Who owns my dental office passwords and IT accounts?

Key facts

What counts as "my passwords"?

More than most owners think. In a typical dental office, the keys to the practice include:

• Domain name and DNS (registrar account), which controls your website and email delivery.
• Email and productivity admin (Microsoft 365 or Google Workspace global administrator).
• Practice-management and imaging software administrator accounts and database credentials.
• Firewall, router, switches and Wi-Fi admin logins, plus the Wi-Fi passphrases.
• Server and workstation local administrator accounts.
• Backup consoles and any cloud backup encryption keys.
• Internet, phone and fax carrier accounts.
• Security cameras (the recorder or cloud portal) and door-access systems.
• Website hosting, clearinghouse, e-prescribing and insurance portals.

If you cannot name who holds the top-level login for each of these, you do not fully control your practice. Put simply: your practice shouldn't be held hostage by whoever installed it.

Does it matter that my IT company created the accounts?

Not to ownership. An IT firm writing on this exact question puts it plainly: "you and you alone have full ownership over your credentials. Even if your IT provider creates the accounts you use, the rights over them still fall under your umbrella" (ITS). You granted your provider access so it could manage your systems; it did not acquire your systems.

Your contract still matters, because it governs how and when handover happens. U.S. and allied cybersecurity agencies tell managed-service customers to make sure contracts "transparently identify ownership of ICT security roles and responsibilities" (CISA advisory AA22-131A). See what your IT contract should say about passwords and data.

To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.

What does HIPAA actually require?

HIPAA does not use the phrase "password ownership," but several Security Rule requirements only work if your practice can reach its own systems:

• Availability. Covered entities must ensure the confidentiality, integrity and availability of the ePHI they hold (HHS). HHS has said a covered entity that signs contract terms preventing it from ensuring the availability of its own PHI is itself out of compliance (HHS OCR FAQ 2074).
• Emergency access. You must establish procedures for obtaining necessary ePHI during an emergency (45 CFR 164.312(a)(2)(ii)). A procedure that depends on one outside technician answering the phone is fragile.
• Unique user IDs. Each user needs a unique name or number for identifying and tracking activity (45 CFR 164.312(a)(2)(i)). Shared "admin/admin" logins undermine this.
• Ending access. Procedures for terminating access when an employment or "other arrangement" ends are an addressable specification (45 CFR 164.308(a)(3)(ii)(C)). You cannot revoke what you cannot see.
• Business associate agreements. Any vendor that creates, receives, maintains or transmits ePHI for you needs a BAA (HHS).

For the full checklist, see what the HIPAA Security Rule requires for dental IT. This is general information, not legal advice.

Who owns my domain name?

Whoever is listed as the registrant. If a web designer or IT company registered your domain under its own name, changing that requires going through the registrar where it is registered; ICANN directs registrants to contact that registrar and to look up the registrar through a WHOIS search (ICANN). ICANN also notes registrars must apply a 60-day transfer lock after a change of registrant unless the registrant opts out where offered (ICANN). Fix this while relationships are good, not during a dispute.

How do I take inventory of what I own?

Do this once, then keep it current.

1. List every system from the section above. Note the vendor, the account URL and who holds the top-level login.
2. Create a practice-owned admin account on each system where the vendor allows it, in the practice's name, with multi-factor authentication tied to a practice-controlled phone or key.
3. Store credentials in a practice-controlled vault, not a technician's notebook or personal password manager.
4. Confirm the domain registrant and the email global admin are the practice.
5. Get the network documentation: firewall config backup, switch port map, IP plan and Wi-Fi settings. See how a dental office network should be designed.
6. Verify backups are restorable by you, including where encryption keys live. See how to back up patient data.
7. Review quarterly and after any staff or vendor change. CISA's first tactical recommendation is to identify and disable accounts no longer in use (CISA).

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

Does owning my passwords mean I should manage IT myself?

No. Owning the keys and doing the work are different jobs. A good IT provider should have its own named accounts, logged and revocable, while your practice holds the master access. That arrangement protects both sides: the provider can prove what it did, and you can change providers without a crisis. If you are already mid-dispute, read Can my IT company refuse to give me my passwords? and how to switch IT providers without losing access.

How FloorStack helps

FloorStack is a dental build-out platform that also documents what gets built. Our free IT Credential Ownership Checklist (coming soon at /tools/credential-ownership-checklist) will walk you through every system above and flag gaps. As described on the FloorStack homepage, FloorStack keeps each login with its device in a BAA-backed vault and lets you grant or revoke access for your MSP, staff or vendors at any time. Start at the Own Your Dental Passwords hub.

Free tools on the FloorStack dental build-out platform for this step: FloorStack Studio (live, free plan).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.