Guide hub · 9 guides
Dental Office Password Management: Own Your Passwords, Accounts and Data
On this page
Dental office password management starts with ownership: your practice owns its passwords, domain and admin accounts, and in 2026 HIPAA makes your practice responsible for the availability of its own patient data (HHS OCR FAQ 2074). A vendor can't block that access over a payment dispute (HHS OCR FAQ 2074). This hub links 9 guides.
What is FloorStack? FloorStack is the dental build-out platform where doctors, contractors, architects, equipment reps and IT teams plan, build and document a dental practice together in live 3D, and the doctor owns every device, password and record when the doors open.
Key facts
| Item | Figure | Source |
|---|---|---|
| Who is responsible for data availability | The covered entity (your practice) is responsible for ensuring the availability of its own PHI | HHS OCR FAQ 2074 |
| Can a vendor holding your data block your access? | No; blocking a covered entity's access, for example over a payment dispute, is an impermissible use of PHI | HHS OCR FAQ 2074 |
| Credential ownership | "You and you alone have full ownership over your credentials," even if the MSP created the accounts (an MSP's own view) | ITS |
| Emergency access procedure | Required implementation specification | 45 CFR 164.312(a)(2)(ii) |
| MSPs named | "IT contractor or vendor (e.g., EHR vendor, Managed Services Provider)" supporting systems with ePHI is a business associate | HHS |
| Required BAA term at termination | Return or destroy PHI, if feasible | HHS sample BAA provisions |
| Breach reporting | Without unreasonable delay, no later than 60 calendar days after discovery | 45 CFR 164.410 |
| Audit admin accounts | Quarterly; prioritize remote monitoring and MSP access | CISA #StopRansomware Guide |
| Emergency admin accounts | At least two; validate at least every 90 days | Microsoft Learn |
| Domain name | The registrant assumes sole responsibility for the registration | ICANN |
Who this hub is for
- Doctors and practice owners: start with who owns your passwords, then read the BAA and IT contract guides before you sign or renew with an IT provider.
- Doctors in a dispute with an IT company: go straight to what to do when an IT company withholds passwords, then the guide to switching providers.
- Incoming MSPs: use the credential handoff plan and the client network documentation guide.
- IT providers who want to stand out: read the owner-controlled credential sharing guide; handing doctors control is a selling point.
- Office managers: use the equipment registration guide to check that devices and warranties are in the practice's name.
What "your passwords" actually covers
When this hub says passwords, it means every account the practice depends on, not only the ones staff type in each morning:
- Identity and email: the domain registration, DNS, and the email and productivity admin accounts. ICANN treats the registrant as solely responsible for a domain (ICANN), so the registrant should be the practice.
- Network: firewall, switches, Wi-Fi controllers and the internet service account.
- Clinical software: practice management, imaging and cloud backup admin logins.
- Devices and vendors: equipment portals, warranty registrations, phone system and camera admin accounts.
- Break-glass access: at least two emergency admin accounts not tied to any one person, checked at least every 90 days (Microsoft Learn).
The rules in plain English
HIPAA puts the duty on the practice: you must be able to reach your own patient data, and HIPAA requires an emergency access procedure (45 CFR 164.312). An IT company or managed service provider that supports systems with patient data is a business associate (HHS), so it needs a business associate agreement. That agreement must provide for returning or destroying PHI at termination where feasible (HHS sample BAA provisions), and HHS says a business associate may not block your access to PHI over a payment dispute (HHS OCR FAQ 2074). None of this means you should run IT yourself. It means the practice holds the keys and grants access to whoever does the work.
Every guide in the Own Your Dental Passwords hub
This hub links all 9 guides in the Own Your Dental Passwords pillar, grouped by stage and by who uses them.
For doctors: know what you own
Start here if you are not sure who holds your logins.
- Who Owns Your Dental Office Passwords and IT Accounts?: which passwords, domains and admin accounts belong to the practice, and how to take inventory.
- Can Your IT Company Refuse to Give You Your Passwords?: what to do when an IT company won't hand over your passwords.
- Dental IT Contract Clauses: Own Your Passwords and Data (2026): IT contract clauses that keep your passwords and data yours.
- BAA With Your Dental IT Company: What It Must Cover: what a business associate agreement with your IT company must cover.
Changing IT providers
Switch without losing access.
- How to Switch Dental IT Providers Without Losing Access (2026): switching IT providers without losing access to anything.
- Taking Over a Dental Client From Another MSP: Credential Handoff Plan: for incoming MSPs: a credential handoff plan when taking over a client.
Equipment registrations
Devices and warranties should be in the owner's name too.
- Is Your Dental Equipment Registered to You? How to Check and Fix It: checking that equipment is registered to you, and fixing it if not.
For IT providers: document and share
Make the handoff easy before anyone asks.
- How to Document a Dental Client's Network and Devices: for MSPs: documenting a client's network and devices.
- Sharing Credentials With Dental Clients: Owner-Controlled Access: for MSPs: owner-controlled credential sharing.
Related hubs and guides
- Dental Office IT Setup hub: set up the network so ownership is clear from day one.
- HIPAA IT Checklist for Opening a Dental Office: the HIPAA items that go with credential ownership.
- Dental Equipment Inventory hub: serials, warranties and documentation for every device.
- Handing Over Equipment Docs and Credentials to the Doctor: what dealers and IT should hand over at opening.
- Technology Audit Before Buying a Dental Practice: check credential ownership before you buy a practice.
Free tools for this hub
Start with the Credential ownership checklist
The Credential ownership checklist (free tool, coming soon) is the anchor tool for this hub. It is planned to list every admin account the practice should own, flag the ones held by someone else, and include a "password hostage" letter template you can adapt with your attorney. Until it launches, the inventory steps in who owns your dental office passwords cover the same ground.
Other free tools for this stage
- FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
- Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
- Equipment inventory & appraisal report (free tool, coming soon): build an equipment inventory with warranties and an appraisal-ready report.
- Free equipment inventory CSV (free download, coming soon): a spreadsheet template for serials, warranties, service dates and owner-of-record.
How FloorStack helps
Credential ownership is the core of what makes FloorStack different. As described on the FloorStack homepage, FloorStack keeps each login with its device in a BAA-backed vault and lets you grant or revoke access for your MSP, staff or vendors at any time. FloorStack Studio is live today on a free plan. You upload a floor plan or a phone photo, and in about 10 minutes it returns an interactive view with every device placed, a device schedule with rooms, ports and cable lengths, and a rack layout; it is vendor-neutral, suggests up to 3 alternatives per device and never asks for patient data (FloorStack FAQ).
Frequently asked questions
Who owns my dental office passwords?
Your practice does, even when an IT company created the accounts (ITS). See who owns your dental office passwords.
Can my IT company refuse to give me my passwords?
For systems holding patient data, HHS says a business associate may not block your access to PHI, even in a payment dispute (HHS OCR FAQ 2074). See can your IT company refuse.
Does my IT company need a BAA?
Yes, if it supports systems with ePHI; HHS names managed service providers as business associates (HHS). Required contents are set out in 45 CFR 164.504(e). See BAA with your dental IT company.
How do I switch dental IT providers without losing access?
Inventory every account first, move admin rights to practice-owned accounts, then remove the old provider. CISA recommends auditing admin accounts quarterly with priority on MSP access (CISA). See how to switch dental IT providers.
Who owns my practice's domain name?
The registrant, who ICANN says assumes sole responsibility for the registration (ICANN). Make sure that is the practice, not the IT company or web designer.
Do I have to manage IT myself to own my passwords?
No. Owning the credentials means the practice holds the admin keys and grants access; your IT provider still does the work. See the owner-controlled credential sharing guide.
What should my IT contract say about ownership?
That the practice owns all credentials, data and documentation, and that they are handed over on termination. See dental IT contract clauses.
Sources
All 9 guides in Own Your Dental Passwords
- How to Document a Dental Client's Network and DevicesA 2026 MSP guide to documenting a dental client's network: asset inventory fields, network map, credentials, vendor access and a handover-ready format.6 min read
- Sharing Credentials With Dental Clients: Owner-Controlled AccessHow an MSP should share credentials with a dental client in 2026: practice-owned vault, named accounts, MFA, emergency admin access and logged handoffs.5 min read
- Taking Over a Dental Client From Another MSP: Credential Handoff PlanA 2026 credential handoff plan for MSPs taking over a dental client: owner-led requests, domain, Microsoft 365, firewall, backups, BAAs and old-MSP offboarding.5 min read
- Dental IT Contract Clauses: Own Your Passwords and Data (2026)What a dental IT contract should say in 2026 about passwords, admin accounts, data return and offboarding, so your practice is never held hostage.6 min read
- BAA With Your Dental IT Company: What It Must CoverDoes your dental IT company need a BAA? Yes, if it can access ePHI. What a 2026 BAA must cover under 45 CFR 164.504 and 164.314, plus terms worth adding.5 min read
- Who Owns Your Dental Office Passwords and IT Accounts?Your practice owns its passwords, domain and admin accounts, not the IT company that set them up. See what HIPAA requires in 2026 and how to take inventory.6 min read
- Can Your IT Company Refuse to Give You Your Passwords?An IT company holding your patient data can't lock you out over a billing dispute, HHS says. What to do in 2026 if your dental IT provider withholds access.6 min read
- How to Switch Dental IT Providers Without Losing Access (2026)A 2026 step-by-step plan for switching dental IT providers: inventory, owner admin accounts first, credential handover, BAA data return, and a 30-day checklist.6 min read
- Is Your Dental Equipment Registered to You? How to Check and Fix ItCheck who your dental equipment is registered to in 2026: x-ray state registration, warranty invoices, software licenses and vendor portals, and how to fix it.5 min read