If your guest WiFi can talk to your server, you don’t have a wireless network. You have an open floor plan for ransomware.
I’ve walked into a lot of dental offices over the last twenty years. One WiFi name, one password taped inside a drawer at the front desk, and everything connected to it. The Dentrix server. The doctor’s personal phone. A patient’s kid playing games on a tablet in the waiting room. All in the same digital room, all able to see each other.
That setup felt fine in 2012. It’s a liability now, and I want to show you exactly why, in plain English, without the scary vendor pitch.
One Password for Everything Is the Real Problem
Here’s how most practices are set up. One SSID, which is just the network name you see when you connect. One shared password. Everything joins the same network.
The technical term for this is a flat network. Every device on it can see every other device. Your imaging computer can see the hygienist’s iPhone. The iPhone can see the server. Nothing separates them.
Why does that matter? Because modern ransomware doesn’t kick your front door down. It walks in on a device that’s already infected, then looks around. Security people call this lateral movement. The malware scans the network, finds your file shares, finds your practice management server, and spreads.
On a flat network, nothing stops that scan. The infected phone and your patient database are neighbors. That’s the whole problem in one sentence.
And the entry point is rarely dramatic. It’s a staff member’s personal phone that picked something up on airport WiFi last weekend. Your firewall never saw the attack because it didn’t happen at your office. It just walked in the door Monday morning.
The Three Networks Your Practice Actually Needs
The fix is segmentation. You split your wireless into three separate networks using VLANs, which are logical walls your router and switches enforce. Same hardware in most cases. Three separate rooms instead of one big one.
Guest WiFi for patients
Patients expect WiFi. Give it to them. But this network should do exactly one thing, which is reach the internet. Nothing else.
It sits on its own VLAN with zero routing to anything internal. A patient’s infected laptop can scroll Instagram all day and it still can’t find your server, because from where it sits, your server doesn’t exist. I also recommend scheduling this network to shut off outside business hours. Nobody needs your guest WiFi at 2 AM.
Quick test you can run today. Connect to your guest network and try to reach a shared folder or ping your server. If you can, so can everyone in your waiting room.
Staff WiFi for personal devices
Your team’s phones and smartwatches need to connect somewhere, and it shouldn’t be the guest network and definitely shouldn’t be the clinical one.
Here’s the uncomfortable truth about personal devices. You can’t manage them. You don’t control when they get updated, what apps are on them, or what sketchy hotel network they joined last month. Putting an unmanaged phone on the same network as your patient records means trusting a device you have no visibility into.
The staff network stays on around the clock, keeps your team productive, and has firewall rules that block it from reaching the server VLAN. Their phones work fine. Your charts stay out of reach.
Internal WiFi for clinical systems
This is the vault. Only devices that genuinely need server access live here. Practice management workstations, imaging equipment, intraoral scanners, your CBCT unit, backup systems.
This network gets the strictest rules. Unique credentials per user instead of one shared password. Access limited to what each role actually needs. Your front desk computer doesn’t need the same reach as your server, and neither does every laptop in the building.
Not everything deserves keys to the vault. That’s the principle, and it’s called least privilege for a reason.
Get the Encryption Right or None of This Matters
Segmentation controls where traffic can go. Encryption controls who can read it and who can join in the first place. You need both, and this is where a lot of otherwise decent setups fall apart.
WPA2 is the floor, WPA3 is the standard
Every network you broadcast should use WPA2 encryption at absolute minimum, and WPA3 if your equipment supports it, which most hardware sold in the last several years does. If anything in your office still runs WEP or WPA, that gear needed replacing years ago. Those older standards can be cracked in minutes with free tools.
The bigger issue is how most offices use WPA2. One shared password for everyone is called a pre-shared key, and it has a nasty property. Everyone who ever knew it still knows it. The assistant who left in 2023? Still has your WiFi password unless you changed it after she left. Most offices never do.
On your internal network, move past shared passwords entirely. Individual credentials or certificate-based authentication mean one person leaving doesn’t compromise the whole network, and you can revoke a single user without disrupting everyone else.
The hidden SSID myth
Somebody may have told you to hide your network name so hackers can’t find it. Skip it. Hidden SSIDs are visible to anyone with a free scanning app, and hiding them can actually make your devices broadcast the name everywhere they go, looking for it. It’s the security equivalent of hiding your key under the doormat. Real protection comes from encryption and segmentation, not invisibility.
Why Your Insurance Company and HIPAA Both Care
This stopped being optional advice a while ago, and here’s the proof.
Pull up your last cyber insurance application. There’s a good chance it asked whether your network is segmented. Carriers ask because flat networks turn small incidents into total losses, and total losses cost them money. Answer no and you may see higher premiums or remediation demands. Answer yes inaccurately and you may see a denied claim when you need it most.
On the HIPAA side, the Security Rule requires reasonable and appropriate safeguards for patient data. It doesn’t spell out VLANs by name. But when investigators look at a breach, one of the first things they document is whether public, staff, and clinical traffic were separated. No separation reads as no safeguard. That’s not a conversation you want to have after an incident, with your dental IT setup as Exhibit A.
What to Do About It This Week
Three steps, in order.
First, run the guest network test I mentioned. Connect to it and see what you can reach. Five minutes, and you’ll know where you stand.
Second, count your SSIDs. If the answer is one, you now know what needs to change. If it’s two or three, ask whoever set them up to show you the firewall rules between them. Separate names with no rules behind them is just decoration.
Third, ask about your encryption. WPA3 where possible, WPA2 as the floor, and no shared password on anything that touches patient data.
None of this requires ripping out your equipment. Most of it is configuration on hardware you already own. What it requires is intention.
I’m Michael Amador, owner of Willamette Valley IT. We do dental IT and nothing else, from Woodland down to Salem. If you want a second set of eyes on your network, call the office at 503.856.6897. The guest WiFi test is free either way. Run it today.