Dentist is responsible for fixing teeth, if it does not involve teeth and they dont know about it, they are fine for not knowing

HIPAA doesn't have that kind of teeth(pun intended). It just guarantees that someone at the practice claims to be responsible for the safekeeping of your protected health information (PHI). They have to report data breaches in a timely fashion. They have to protect your data with "best practices," and have plans in place to do so. It's so loosely worded; there's no requirement that all their vendors claim to be compliant. Certainly, it's easier for them to use vendors that support the alphabet soup if it comes to court, but their compliance is not hinged upon it. A few years ago, they added some specifics on encryption at rest and encryption in transit.

All they have to "prove" is that they've done a reasonably good job protecting your data and are following a couple of NIST guidelines for encryption. Certainly, half the vendors are small companies use are not doing a good job behind the scenes. They probably have people VPNing from home, using personal machines, perhaps in public places. It's very easy to say you are HIPAA compliant when providing services to a larger company because those same toothless pinky-swear best-practice rules apply to them as well.

Before I'd worry about their artifact repository vendor, who's probably at least somewhat responsible, I'd worry about their remote IT support service. Or the backups they're using, or that they properly decommission and dispose of their hardware, or that they have sufficient antivirus and anti-malware protection to stop ransomware. Dental offices make great ransomware targets.

If their vendor is using AI, chances are they're doing it the right way. They take the x-rays the software consumes the x-rays tells them with a decent likelihood whether you actually need dental work in a specific spot. The dentist comes back and checks out the spot, confirms or denies and trains the algorithm a little bit. It's not a repository of identified people's teeth they're building up, It's a repository of unidentified images getting labeled with diagnostic issues. PHI is not PHI without the I. It might even grease the insurance process. How do you know Mr Smith needed a root canal? 14 years of experience and the software flagged it as well.

I've never met a dentist that was not a decision-maker in their practice.