find a fault; it cannot carry a drive into your server closet. An AWS migration of the server removes part of that burden.
HIPAA reaches any dental office that sends claims electronically. Texas adds a wider privacy statute, its own breach clock and a records-retention rule, each shaping how we configure systems.
Health and Safety Code chapter 181 covers anyone who stores, transmits or comes into possession of PHI, including contractors. Each employee must be trained on state and federal privacy law within 90 days of hire, and within a year of a material change in the law, then sign a statement the practice keeps for six years.
When your system can produce it, a patient's written request for an electronic copy of their record must be met within 15 business days under section 181.102. The dental board's rule allows 30 days for copies, so the shorter electronic deadline is the one to plan around. Since 1 September 2025, section 181.105 also requires posted instructions for requesting records and filing complaints.
Business and Commerce Code section 521.053 requires notice to affected people without unreasonable delay and within 60 days of determining a breach occurred. If 250 or more Texans are affected, the Attorney General must be told within 30 days through an online form, and the AG publishes a list of reported breaches. Health information that identifies a patient counts as sensitive personal information.
The State Board of Dental Examiners requires records to be kept at least five years from the last treatment, or until age 21 for a patient last treated as a minor if that is longer. Backup retention and data migrations must respect that clock.
The Security Rule requires a thorough risk analysis, a data backup plan, a disaster recovery plan, unique user IDs and workforce security training. HHS proposed a major revision in January 2025; as of 1 November 2026 no final rule has been published, and the federal agenda lists it as a long-term action.
Chapter 181 civil penalties run up to $5,000 per negligent violation, $25,000 per knowing one and $250,000 where PHI is used for financial gain.
We are not a reseller or support partner for any practice-management vendor; the vendor stays your first call for application faults. We secure the server, logins, backups and network around it.
Open Dental runs on a MySQL or MariaDB database and, since version 24.4, is proprietary rather than GPL-licensed. Its manual calls for a unique login per person, documents permission groups and an audit trail, and recommends daily, encrypted backups tested on a computer off the office network. We confirm each is switched on and working.
Henry Schein One sells Dentrix and Ascend by Dentrix, which it describes as cloud-based. An on-premises install keeps the database server in your office, so patching, access and backups fall to the practice. A cloud system moves the work to logins, MFA, browsers and the workstations used to reach it.
Patterson Dental sells and supports Eaglesoft, a server-based system. The machine holding its database is the asset to protect first: limited remote access, a patched operating system, monitored logins and an off-site backup.
HHS's 405(d) guidance lists social engineering and ransomware among the top five threats to healthcare organizations and has a volume for practices with one to ten physicians. Its ten practices are the checklist behind these services.
We collect logs and endpoint alerts from the server and workstations and investigate what matters, from repeated failed logins to unfamiliar software at the front desk.
Encrypted daily backups of the practice database and imaging folders, a copy kept outside Houston, and scheduled restore tests. When Hurricane Beryl struck in July 2024, CenterPoint reported more than 2.26 million customers without power at the peak; a backup that sits only beside the server shares its fate.
Phishing filtering, MFA on email and remote access, and reviews of mailbox forwarding rules and shared inboxes. Staff get phishing simulations from our security awareness training program, with results you can show an auditor.
The Security Rule's risk analysis, scoped to a dental office rather than a hospital, and the policies it leads to, drawn from our HIPAA compliance consulting.
Short training on Texas and federal privacy law for every new hire inside the 90-day window, refreshers after material changes in the law, and signed completion statements filed for six years.
If your server is aging, we can plan a move of the practice-management workload to AWS where the vendor supports it, with encryption, least-privilege access and logging, or help you weigh a move to a cloud-based system.
Houston is on Central Time. From 1 November 2026 to 14 March 2027 the clocks read UTC−6, so India (UTC+5:30, no daylight saving) is 11 hours 30 minutes ahead. From 14 March 2027 Houston moves to UTC−5 and the gap narrows to 10 hours 30 minutes.
A video walkthrough with your office manager, then a read-only review of accounts, backups, patches, mailboxes and HIPAA documents. You get a written findings list ranked by risk, the starting point for a full HIPAA risk assessment.
An Indian working day of 9:30 a.m. to 6:30 p.m. IST equals 10:00 p.m. to 7:00 a.m. in Houston during Central Standard Time, so updates and restarts on the server run while the operatories are empty.
Serious alerts go to the contact you name. A monthly written report covers backup and restore results, patch status, account changes and open risks.
Security incidents get a same-day response. We guide containment remotely, brief your local technician on any hands-on work, and track the Texas and HIPAA notice deadlines with you.
Live calls: We book video reviews at the start of your day. 8:00 a.m. in Houston is 7:30 p.m. in India under Central Standard Time and 6:30 p.m. under Central Daylight Time, so a short call fits before the first patient arrives.
Healthcare technology has been our main field since the company began in 2008, so PHI handling, risk analysis and breach rules are everyday work.
A suspected ransomware infection or breach gets a same-day response. Other enquiries get a reply within one business day.
A short document lists what we cover remotely and what your local technician covers, so no task falls between vendors.
When our work involves access to protected health information, we sign a Business Associate Agreement.
The people who write your risk analysis also fix the findings, so advice arrives with the configuration work.
More than 60 in-house engineers and developers, with solution architects leading each engagement.
Tell us how many workstations you run, which practice-management system you use and who handles your hardware today. Within one business day you will have our view of what we would cover remotely, what should stay local, and the first risks we would check.
Prefer email? info@xcodefixglobal.com
Talk to the specialist who would scope the work — not a call-centre script.
Ask us directlyYes, for most practices. HIPAA covers any health care provider that transmits health information electronically in a standard transaction, such as an insurance claim, so a dental office filing claims electronically is a covered entity. In Texas, chapter 181 of the Health and Safety Code reaches further still, covering anyone who handles or comes into possession of PHI.
Ninety days. Texas Health and Safety Code section 181.101 requires each employee to complete privacy training within 90 days of hire, and again within a year of a material change in law that affects their duties. Each employee signs a statement, kept for six years. Pages citing 60 days or training every two years describe the law before a 2013 amendment.
Some providers publish flat monthly prices. On 1 November 2026, DDS Tech Pro's pricing page listed $999 a month for ten or fewer workstations, and Siotek's listed $399 a month for up to ten. Prices change, so confirm them with each vendor. We price remote security and compliance work after a short review.
Security, monitoring, backups, email protection, patching, compliance work and HIPAA penetration testing can all be done remotely, and that is the service we offer. Hardware cannot. Failed drives, new workstations, sensor installs, cabling and Wi-Fi still need someone in the building, so a Houston practice using us should keep a local technician for that work.
Disconnect affected machines from the network without wiping them, then call your incident responder. If unsecured PHI may have been exposed, HIPAA requires notice to patients without unreasonable delay and within 60 days of discovery, and Texas law requires notice within 60 days of determining a breach, with the Attorney General told within 30 days when 250 or more Texans are affected.
At least five years from the last date of treatment under the State Board of Dental Examiners rule, 22 TAC 108.8. For a patient last treated before age 18, keep the records until the patient turns 21 or for five years, whichever is longer. Other laws can require longer, so set backup and archive retention to the longest rule that applies.
No software is HIPAA compliant on its own; compliance depends on how the practice configures and runs it. Open Dental supplies the tools: unique user logins, permission groups, an audit trail of user actions, and backup guidance that calls for daily, encrypted copies. The practice still has to use them, document a risk analysis and protect the server.
If the provider creates, receives, maintains or transmits PHI for you, for example by managing the server or holding your backups, HIPAA treats it as a business associate, and you need a signed agreement. Ask for one before granting access. We sign a BAA whenever our work involves access to protected health information.
