How should I document a dental client's network?
On this page
- Key facts
- Why does documentation matter more in dental than elsewhere?
- What goes in the asset inventory?
- What should the network map show?
- How should credentials be documented?
- What about vendors and outside access?
- How often should it be updated?
- Which free tools help with this?
- How FloorStack helps
- Free tools for this step
- Frequently asked questions
- Sources
Document it as if the practice will hand it to another IT company tomorrow: an asset inventory, a network map, a credential register owned by the practice, and a vendor-access list. HHS 405(d) lists 11 inventory fields per device (HICP Technical Volume 1), and in 2026 that is the baseline.
Key facts
| Item | What the source says | Source |
|---|---|---|
| Inventory fields per device | Asset ID, host name, purchase order, OS, MAC, IP, deployed to, last user, purchase date, cost, physical location | HICP Technical Volume 1 |
| Spreadsheet acceptable | A "well-designed spreadsheet" can hold the inventory for a small organization | HICP Technical Volume 1 |
| Don't key on IP or MAC | Using host name, IP or MAC as the unique ID is not recommended because they change | HICP Technical Volume 1 |
| Network diagrams | Keep comprehensive, regularly updated diagrams of systems and data flows | CISA #StopRansomware Guide |
| Proposed HIPAA change | The 2025 NPRM would require a written technology asset inventory and network map | Federal Register |
| Status of that proposal | Not final; final action listed for July 2027 | Reginfo.gov |
| Contract ownership of roles | MSP-customer contracts should "transparently identify ownership of ICT security roles and responsibilities" | CISA AA22-131A |
Why does documentation matter more in dental than elsewhere?
A dental office packs a lot of specialized gear into a small network: chairside workstations, X-ray sensors, a pano or CBCT, an intraoral scanner, an imaging server, VoIP phones, cameras and guest Wi-Fi. Each has its own vendor, driver and login. When the documentation lives only in one technician's head, the practice is one resignation away from a crisis.
NIST's Cybersecurity Framework 2.0 lists documentation as basic hygiene, not a premium service. Its Asset Management outcomes include inventories of hardware (ID.AM-01), inventories of software, services and systems (ID.AM-02), representations of authorized network communication and data flows (ID.AM-03), and inventories of supplier services (ID.AM-04) (NIST CSWP 29). For a dental client, those four map neatly onto four documents.
What goes in the asset inventory?
Start with the 11 fields HHS 405(d) lists, then add the dental-specific ones that matter when something breaks or the practice is sold.
| Field | Why it matters in a dental office |
|---|---|
| Asset tag (unique ID) | HHS advises a tag, not IP or MAC, as the primary key (HICP Technical Volume 1) |
| Room and position | "Op 3, assistant side" saves an hour on every service call |
| Make, model, serial | Needed for warranty claims and recalls |
| OS and version | Dentrix, for example, publishes supported Windows versions (Henry Schein One) |
| IP, VLAN, switch port | Ties the device to the network map |
| Connected clinical devices | Which sensor, camera or scanner plugs into this PC |
| Warranty end and support end | Drives the replacement plan |
| Registered owner | Should be the practice, not the MSP |
| Credential reference | A pointer to the vault entry, never the password itself |
Include everything, not just PCs. HHS says the inventory should cover workstations, laptops, servers, portable drives, mobile devices, tablets, printers, medical devices, routers, access points, firewalls, software applications and smartphones (HICP Technical Volume 1). Our free equipment inventory CSV (free download, coming soon) and the inventory template guide follow that structure.
What should the network map show?
CISA recommends developing and regularly updating network diagrams that describe systems and data flows, because they help incident responders know where to focus (CISA). For a dental office, draw it on the floor plan, not as an abstract cloud diagram:
- Internet circuits, failover and the firewall.
- Every switch, with port-to-room mapping.
- VLANs or segments: clinical, imaging, phones, cameras, guest. HHS 405(d) recommends placing IoT items such as cameras in more restricted zones (HICP Technical Volume 1).
- Where ePHI lives and moves: PMS server or cloud PMS, imaging database, backups, email.
- Every remote-access path, including vendor support tools.
The 2025 HIPAA Security Rule proposal would make this explicit. It proposes a standard requiring an accurate, written technology asset inventory and a network map showing the movement of ePHI through, into and out of information systems (Federal Register). It isn't law yet; the Unified Agenda lists final action for July 2027 (Reginfo.gov). Documenting to it now costs little and makes the practice's required risk analysis easier (45 CFR 164.308). See network design for the segmentation itself.
How should credentials be documented?
As a register the practice owns, not a spreadsheet the MSP keeps. Record each system, its admin account, who has access and when it was last rotated, with the secret itself in a vault. Microsoft recommends at least two emergency access accounts for Microsoft 365, not tied to any individual, and validating them at least every 90 days (Microsoft Learn). The practice should hold at least one. For the full approach, see sharing credentials with dental clients and who owns dental office passwords.
What about vendors and outside access?
List every supplier service: PMS vendor, imaging support, cloud backup, phone provider, camera cloud, equipment dealer. CISA and partner agencies tell MSP customers to identify and disable accounts that are no longer in use and to enforce MFA on MSP accounts (CISA AA22-131A). HHS 405(d) adds that third parties should reach only the networks their role requires, through tightly controlled interfaces (HICP Technical Volume 1). Note which vendors have a signed BAA; see BAA with your dental IT company.
How often should it be updated?
On every change, plus a scheduled review. HHS 405(d) says to record each new asset at procurement and record each decommissioning, including any certificate of destruction (HICP Technical Volume 1). Store a copy offline: CISA recommends keeping network diagrams with offline backups and hard copies (CISA).
Which free tools help with this?
FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ). The network & IT plan generator (free tool, coming soon) is planned to turn a floor plan into a network, drop and rack plan. The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. The equipment inventory & appraisal report (free tool, coming soon) is planned to turn your equipment list into an appraisal-ready report.
How FloorStack helps
FloorStack is a dental build-out platform that keeps this documentation on the practice's real floor plan. Studio (live, free to start) places every computer, camera, Wi-Fi point and drop by room, and paid plans add a live inventory with specs, serials and warranty dates per device (FloorStack). Logins are vaulted per device, and the practice can grant or revoke your MSP access at any time, with every view logged (FloorStack). The free Network & IT plan generator (coming soon) will turn a floor plan into a starting network map, the free Credential ownership checklist (coming soon) will audit who holds which keys, and the free Equipment inventory & appraisal report (coming soon) will format the asset list for warranties and sale. Visit the Own Your Dental Passwords hub. Also use the Free equipment inventory CSV (free download, coming soon).
Free tools for this step
- Studio: map every device on the floor plan (live).
- Network & IT plan generator: starting network map and drop schedule (free tool, coming soon).
- Credential ownership checklist: who holds each admin login (free tool, coming soon).
- Equipment inventory & appraisal report: inventory formatted for warranty and sale (free tool, coming soon).
- Free equipment inventory CSV (free download, coming soon): spreadsheet version of the fields above.
Frequently asked questions
Is a spreadsheet good enough for a dental office inventory?
For a small practice, yes. HHS 405(d) says a well-designed spreadsheet can hold the inventory (HICP Technical Volume 1). What matters is that it's complete, current and owned by the practice.
Does HIPAA require a network map today?
Not by name. The current rule requires an accurate risk analysis (45 CFR 164.308). The 2025 proposal would require a written network map, but final action is listed for July 2027 (Reginfo.gov).
Should passwords go in the network documentation?
No. Keep a pointer to a vault entry in the documentation and store the secret in a vault the practice controls.
What unique ID should each device use?
An asset tag. HHS 405(d) advises against using host name, IP or MAC as the unique ID because they can change (HICP Technical Volume 1).
Who owns the documentation, the MSP or the practice?
The practice. Write it into the contract; see dental IT contract clauses.
Where should the offline copy live?
Somewhere that survives a ransomware event, such as with offline backups and a printed copy, as CISA recommends (CISA).
Sources
- FloorStack: Frequently asked questions
- HHS 405(d): HICP Technical Volume 1, Small Health Care Organizations (PDF)
- CISA: #StopRansomware Guide
- CISA et al., Advisory AA22-131A: Protecting Against Cyber Threats to MSPs and their Customers
- NIST CSWP 29: The NIST Cybersecurity Framework 2.0 (PDF)
- Federal Register: HIPAA Security Rule NPRM, Jan 6, 2025
- Reginfo.gov: RIN 0945-AA22, Unified Agenda entry
- 45 CFR 164.308, Administrative safeguards (LII)
- Microsoft Learn: Manage emergency access admin accounts
- Henry Schein One: Dentrix System Requirements (PDF)
- FloorStack home page
More in Own Your Dental Passwords
- Sharing Credentials With Dental Clients: Owner-Controlled AccessHow an MSP should share credentials with a dental client in 2026: practice-owned vault, named accounts, MFA, emergency admin access and logged handoffs.5 min read
- Taking Over a Dental Client From Another MSP: Credential Handoff PlanA 2026 credential handoff plan for MSPs taking over a dental client: owner-led requests, domain, Microsoft 365, firewall, backups, BAAs and old-MSP offboarding.5 min read
- Dental IT Contract Clauses: Own Your Passwords and Data (2026)What a dental IT contract should say in 2026 about passwords, admin accounts, data return and offboarding, so your practice is never held hostage.6 min read
- BAA With Your Dental IT Company: What It Must CoverDoes your dental IT company need a BAA? Yes, if it can access ePHI. What a 2026 BAA must cover under 45 CFR 164.504 and 164.314, plus terms worth adding.5 min read
- Who Owns Your Dental Office Passwords and IT Accounts?Your practice owns its passwords, domain and admin accounts, not the IT company that set them up. See what HIPAA requires in 2026 and how to take inventory.6 min read
- Can Your IT Company Refuse to Give You Your Passwords?An IT company holding your patient data can't lock you out over a billing dispute, HHS says. What to do in 2026 if your dental IT provider withholds access.6 min read