Guide

The dental IT transition checklist: credentials, BAAs, and backups

In one sentence

Before switching dental IT providers, gather four things while the old provider is still engaged — administrative credentials for every system, software licenses, backup access plus a tested restore, and documentation of how everything is configured — and get a signed BAA from the new provider before it touches your systems. The checklist turns a scary switch into confirmable steps.

Last updated

On this page
6 min read Published
transitionchecklistcredentialsbaabackups

What do I need before switching dental IT providers?

Before you switch, collect and verify four things from your current setup: administrative credentials for every system, software licenses, backup access plus a tested restore, and documentation of how everything is configured - and get a signed BAA from the new provider before it touches your systems. Gather these while the old provider is still engaged - it is far harder to extract them after you have given notice. Use the checklist below.

1. Administrative credentials

You should hold (or be able to obtain) admin access to all of it. If the old provider holds these and will not document them, that is itself a reason to be glad you are leaving.

  • Server and workstation administrator accounts
  • Practice-management and imaging software admin logins
  • Network gear: firewall/router, switches, Wi-Fi controller
  • Email/Microsoft 365 or Google Workspace admin
  • Domain registrar and DNS, and the internet account with your ISP

2. Software licenses and accounts

  • Practice-management and imaging software license records
  • Antivirus/security, backup, and any monitoring tool licenses
  • Any subscriptions billed through the IT provider you will need to move

3. A signed BAA with the new provider

If a provider touches systems with access to PHI, HIPAA expects a Business Associate Agreement. Have the new provider's BAA signed before they begin, and keep a copy. (See Security & Compliance.)

4. Backup access - and a tested restore

This is the one people skip and regret. Confirm where backups run, get access to them, and verify an actual restore of the practice-management database before the old provider loses access. "The backup runs nightly" is not evidence; a successful restore is. (See do my dental backups actually work?)

5. Documentation of the environment

  • A network diagram and an asset list (machines, ages, warranties)
  • How the practice-management server, database, and images are configured
  • Integrations and bridges (imaging, e-claims, payments)
  • Any custom settings or scripts the old provider put in place

6. After cutover: revoke and confirm

Once the new setup is verified, revoke the previous provider's remote access and accounts - and confirm the revocation rather than assuming it. Lingering vendor access is a standing security risk. (See is my IT vendor my biggest security risk?)

Worked top to bottom while the old provider is still engaged, this list turns "switching is scary" into a sequence of confirmable steps. The transition itself - the zero-downtime cutover - is covered in how to switch dental IT without downtime.

Frequently asked questions

What should I get from my old IT provider before switching?

Administrative credentials for every system (servers, software, network, email, domain, ISP), software license records, access to your backups with a tested restore, and documentation of how the environment is configured. Collect these while the old provider is still engaged, since extraction is harder after you give notice.

What if my current provider will not hand over credentials?

A provider that controls your systems and will not document access is a reason to leave, not to stay. Your administrative access to your own infrastructure is yours. Request it in writing, and if they resist, that resistance is exactly the lock-in a transparent provider is designed to prevent.

What is the single most important item on the list?

A verified backup restore before the old provider loses access. Credentials and documentation can be reconstructed with effort; a practice-management database that cannot be restored cannot. Prove a real restore first, and the rest of the transition is low-risk.

Security7 min read

Are dental practices really HIPAA-compliant? The vendor BAA gap

Many dental practices believe they are HIPAA-compliant but have real gaps — the most common being the vendor BAA gap: an IT company that maintains systems holding patient data on your behalf without a signed Business Associate Agreement. Compliance is ongoing safeguards, agreements, and evidence, not a one-time certificate. Here is where practices fall short.

Read article
Security6 min read

How do I know if my dental backups actually work?

"Backed up" and "restorable" are not the same thing. The artifact that proves your dental backups work is a tested restore of the practice-management database from within the last 30 days. If you do not have that, "we have backups" is a control-design statement, not a control-evidence one — and HIPAA’s Security Rule lists data availability as a security property, so the gap matters.

Read article
Guide8 min read

How to switch dental IT providers without downtime (2026 step-by-step)

You can switch dental IT providers without downtime by overlapping the old and new providers, inventorying everything first (credentials, licenses, backups, BAAs), verifying a real backup restore, and cutting over in a planned window. The fear of going dark is the main reason owners stay with a provider they dislike — and it is avoidable.

Read article