How do I share credentials with a dental client securely?

Key facts

Why is "just email them the passwords" the wrong answer?

Because the problem isn't delivery. It's control. A list emailed once is stale the next time you rotate a password, sits in two mailboxes forever and gives the practice no idea who used what. The question a dental owner actually asks is "can I get in without you, and can I see what you did?" Design for that.

I run a dental MSP, and my view is simple: the practice owns the keys; we borrow them. That stance also matches HHS. HHS says a business associate may not block a covered entity's access to PHI, even to resolve a payment dispute (HHS FAQ 2074). Credentials are how that access happens.

What does owner-controlled access look like?

Five layers, from the most important down.

1. A vault the practice owns

The vault account, billing and top-level admin belong to the practice. Your firm is a guest with scoped access. NIST's digital identity guidelines require verifiers to allow password managers (NIST SP 800-63B-4), and CISA recommends them for long, random, unique passwords (CISA). Organize entries by device and room, so "firewall," "imaging server" and "Op 2 workstation" each have their own record.

2. Named accounts, not shared ones

Each technician gets their own login to the firewall, server and Microsoft 365, with MFA. CISA and partner agencies tell MSP customers to enforce MFA on MSP accounts that access the customer environment (CISA AA22-131A). Named accounts are also how you satisfy HIPAA's unique user identification requirement (45 CFR 164.312).

3. Emergency access the practice holds

For Microsoft 365, Microsoft recommends two or more emergency access accounts, cloud-only, not tied to any individual, protected with phishing-resistant authentication, stored in separate secure locations and validated at least every 90 days (Microsoft Learn). The doctor or office manager should control at least one. Do the same for the firewall and domain registrar: one owner-held admin that you don't use day to day.

4. Least-privilege partner access

Use the platform's delegated model where it exists. Microsoft's GDAP lets partners configure "granular and time-bound" access, and customers must explicitly grant it (Microsoft Learn). The customer can remove partner admin roles at any time from Partner relationships (Microsoft Learn). Tell the practice that, in writing.

5. Logged reveals and rotation on change

Every time someone views a password, it should be logged. Rotate when people leave or on evidence of compromise, not on a calendar: NIST says verifiers shall not require periodic password changes but shall force a change if there's evidence of compromise (NIST SP 800-63B-4). HIPAA's workforce security standard includes termination procedures for ending access when someone leaves, an addressable specification (45 CFR 164.308).

Which credentials should be in the vault?

Defaults go first: CISA lists changing default passwords among baseline steps (CISA). For a full audit, see who owns dental office passwords.

What about the one-time handoff at go-live or offboarding?

Hand over vault ownership, not a document. If you must deliver a static export, encrypt it, send the passphrase by a separate channel and delete your copy once the practice confirms. Then walk the owner through logging in to each critical system with their own account, while you're on the call. The steps for a full transition are in switching dental IT providers and taking over a client from another MSP.

Which free tools help with this?

The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ).

How FloorStack helps

FloorStack is a dental build-out platform with a credential vault built for this model. Logins are stored with the device they open, encrypted, revealed only to the people the practice chooses, and every view is logged; the practice can grant, limit or revoke MSP and vendor access, including expiring vendor access (FloorStack). The vault and a signed BAA come with the Shared Stack plan (FloorStack). Start by mapping devices in Studio (live, free to start), then run the free Credential ownership checklist (coming soon), which includes a "password hostage" letter template for practices whose current provider won't cooperate. Visit the Own Your Dental Passwords hub.

Free tools for this step

• Credential ownership checklist: system-by-system audit plus letter template (free tool, coming soon).
• Studio: map devices so each credential has a home (live).