What should a dental IT contract say about passwords and data ownership?
On this page
It should say the practice owns every account, credential, domain and piece of data, and that the provider hands it all over within a set number of days of any request or termination. HHS says a business associate may not block your PHI access, even in a payment dispute (HHS FAQ 2074). Sign it in 2026, before work starts.
Key facts
| Item | What the source says | Source |
|---|---|---|
| Blocking access to PHI in a payment dispute | Impermissible use under the Privacy Rule; violates the Security Rule's availability requirement | HHS FAQ 2074 |
| Covered entity's own duty | Agreeing to BAA terms that keep you from your own PHI puts you out of compliance | HHS FAQ 2074 |
| Required BAA term at termination | Return or destroy PHI, if feasible | HHS sample BAA provisions |
| SLA topics HHS suggests for cloud vendors | Availability, backup and recovery, how data is returned at termination, security responsibility | HHS cloud guidance |
| Credential ownership | "You and you alone have full ownership over your credentials," even if the MSP created the accounts (an MSP's own view) | ITS |
| Emergency admin access | Microsoft recommends two or more emergency access accounts, not tied to any individual | Microsoft Learn |
| Domain name | The registrant assumes sole responsibility for the registration | ICANN |
Why does a dental practice need these clauses at all?
Because the person who installed your systems usually holds the keys, and that's fine until the relationship ends badly. In 2017, CTV News Calgary covered a "digital breakup" between a Calgary dental office and its IT company (CTV News, Feb 2017). The dispute was resolved two months later (CTV News, April 2017). That case is Canadian, but the pattern isn't. An MSP writing about the topic describes the same scenario: a billing dispute, credentials held "hostage," and critical systems locked until the client pays (ITS).
Your practice shouldn't be held hostage by whoever installed it. I run a dental MSP, and I'll say it plainly: a good provider has no reason to resist these clauses. If one does, that tells you what you need to know.
What does HIPAA already say?
More than most practice owners realize. HHS's answer to "May a business associate... block or terminate access" is "No." HHS calls blocking a covered entity's access to PHI to resolve a payment dispute, such as an EHR vendor activating a "kill switch," an impermissible use under the Privacy Rule. It also says it violates the Security Rule, because ePHI must stay available to the covered entity on demand, whether it sits in an EHR, cloud, backup system or database (HHS FAQ 2074).
The same FAQ cuts the other way too. If you agree to BAA terms that stop you from ensuring access to your own PHI, you are out of compliance (HHS FAQ 2074). So read the contract before you sign it.
Two limits to keep in mind. HIPAA protects your patients' data. It doesn't directly cover your firewall password or your domain name. Those depend on your contract. And this is general information, not legal advice. Have a healthcare attorney review the final agreement.
Which clauses should be in the contract?
1. Ownership
The practice owns all data, configurations, documentation, accounts, licenses, domains and credentials created or managed for it, regardless of who created them or who pays the vendor. That matches the position ITS takes: you own your credentials even when the MSP created the accounts (ITS).
2. Owner-held admin access from day one
The practice holds its own administrator access to every critical system at all times, not just on request. For Microsoft 365, that means at least two emergency access accounts with Global Administrator rights. Microsoft says to keep them cloud-only, not tied to any individual, protected with phishing-resistant authentication, stored in secure separate locations, and checked at least every 90 days (Microsoft Learn). The practice should control at least one.
3. Registered in the practice's name
The domain, Microsoft 365 or Google Workspace tenant, PMS license, backup account, firewall license and camera cloud account are registered to the practice, with its billing contact. ICANN treats the registrant as solely responsible for a domain registration (ICANN), so the registrant should be the practice, not the MSP.
4. Turnover on request and at termination
All credentials and documentation are delivered within a fixed number of business days of a written request or termination, for any reason, including a billing dispute. Delivery is through an encrypted channel or secure vault. ITS lists encrypted email and secure password repositories as appropriate methods (ITS).
5. No withholding, no kill switch
The provider may not disable, lock or degrade access to systems or data as leverage. That restates HHS's position for PHI (HHS FAQ 2074) and extends it to everything else in the contract.
6. Data return format
At termination, PHI and backups are returned in a usable format, then destroyed, and the provider certifies it. HHS's sample BAA requires return or destruction at termination (HHS sample BAA). HHS's cloud guidance lists "manner in which data will be returned" as an SLA topic (HHS cloud guidance).
7. Living documentation
The provider keeps an up-to-date network diagram, asset list and credential inventory that the practice can access at any time. CISA recommends network diagrams that show third-party and MSP access, stored with offline backups and hard copies (CISA).
8. Transition assistance
A defined number of hours at a stated rate to help the next provider take over. See switching IT providers.
9. Least privilege and remote access
Vendor accounts are named and individual, use MFA, are limited to the systems in scope, and are removed at termination. CISA recommends least privilege for third parties and MSPs, plus quarterly audits of third-party accounts (CISA).
10. A signed BAA
Required whenever the provider can access ePHI (HHS). Include breach and security-incident reporting timelines. HHS's sample BAA notes parties may set stricter timelines (HHS sample BAA).
To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.
To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.
What if my current contract doesn't say any of this?
Add an amendment at renewal. Ask your provider for a credential and documentation export now, while the relationship is good. ITS advises keeping things civil, keeping communication open and involving your attorney if a dispute escalates (ITS). See can my IT company refuse to give me my passwords? and who owns my dental office passwords?.
How FloorStack helps
FloorStack gives the practice its own BAA-backed credential vault. Credentials are stored per device, and you can grant or revoke access for your MSP, staff or vendors at any time, with every reveal logged (FloorStack). The planned free Credential Ownership Checklist (free tool, coming soon) will turn the clauses above into a step-by-step audit. It's part of the FloorStack dental build-out platform. See the Credential Ownership Checklist or the Own Your Dental Passwords hub.
Free tools on the FloorStack dental build-out platform for this step: FloorStack Studio (live, free plan).
Free tools for this step
- FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
- Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.
Frequently asked questions
Can my IT company hold my passwords until I pay?
For systems holding PHI, HHS says a business associate may not block your access to resolve a payment dispute (HHS). For other accounts, your contract decides, which is why the clauses above matter.
Who should own our Microsoft 365 admin account?
The practice. Microsoft recommends at least two emergency Global Administrator accounts not tied to any individual (Microsoft Learn). The practice should hold at least one.
Who should be the registrant on our domain name?
The practice. ICANN says the registrant assumes sole responsibility for the domain registration (ICANN).
Is a BAA enough to protect us?
No. A BAA covers PHI. It doesn't cover firewall logins, domains or licenses. You need ownership and turnover clauses in the service agreement too.
What's a reasonable turnover deadline?
There's no legal standard. Pick a short, specific number of business days and write it in.
Does this apply to my equipment dealer and phone vendor too?
Yes. Anyone who configures a system you depend on, including the phone system, cameras, imaging server and Wi-Fi, should be covered by the same ownership and turnover terms.
Sources
- HHS FAQ 2074: May a business associate block or terminate access to PHI?
- HHS: Sample Business Associate Agreement Provisions
- HHS: Guidance on HIPAA and Cloud Computing
- HHS: Summary of the HIPAA Security Rule
- Intelligent Technical Solutions (ITS): Can an IT Company Withhold Your Login Credentials?
- CTV News Calgary: Costly consequences for Calgary company after digital breakup (Feb 2017)
- CTV News Calgary: Calgary company resolves digital breakup dispute (April 2017)
- Microsoft Learn: Manage emergency access admin accounts
- ICANN: Registrants' Benefits and Responsibilities
- CISA: #StopRansomware Guide
- FloorStack home page
More in Own Your Dental Passwords
- BAA With Your Dental IT Company: What It Must CoverDoes your dental IT company need a BAA? Yes, if it can access ePHI. What a 2026 BAA must cover under 45 CFR 164.504 and 164.314, plus terms worth adding.5 min read
- Who Owns Your Dental Office Passwords and IT Accounts?Your practice owns its passwords, domain and admin accounts, not the IT company that set them up. See what HIPAA requires in 2026 and how to take inventory.6 min read
- Can Your IT Company Refuse to Give You Your Passwords?An IT company holding your patient data can't lock you out over a billing dispute, HHS says. What to do in 2026 if your dental IT provider withholds access.6 min read
- How to Switch Dental IT Providers Without Losing Access (2026)A 2026 step-by-step plan for switching dental IT providers: inventory, owner admin accounts first, credential handover, BAA data return, and a 30-day checklist.6 min read
- Is Your Dental Equipment Registered to You? How to Check and Fix ItCheck who your dental equipment is registered to in 2026: x-ray state registration, warranty invoices, software licenses and vendor portals, and how to fix it.5 min read
- How to Document a Dental Client's Network and DevicesA 2026 MSP guide to documenting a dental client's network: asset inventory fields, network map, credentials, vendor access and a handover-ready format.6 min read