How do I switch dental IT providers without losing access?

Key facts

What should I do before I tell my current provider?

Get the facts and the keys you can get without asking. This isn't about being sneaky. It's about making sure the practice can keep seeing patients no matter how the conversation goes.

1. Read your contract. Find the notice period, termination terms, transition-assistance terms and any equipment that's leased rather than owned. If ownership and turnover aren't spelled out, see what your IT contract should say.
2. Read your BAA. Look for what happens to PHI and backups at termination (HHS sample BAA).
3. Confirm what you already control. Can the doctor or office manager log in as an administrator to Microsoft 365 or Google Workspace, the domain registrar, the PMS vendor portal and the backup console? If not, that's the first gap.
4. Pick and sign the new provider, including a BAA, before notice goes out.

What has to be on the inventory?

Every system someone has to log into to keep the practice running. CISA tells organizations to inventory both logical (data, software) and physical (hardware) IT assets, and to store network documentation securely with offline backups and hard copies (CISA).

How should credentials actually be handed over?

Through an encrypted channel, never in a plain email or a spreadsheet. ITS, an MSP writing about this exact scenario, suggests encrypted email or a secure password repository, with the master key delivered separately through a secure method (ITS).

Ask the outgoing provider for:

• The full credential export
• Network diagram, IP plan, switch port map and firewall rules
• Backup job list, retention settings and encryption keys
• A list of every remote access and monitoring agent they installed
• Open tickets and known issues

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

What is the switchover sequence?

A workable 30-day sequence. Adjust to your notice period.

Week 1, secure ownership

• Create practice-held emergency admin accounts in Microsoft 365. Microsoft recommends at least two, cloud-only, not tied to any individual, protected with phishing-resistant authentication (Microsoft Learn)
• Move the domain registrar account into the practice's name (ICANN)
• Give written notice per the contract

Week 2, transfer

• Receive credentials and documentation
• New provider verifies every credential actually works. An export that's out of date is common.
• Confirm a current, restorable backup exists before changing anything (backup)

Week 3, cut over

• New provider deploys its tools
• Remove the old provider's remote access and monitoring agents
• Rotate every administrative password, Wi-Fi key and service account. CISA's recovery guidance likewise calls for password resets on affected systems, and its hardening guidance calls for quarterly audits that remove inactive or unauthorized accounts (CISA)

Week 4, close out

• Disable or delete all old-provider accounts. HIPAA's workforce security standard includes procedures for ending access when an arrangement ends (45 CFR 164.308)
• Get written confirmation that PHI was returned or destroyed per the BAA (HHS sample BAA)
• Update your risk analysis to reflect the vendor change (HIPAA Security Rule)

To turn this into a drawing your low-voltage contractor can bid, the free network & IT plan generator (coming soon) is planned to produce drops, rack, Wi-Fi and VLAN plans from your floor plan.

To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.

What if the old provider won't cooperate?

Stay calm and document everything. ITS's advice is to keep things civil, keep communication open, and bring in your attorney to review the agreements if needed (ITS).

For anything holding patient data, HHS's position is clear. A business associate that terminates access privileges or otherwise denies a covered entity access to the ePHI it holds is violating the Security Rule, and blocking access to resolve a payment dispute is an impermissible use under the Privacy Rule (HHS FAQ 2074). Your attorney can raise that directly. For the specific question of withheld passwords, see can my IT company refuse to give me my passwords?

Where you already hold owner-level admin access, the new provider can often regain control of systems without the old provider's help. That's the strongest argument for holding it from day one.

Why rotate every password after a switch?

Because the outgoing provider, and any of its staff who've left, still know them. CISA lists third parties and MSPs as an initial access vector for ransomware and recommends least-privilege third-party access and quarterly audits of MSP and remote-monitoring accounts (CISA). Leaving an old remote-access agent installed is like leaving a former employee's key in the door.

How FloorStack helps

FloorStack keeps your device inventory and credentials in the practice's own BAA-backed vault. You can grant your MSP access and revoke it the day you switch, and every reveal is logged (FloorStack). MSPs and IT providers can manage each dental client's plan, vault and access in one place through the partner program. The planned free Credential Ownership Checklist (free tool, coming soon) will walk through the inventory above. It's part of the FloorStack dental build-out platform. See the Credential Ownership Checklist or the Own Your Dental Passwords hub.

Free tools on the FloorStack dental build-out platform for this step: FloorStack Studio (live, free plan) and Network & IT plan generator (free tool, coming soon).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.