How to Back Up Dentrix the Right Way in 2026

Why can't I just copy the Dentrix folder?

Because Dentrix is a live database application, and copying its files while it's running gives you a backup that may not restore. Dentrix stores your practice in a live database that is constantly written to as staff add charts, post payments, and adjust the schedule. Grab those files mid-write and you capture a half-finished transaction. The result is the digital equivalent of photographing a moving car: technically an image, practically useless.

This is the single most common mistake we see, so it gets its own box.

Backing up the folder ≠ backing up Dentrix

Copying the Dentrix data folder while the database is in use produces an inconsistent, often corrupt backup that fails when you actually need it. A real Dentrix backup requires an application-consistent capture — the database is captured in a way that keeps every record consistent with the same moment in time. Then you need that consistent copy stored off-site and immutable, so ransomware on your network can't reach it.

What does Dentrix actually store that I have to protect?

Everything that makes your practice a practice — and it's more than one folder. A complete Dentrix backup has to cover the live clinical and financial record plus the linked media that the database points to but doesn't contain.

What it is	Why it's critical
Practice-management database	The core record tying every patient, appointment, and transaction together.
Patient charts & clinical notes	Treatment history, diagnoses, perio, and progress notes — your medical-legal record.
Schedule / appointment book	Who's coming in and when; losing it stops the practice cold.
Ledgers & financials	Production, payments, insurance claims, A/R. Rebuilding these by hand is brutal.
Linked imaging & documents	X-rays, photos, scanned forms, and signed consents, which can live outside the core database and are worthless without the records that reference them.

If your backup captures the database but skips imaging — or vice versa — you don't have a recoverable practice. You have two incomplete halves.

Why does the backup have to leave the building?

Because a backup sitting on your own network gets encrypted right alongside production. Modern ransomware specifically hunts for connected backups before it triggers. In January 2026, Tampa Bay Dental Implants & Periodontics in Florida identified a ransomware incident affecting an internal legacy server, which the practice said held a backup of its electronic medical records; HHS lists 6,400 individuals (HHS breach portal, HIPAA Journal). An on-site-only backup is a single blast radius.

The contrast is just as instructive. True Dental Care for Kids and Adults, a Pennsylvania practice, disclosed in April 2025 that an unauthorized party had encrypted its data around February 3, 2025, and said it did not pay; HIPAA Journal reported that 17,640 individuals were notified and that files were restored from backups (HIPAA Journal). The difference between paying and recovering usually comes down to whether a clean, separated copy survived.

That's why the rule is at least one off-site copy and at least one immutable copy. Immutable means write-once: even an attacker with admin credentials cannot alter or delete the recovery point during its retention window. We go deeper on this failure mode in why your dental backup got encrypted too.

How often should Dentrix be backed up?

Often enough that a failure costs you minutes of data, not days — which in a busy practice means continuous or near-continuous capture, not a nightly file dump. Every appointment booked, payment posted, and note written between backups is data you'd re-enter by hand after a loss. The principle holds regardless of vendor: tighten the gap between backups and you shrink the size of any disaster.

The stakes here aren't abstract. Comparitech counted 636 ransomware attacks on the healthcare sector in 2025, 445 on care providers and 191 on healthcare businesses; attacks on providers were flat from 2024 (437), while attacks on healthcare businesses rose 25% (Comparitech). In US healthcare, ransomware downtime averaged over 17 days per attack (Comparitech), and Sophos's 2025 survey put the mean recovery cost at about $1.02 million (Sophos). Paying does not guarantee recovery: in Sophos's 2021 survey of mid-sized organizations, only 8% of those that paid got back all of their encrypted data, and they recovered about 65% of it on average (Sophos). Paying is not a recovery plan.

What does a correct Dentrix backup actually look like?

It's a layered system, not a single copy. A backup you can trust in 2026 has four properties:

1. Application-consistent — the database is quiesced or VSS-snapshotted so every record is captured at one coherent moment.
2. Complete — the PMS database and imaging/linked documents, together.
3. Off-site — at least one copy lives on a separate network the ransomware can't traverse.
4. Immutable — at least one write-once recovery point that can't be altered or deleted.

Layered on top: encryption in transit and at rest, retention long enough to survive a slow-burn attack, a signed HIPAA Business Associate Agreement, and — most important — regularly tested restores. A backup you've never restored is a hypothesis, not a safeguard.

This is the approach DDSArk takes: the Dentrix data and imaging backed up together, encrypted before upload, and kept as immutable recovery points off-site, run by your practice or your IT partner. If the worst happens, walk the dental ransomware recovery playbook, and to pressure-test your current setup before you need it, run the HIPAA backup audit self-check.