If the only thing standing between the internet and your patient records is the box your internet company installed, you are connected. You are not protected.
Those sound like the same thing. They are not even close.
I run a dental-only IT company, and I have this conversation at least twice a month. A practice owner tells me, confidently, that they have a firewall. Comcast set it up. The tech even called it that. Then I look in the server closet and find a Comcast Business Gateway doing exactly what it was built to do, which is hand out Wi-Fi.
Let me walk you through why that matters.
The Box in Your Closet Has One Job
Your ISP gateway is really three or four devices in one plastic shell. It is a modem that connects your office to the internet. It is a router that moves traffic between your computers. It broadcasts Wi-Fi. And it performs something called Network Address Translation, which hides your internal addresses from the outside world.
Read that list again. Every single function is about moving traffic.
None of it is about inspecting traffic, judging traffic, or stopping traffic that means you harm. The box was designed to get you online quickly with as few support calls to Comcast as possible. It does that job well. Security was never the job.
Yes, There Is a Firewall Tab. That Is the Problem
Here is where I need to be fair, because your current IT guy might push back on this.
If you log into a Comcast gateway, there is literally a settings page labeled “Firewall.” It is a basic stateful packet filter. It blocks unsolicited inbound connections, and that is genuinely better than nothing.
So technically, yes, there is a firewall in there. The same way a doorknob technically has a lock.
Here is what that built-in filter does not do. It does not run an intrusion prevention system. It does not perform deep packet inspection to look inside traffic for malicious behavior. It does not filter dangerous websites or block connections to known criminal servers. It keeps almost no logs, so after an incident nobody can reconstruct what happened. And no human being on earth is watching it.
That settings tab is exactly where the confusion started. Somebody saw the word firewall, repeated it, and a decade later dental offices across the country believe they have perimeter security because a menu said so.
What a Real Firewall Does All Day
Think of your gateway as a receptionist who opens the front door for everyone who knocks. Friendly. Efficient. Completely unequipped to handle a threat.
A business-grade firewall is a trained security guard. It checks IDs. It watches the cameras. It keeps a written log of everyone who came and went. And when something looks wrong, it locks the door and raises an alarm.
In practical terms, a real firewall inspects traffic in real time, blocks connections to known malicious domains, flags suspicious behavior patterns, logs events you can actually hand to an auditor, segments your network so a compromised front-desk PC cannot reach your imaging server, and supports secure remote access for you and your dental IT provider.
Your gateway does none of that at any meaningful level. Not because it is broken. Because it was never asked to.
Why Ransomware Crews Love a Bare Router
Here is the part practice owners get wrong most often. You assume nobody would bother attacking a single dental office in Vancouver or Salem.
You are right. Nobody would bother. That is not how it works anymore.
Ransomware operations run automated scans across the entire internet, around the clock, looking for weak edge devices and exposed services. Your office is not chosen. It is found. And your router answers those scans in ways that identify exactly what it is. An attacker can tell the difference between a consumer-grade Comcast box and a managed security appliance from the other side of the planet, in seconds.
One device says easy target. The other says move along.
Now consider what is sitting behind that easy target. Patient health records. Social Security numbers. Insurance details. Payment data. X-rays. Medical records sell for many times what a stolen credit card brings, because you can cancel a credit card. You cannot cancel a medical history.
A bare router in front of that data is not a gamble. It is an invitation.
The Insurance and HIPAA Angle Nobody Mentions
HIPAA never actually uses the word firewall. What it requires is a security risk analysis and reasonable technical safeguards for patient data. Try defending “the Comcast box handles it” in that analysis after a breach. I would not want to be in that meeting.
Then there is your cyber insurance application. Those forms now ask direct questions about your network security controls. If you check yes on the firewall question because of that settings tab, and a claim gets investigated, you have a real problem. Carriers have fought claims over misrepresented security controls, and they won. The cheapest firewall in the world is more expensive than a denied claim.
Three Questions to Ask This Week
You do not need to become a network engineer. You need three answers.
First, what is the make and model of the device protecting my network? If the answer is anything with Comcast printed on it, you have your finding.
Second, who is monitoring it? A firewall nobody watches is a smoke detector with no battery.
Third, when were its protections last updated? Threat lists go stale fast. A security device running on old definitions is guarding against last year’s attacks.
If your IT provider can answer all three without checking, good. If the question produces silence, that silence is your answer.
You lock the office doors at night. You alarm the building. You secure the narcotics cabinet. Extend that same instinct to the digital front door, because right now it might be guarded by a box whose real job is handing out Wi-Fi.
Being connected is easy. Being secure takes intention. Your patients are counting on you to know the difference.
Michael Amador owns Willamette Valley IT, a dental-only IT company serving practices from Longview, WA to Salem, OR. If you are not sure what is in your server closet, that is exactly the kind of question we answer. 503.856.6897.