Can my IT company refuse to give me my passwords?

Key facts

Is withholding passwords actually illegal?

It depends on what is being withheld and who is withholding it. Be precise, because precision is leverage.

If the IT company maintains patient data for you, such as hosting your server, running your backups or managing a cloud system, it is a business associate under HIPAA. HHS's cloud guidance says that holds even when the vendor stores only encrypted data and has no key (HHS). For business associates, HHS is direct: blocking or terminating your access to the PHI it maintains is an impermissible use under the Privacy Rule, and denying access violates the Security Rule's availability requirement (HHS OCR FAQ 2074). HHS's own example is a vendor using a "kill switch" to resolve a payment dispute.

If the dispute is over network passwords alone, such as the firewall or Wi-Fi admin login, HIPAA may not address it as squarely, and your contract and state law carry more weight. Even then, IT firms writing on the question say the credentials are yours and should be provided when requested, regardless of how the relationship ends (ITS).

None of this cancels a legitimate unpaid invoice. A provider can pursue payment; HHS's position is that it cannot use your patients' data as the collection tool. This article is general information, not legal advice.

To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.

Has this happened to dental practices?

Yes. In 2017 CTV News Calgary reported on a "digital breakup" in which a Calgary business and its former IT provider fought over access to its systems (CTV News, Feb. 2017); a follow-up that April, captioned with a dentist reviewing X-rays in her office, reported the dispute resolved (CTV News, Apr. 2017). Both reports are video-based and Canadian, so HIPAA did not apply; we cite them only to show the pattern is real.

What should I do first if my IT company won't hand over access?

Work from least to most adversarial, and document everything.

1. Stay civil and keep talking. De-escalation resolves most disputes, and silence can push a vendor to "drive a point home" (ITS).
2. Put the request in writing. List every system you need access to (see the inventory in Who owns my dental office passwords?), ask for a secure handover, and set a reasonable date.
3. Pull your contracts. Read the service agreement and the business associate agreement. HHS notes BAAs must require return or destruction of PHI at termination where feasible (HHS). If you have no BAA with a vendor that stores your ePHI, that is a compliance gap on both sides (HHS).
4. Cite the guidance. A short letter referencing HHS OCR FAQ 2074 often changes the conversation.
5. Call your attorney. Counsel can review the agreements and your options (ITS).
6. Know the escalation path. OCR accepts complaints against covered entities and their business associates, and anyone can file (HHS).

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

Can I get access back without the IT company?

Often, for many systems, though it takes time.

• Software you license (practice management, imaging, Microsoft 365 or Google Workspace) usually has an account-owner verification path with the vendor. Expect to prove you are the licensee.
• Your domain is controlled by the registrant of record. ICANN directs registrants to their registrar for registrant changes (ICANN).
• Network hardware you own can typically be factory-reset and reconfigured by a new provider, at the cost of downtime and rebuilt settings.
• Backups are the hard case. If backups are encrypted and the provider holds the only key, plan your new backup first so patient data is protected while the old one is sorted out. See how to back up patient data.

How do I safely receive passwords once they agree?

Not by plain email or text. ITS recommends encrypted email or a secure password repository, with the master key delivered separately (ITS). Then change every handed-over password, remove the old provider's named accounts and confirm multi-factor authentication points to your devices. CISA's first recommendation for MSP customers is to identify and disable accounts no longer in use (CISA).

How do I make sure this never happens again?

• Hold your own master admin on every system; give providers their own named, revocable accounts.
• Write ownership and handover terms into the contract. CISA advises that MSP contracts transparently identify ownership of security roles and responsibilities (CISA). See what a dental IT contract should say about passwords and data.
• Plan transitions on your schedule. See how to switch dental IT providers without losing access.

Your practice shouldn't be held hostage by whoever installed it.

How FloorStack helps

FloorStack is a dental build-out platform that keeps your practice's technology documented from day one. Our free IT Credential Ownership Checklist (coming soon at /tools/credential-ownership-checklist) will show which logins you hold and which you don't. As described on the FloorStack homepage, FloorStack stores each login with its device in a BAA-backed vault, and you can grant or revoke access for your MSP, staff or vendors anytime, so the next handover is a click, not a standoff. Visit the Own Your Dental Passwords hub.

Free tools on the FloorStack dental build-out platform for this step: FloorStack Studio (live, free plan).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.