How do I audit the tech in a practice before buying?

Key facts

Why audit technology separately from equipment?

Because technology fails differently. A chair wears out slowly; a server loses security updates on a fixed date. Jaffe Law's buyer due-diligence list calls out practice management software licensing and IT infrastructure and cybersecurity status as their own items (Jaffe Law). After closing, you inherit any unsupported systems, missing backups, and vendor contracts. If the seller's IT company holds every password, you inherit that too.

Step 1: Inventory every device

List workstations, server, firewall, switches, Wi-Fi, phones, printers, cameras, imaging PCs and sensors, with make, model, serial, location and operating system. HHS's guidance for small healthcare organizations says IT asset management should cover endpoints, servers, network equipment and cloud applications, and a well-designed spreadsheet can hold it (HHS 405(d) HICP). Use the equipment inventory template.

Step 2: Check support dates

Anything past its support date is a replacement cost you should price into the deal. See sensor and PMS compatibility.

Step 3: Test the backups

Don't accept "we back up nightly." Ask for the backup report, where copies are stored, whether one copy is offline or immutable, and the date of the last successful test restore. Then watch a restore. More in dental practice data backup.

Step 4: Confirm who controls the logins

List every admin account: domain and email, PMS, imaging, firewall, Wi-Fi, phone system, cameras, backup console, and the domain registrar. For each, record who holds it today. If it's the seller's IT company, the purchase agreement should require transfer at closing. See switching IT providers.

Step 5: Read the licenses and contracts

• Software licenses. Do they transfer to a new owner? Is the PMS on a subscription in the seller's name? (Jaffe Law)
• IT services contract. Term, termination notice, and what the vendor must hand over on exit.
• BAAs. An IT contractor such as an MSP that supports systems with ePHI is a business associate under HIPAA (HHS). Ask for each vendor's BAA; you'll need your own after closing. See BAAs with your IT company.
• Internet, phone and cloud contracts. Who's the account holder, and what are the early termination terms?

Step 6: Review security posture

Ask for the latest HIPAA security risk analysis, any incident history, and whether staff use multifactor authentication on email and remote access. Check the firewall model's support status against CISA's warning on EOS edge devices (CISA). Compare what you find with the HIPAA IT checklist.

Questions to ask the seller's IT company

Get the seller's written permission first, then ask:

1. Can you send a current device list with operating systems and warranty dates?
2. Which systems are past or near end of support, and what did you recommend?
3. Where are backups stored, and when was the last test restore?
4. Which admin accounts do you hold, and which does the practice hold?
5. Is the domain registered to the practice or to you?
6. What's in your contract about handing over documentation and credentials when the practice changes hands?
7. Do you have a signed BAA with the practice, and when was the last risk analysis done?
8. Have there been any security incidents in the past three years?

Vague answers tell you as much as complete ones. A provider who can't produce a device list in a few days probably doesn't have one, and you'll be building it yourself after closing.

What does it cost to fix what I find?

Price each gap: workstation replacements, a server migration or move to cloud, a new firewall, backup setup, and onboarding a new IT provider. That number belongs in the negotiation, not in your first year's surprises.

Which free tools help with this?

The equipment inventory & appraisal report (free tool, coming soon) is planned to turn your equipment list into an appraisal-ready report. The free equipment inventory CSV (coming soon) will give you the columns to start the list in a spreadsheet. The device compatibility checker (free tool, coming soon) is planned to check sensors, imaging units and bridges against your practice software. The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. The network & IT plan generator (free tool, coming soon) is planned to turn a floor plan into a network, drop and rack plan. FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ).

How FloorStack helps

FloorStack is a dental build-out platform that makes a practice's technology visible. The free Equipment inventory & appraisal prep tool (coming soon) will organize devices with age and support status. The free Compatibility checker (coming soon) will flag sensors, imaging and PMS that won't work together. The free Credential ownership checklist (coming soon) lists every login to collect at closing. The free IT & network plan generator (coming soon) outlines the network you'll need after takeover. Studio (live, free to start) maps every device on the floor plan; Shared Stack ($79/mo, billed yearly) adds a credential vault per device with expiring vendor access, an audit log and a BAA included (FloorStack). Start with the inventory template (CSV). See the Dental Practice Appraisal hub.

Free tools for this step

• Equipment inventory & appraisal prep tool: devices, age and support status (free tool, coming soon).
• Dental equipment inventory template (CSV) (free download, coming soon): the device list.
• Compatibility checker: sensors, imaging and PMS (free tool, coming soon).
• Credential ownership checklist: logins to collect at closing (free tool, coming soon).
• IT & network plan generator: your post-closing network (free tool, coming soon).
• Studio: map every device on the floor plan (live).