When a dental practice discovers a data breach, a missing chunk of revenue and a state board complaint, the instinct is to treat them as three unrelated crises requiring three different consultants. The authors of a new book argue that all three share a single point of origin: system access that no one has officially claimed, reviewed or documented. That insight matters for any small business that stores sensitive customer data, but it cuts deepest in dentistry, where a single patient file typically bundles a Social Security number, insurance details, payment information and medical history.
Anthony Jurjevic, CISSP, and the Techspedient team at a dental industry trade show, demonstrating how one phishing click exposes a practice.
Revv Billing Systems at a dental industry trade show. Co-author Monica Cappelli founded the dental billing and revenue cycle firm whose work underpins her chapters in The Unlocked Practice.
Also worth a look: Golden Geese Recruiting launches FDE practice led by ex-Windsurf, Cognition AI operators and ERE forum pushes recruiting leaders past AI pilots to real actions.
Co-author Monica Cappelli also contributed to The Dental Exit Blueprint, writing Lever 2, Collect More From Insurance, one of thirteen EBITDA levers that drive dental practice valuation.
A dental practice holds Social Security numbers, insurance files and payment data with none of a bank’s oversight. Three specialists offer a 90-day plan.
The practices that got hurt were not the careless ones. They were the ones where everyone assumed somebody else was watching.”— Duane “Tink” Tinker, former Texas Dental Board investigatorNEW YORK, NY, UNITED STATES, October 14, 2026 /EINPresswire.com/ — The conventional approach in dentistry is to handle a breach, an embezzlement and a licensing complaint as separate emergencies with separate fix-it plans. The newly released book The Unlocked Practice challenges that assumption head-on, contending that all three disasters germinate in the same soil: access that no one has formally assigned, reviewed or put in writing. The dynamic is hardly unique to dentistry — it plays out in any owner-operated business holding valuable records without a dedicated gatekeeper — but the stakes are unusually high when a single file contains everything needed for identity theft and insurance fraud.
The book, available this month, brings together three distinct vantage points. Monica Cappelli, who runs a practice management and revenue cycle firm, examines operations, vendor oversight and the financial reports that expose billing leaks and outright theft. Anthony Jurjevic, CISSP, focuses on remote access and the vendor connections that owners cannot see from their dashboard. Duane “Tink” Tinker, a former Texas Dental Board law enforcement officer, explains documentation, claims integrity and the specific red flags investigators hunt for.
The urgency is not theoretical. More than 15 million people were notified this year that their information was exposed in a single dental benefits breach, and the DentaQuest incident was reported by multiple security outlets as the largest U.S. health data breach disclosed in 2026. A dental record typically carries a Social Security number, an insurance identifier, a payment method and a medical history in one file.
Consider the case of a former employee’s login that still works. That single credential functions simultaneously as a security exposure, a theft opportunity and a recordkeeping problem — yet no single department within a practice typically owns the issue. The authors document this pattern across 78 endnotes drawn from federal enforcement actions, embezzlement prosecutions and appellate decisions involving dentists.
Perhaps the most telling data point comes from Jurjevic’s own field work. In simulated phishing tests his firm ran at more than 100 dental practices, not one practice’s IT provider ever called to ask about the test, he reports.
The theft side is not confined to healthcare. In Occupational Fraud 2026, the Association of Certified Fraud Examiners’ global study, the median case ran twelve months before anyone detected it, and 43 percent were found through a tip rather than by a control. Organizations with fewer than 100 employees posted the highest median loss of any size band, $126,000.
“Nobody creates the underlying facts. The investigator does not. The payer does not. Looking only reveals what was already there.”
Duane “Tink” Tinker
The authors recommend six concrete steps for practice owners to take this month:
1. Ask your IT provider, in writing, for every person, vendor and tool that can reach your systems from outside the building. Note how many entries are question marks.
2. Turn on multifactor authentication everywhere, starting with email, because whoever controls email can reset nearly every other password.
3. Have the owner receive bank and merchant statements directly, not through the person who reconciles them.
4. Require five consecutive business days away for anyone who handles money. A process only one person can run is one no one else can check.
5. Pull five charts at random and confirm the clinical record supports the claim submitted.
6. Close accounts the day someone leaves, and verify it rather than assume it.
“Most owners are not careless. They are busy. The distance between assuming a practice is protected and knowing it is protected is where the risk lives.“
Monica Cappelli
Cappelli’s revenue integrity chapters extend work she began as a contributing author of the bestselling dental business book The Dental Exit Blueprint, where she wrote Lever 2, Collect More From Insurance, one of thirteen EBITDA levers behind practice valuation. Owners can score their practice across all thirteen with the Dental Exit Readiness Score at dentalexitscore.com.
The book’s eleven questions for evaluating a dental IT provider are posted free at unlockedpractice.com, with no registration required. The Unlocked Practice is available in paperback and Kindle on Amazon.
About Monica Cappelli
Monica Cappelli is a dental practice management and revenue cycle expert with nearly three decades in the industry and founder of Revv Billing Systems, a dental billing firm serving practices nationwide. She created RevvConnect Coaching, RCM Genius and PPO Genius, and is a contributing author of The Dental Exit Blueprint, where she wrote Lever 2, Collect More From Insurance.
About Anthony Jurjevic, CISSP
Anthony Jurjevic is the founder and president of Techspedient, a cybersecurity-first IT company serving dental and healthcare practices nationwide and a Microsoft Advanced Partner. He has spent 25 years in enterprise IT and cybersecurity, the last decade on the systems dental practices run daily, and holds the CISSP, the field’s most widely recognized security certification.
About Duane “Tink” Tinker
Duane Tinker is a dental compliance and risk management consultant and a former Texas Dental Board law enforcement officer who investigated hundreds of cases involving standard of care, infection control, drug diversion and fraud. After 30 years as an EMT, he helps dental organizations protect their patients, teams and licenses through compliance systems, inspections and training.
Catrise Austin
Celebrity Branding, LLC
+1 917-540-5367
Dental Compliance Specialists with Howard Farran and Duane Tinker
Why it matters: The book’s central claim — that security, financial integrity and regulatory compliance converge at the same point of access — reframes how small medical practices should allocate their limited resources. For the broader business community, the lesson is that proactive access audits and basic controls like mandatory time off and direct statement delivery can prevent losses that typically run six figures in small organizations.
