20 Questions to Ask Before Signing a Dental IT Contract (With a Printable One-Page Table)

The provider is chosen, their side of the proposal is signed, and only your name is missing from the last page. Before you add it, turn every sales promise into a sentence in the agreement.

This page is for the practice owner who has already compared providers and now has one agreement to read. If you are still comparing, start with our guide on how to choose a dental IT provider and come back here once you have a favourite. Every question below comes with why it matters, what a clear answer includes, and the red flag that should stop the pen. A printable one-page version follows the five groups.

Why do these questions matter more after you've picked a provider?

Because the sales conversation and the agreement are two different documents, and only one of them binds anyone. Once you sign, the agreement decides what is included, what is billed, how long you stay and what you take with you when you go. Questions asked before the signature cost nothing; the same questions asked a year later become negotiations.

The American Dental Association's own guidance on unwanted contracts puts it plainly: "You should always carefully read any agreement before signing it." The same article notes that, in many cases, the practical way out of a contract that is not working is to "fulfill your obligations under the contract and then elect not to renew it at the end of the contract term." Both points lead to the same place. The term, renewal and exit language deserve as much attention as the price.

The questions are grouped in the order most managed IT agreements are laid out, so you can work through the document page by page rather than jumping around. Scope comes first because it decides what every other clause applies to.

Which documents should be on the table before you ask anything?

Ask for the whole contract package at once, not only the proposal. A dental IT agreement is usually several documents that refer to each other, and the answers to most of the twenty questions sit in the attachments rather than in the signature page. Missing attachments are the first finding.

Request each of these by name and check them off:

1. 1. The master services agreement (the legal terms: term, renewal, liability, termination).
2. 1. The scope of services or statement of work (what the monthly fee covers).
3. 1. The fee schedule (monthly fee, onboarding, hourly rates for out-of-scope work, onsite and after-hours rates).
4. 1. The service level or support description (priority levels, escalation path, coverage hours).
5. 1. The business associate agreement, as its own signed document.
6. 1. The device, user and location inventory the price was built on.
7. 1. The onboarding plan (what happens in the first weeks and what "complete" means).
8. 1. Any offboarding or transition terms, if they are a separate exhibit.

If a provider says one of these "doesn't exist yet" or "will be sorted out after signing", write that down. It is an answer.

Scope: what exactly does the monthly fee cover? (questions 1–4)

Scope questions establish what you are buying, item by item. A monthly fee only means something next to a written list of covered devices, users, locations and tasks, and a written list of exclusions. Most later billing disputes trace back to a scope line that was vague at signing.

For a longer walk through what a managed plan normally contains, see what dental IT services include. The four questions below turn that list into contract language.

1. Which devices, users, locations and systems does the fee count, and what happens when the count changes?

Why it matters. Many proposals are priced from an inventory: so many workstations, a server, a firewall, so many staff accounts. When you add an operatory, hire an associate or buy an imaging workstation, the count changes and so can the bill. You need to know the rule before the change, not after.

Clear answer: "Here is the inventory attached as an exhibit. Adding a device or user changes the fee by this amount, from the next billing month, and we confirm it with you in writing first."

Red flag: There is no inventory, or the fee "covers everything" with no list of what everything is.

2. What is excluded, and how is excluded work quoted and approved?

Why it matters. An exclusions list is the other half of the price. Common exclusions in IT agreements are new hardware, cabling projects, software licences, moves and major upgrades. That is reasonable, provided you know which is which and nothing out of scope starts without your approval.

Clear answer: "Exclusions are listed in section X. Anything outside scope is quoted in writing and starts only after you approve the quote."

Red flag: Exclusions are described as "standard" or "industry-typical" but not written down, or out-of-scope work can be billed without a prior approval step.

3. When Dentrix, Eaglesoft, Open Dental or your imaging software misbehaves, who calls the software vendor?

Why it matters. Many dental problems sit between the IT layer and the clinical software: a database service that will not start, a sensor driver after an update, a bridge between the practice management system and the imaging suite. Someone has to open the ticket with the software vendor and stay on the call. If the agreement is silent, that someone becomes your office manager.

Clear answer: "Vendor coordination for these named systems is in scope (or: is billed at this rate). We open and own the vendor ticket and report back to you."

Red flag: "We'll help where we can," with no line in the scope of services either way.

4. Is there a cap on hours, tickets or visits inside the fee?

Why it matters. Some agreements that look flat are really a block of hours. When the block runs out, every further request is billed separately, which turns a fixed monthly cost into an unpredictable one in exactly the month something goes wrong. The cap may be reasonable; the surprise is not.

Clear answer: "There is no hours cap on covered work," or "The fee includes this many hours; beyond that the rate is this, and we warn you in writing before the block runs out."

Red flag: The word "unlimited" in the proposal and a cap, an allotment or a "fair use" clause in the agreement.

People and support: who answers, and what happens when they can't fix it? (questions 5–8)

Support questions establish who picks up the phone, how a problem moves up when the first person cannot fix it, which hours each commitment covers, and how onsite work is arranged. The aim is a written description of the support path, not a promise about speed, which no agreement can make on your behalf.

5. Who answers when we call, and do they work for you?

Why it matters. The first person your staff reach decides most of the experience. Some providers answer with their own engineers; others route first contact through a contracted answering service or an offshore desk that logs tickets for someone else to pick up. Either can work, but you should know which you are buying.

Clear answer: "Calls to this number are answered by our own staff. If they cannot resolve it, it moves to this team, and you will hear from a named person."

Red flag: The provider will not say who answers, or the answer differs between the sales call and the agreement.

6. How does the agreement define priority levels, escalation and what you will report back?

Why it matters. A service level agreement (SLA) is the part of the contract that defines how requests are classified, how each class is handled and what the provider measures and reports. Its value lies in the definitions: what counts as urgent for a dental office (a server down before the first patient is not the same as a printer jam), who decides the priority, and what happens when a target is missed. Our guide to what a dental IT support SLA should define goes through the clauses in detail.

Clear answer: "Priorities are defined in this exhibit with dental examples. You can raise a ticket's priority by phone. We report monthly on tickets by priority, and this is what happens if we miss a commitment."

Red flag: No definitions at all, or a headline number in the sales deck that does not appear in the agreement, or a target with no explanation of how it is measured.

7. Which hours does each support commitment cover, and what does work outside them cost?

Why it matters. Dental offices open early, run late and sometimes work Saturdays. An agreement can describe staffed help desk hours, monitoring hours and onsite hours differently, and each can carry a different rate outside its window. Evening and weekend premiums are a common source of unexpected invoices.

Clear answer: "Here are the hours for the help desk, monitoring and onsite work, in your time zone. Work outside them is included / billed at this rate, and here is how you reach us."

Red flag: Coverage described as "around the clock" in the proposal, with the agreement silent on what is staffed, what is automated and what costs extra.

8. How is onsite work booked, and is it in the fee or billed per visit?

Why it matters. Remote work fixes most day-to-day problems, but cabling, failed hardware, imaging equipment and moves need someone in the building. Onsite is often the largest variable in a proposal: included for some providers, billed by the hour or with a trip charge for others.

Clear answer: "Onsite visits are booked through the help desk by appointment. They are included for covered devices / billed at this rate, and travel is or is not charged."

Red flag: "We'll send someone if needed," with no booking method, rate or travel rule in writing.

Security, backup and records: how will patient data be protected, and how will you know? (questions 9–12)

These questions cover the business associate agreement, backup and restore evidence, the split of security responsibilities and who owns the documentation. They ask for proof you can see, such as signed documents, test records and written responsibility lists, rather than general reassurance. The regulation text is cited so you can read it yourself.

Nothing here is legal advice. Where a HIPAA rule is mentioned, it is described from the regulation, and what it requires of your practice is a question for your compliance adviser or attorney.

9. Will you sign a business associate agreement, and what does yours contain?

Why it matters. The HIPAA rules define a business associate in terms of an organisation that creates, receives, maintains or transmits protected health information on behalf of a covered entity (45 CFR 160.103). The regulation then lists what a contract between a covered entity and a business associate must contain. Among other items, 45 CFR 164.504(e) says it must require the business associate to report any use or disclosure not provided for by the contract, to ensure that subcontractors who handle the information agree to the same restrictions, and, at termination, "if feasible, return or destroy all protected health information." It must also authorise termination by the covered entity if the covered entity determines the business associate has violated a material term. Under the Security Rule, 45 CFR 164.314(a) adds that the contract must require the business associate to report security incidents it becomes aware of.

Clear answer: "Yes. Here is our BAA as a separate document. Your attorney can compare it against the regulation before you sign."

Red flag: The provider will not put a BAA in front of you, offers a paragraph in the service terms instead of a separate document, or will not show it until after signing.

10. What will you back up, how long will you keep it, and how will we see a restore work?

Why it matters. A backup job that reports "success" is not the same as data you can restore. The Security Rule's contingency plan standard (45 CFR 164.308(a)(7)) lists a data backup plan and a disaster recovery plan as required implementation specifications, and "periodic testing and revision of contingency plans" as an addressable one. Whatever your adviser concludes about your obligations, the contract is where you ask for evidence. Our page on dental backup and disaster recovery sets out what a backup service is meant to cover.

Clear answer: "These systems are backed up (practice management database, imaging, documents, email), on this schedule, kept for this long, with a copy off site. We run a test restore on this cadence and send you the record."

Red flag: No list of what is protected, no retention period, or "restores are tested" with no record you will ever see.

11. Which security tasks are yours, which are ours, and how will you tell us about an incident?

Why it matters. The joint advisory on managed service providers from CISA and its partners (AA22-131A, May 2022) tells customers to make sure "their contract specifies whether the MSP or the customer owns specific responsibilities," and adds that "Contracts should detail how and when MSPs notify the customer of an incident affecting the customer's environment." It also recommends contract terms requiring multifactor authentication on the provider's accounts and barring reuse of admin credentials across customers. These are exactly the gaps that stay invisible until something happens.

Clear answer: "Here is the responsibility list: patching, endpoint protection, firewall, MFA, user removal, staff training. Our accounts use MFA and unique credentials. We notify you of a suspected incident by phone and in writing, as described in this clause." Our dental cybersecurity services page describes the security layer a managed plan sits on.

Red flag: Security described only as products ("we install antivirus") with no written split of who does what, and no notification clause.

12. Who owns the documentation you build about our network, and can we have it during the term?

Why it matters. Over the life of the agreement, the provider will build a picture of your office: the network diagram, device inventory, IP addresses, software versions, vendor contacts, configuration notes. If that picture lives only in the provider's system, you are dependent on them for every future decision, including a move to someone else.

Clear answer: "Documentation about your environment belongs to the practice. You can request a current copy at any time and we provide it in a standard format."

Red flag: Documentation described as the provider's "proprietary" material, or available only at exit, or only for a fee.

Money and term: what will this cost over the full term, not only in month one? (questions 13–16)

Money questions set out the full cost of the agreement over its whole life: the onboarding charge, the monthly fee, how that fee can change, how long you are committed and what hardware and licences really cost through the provider. The monthly figure on the proposal's first page is only one of those lines.

For a fuller breakdown of pricing models and how to compare quotes, see our dental IT support cost guide.

13. Is there an onboarding or setup fee, and what exactly does it buy?

Why it matters. Taking over an office takes real work: documenting the network, installing monitoring tools, fixing what is found, collecting credentials from the previous provider. Some providers charge for it separately, some spread it into the monthly fee, some include it. Any of these can be fair if the deliverables are written down.

Clear answer: "Onboarding costs this amount (or is included). It covers these named tasks, finishes when this checklist is signed off, and here is what happens if we find something that needs a project."

Red flag: An onboarding fee with no list of deliverables, or no definition of when onboarding ends and the monthly service begins.

14. How and when can the price change during the term?

Why it matters. A monthly fee can rise in three ways: an annual increase written into the contract, a change in the device or user count, or a change in third-party costs passed through to you. Each is normal in some form. What matters is a cap, notice and a right to respond.

Clear answer: "The fee is fixed for the first term except for inventory changes. After that, increases are limited to this amount, with this many days' written notice."

Red flag: "Prices may be adjusted at our discretion," with no cap and no notice period.

15. How long is the first term, does it renew automatically, and how much notice does leaving take?

Why it matters. Term, renewal and notice are where owners most often feel trapped. A multi-year term with automatic renewal and a long notice window can keep you in an agreement for a further year because a date passed unnoticed. Shorter terms trade some price stability for flexibility; longer terms may carry a lower monthly rate. Either can be right once the exit rules are clear.

Clear answer: "The first term is this long. It renews for this period unless either side gives this much written notice, sent to this address or email. Early termination costs this amount, calculated this way."

Red flag: Automatic renewal for the full original term, a notice window that is easy to miss, or an early-termination charge equal to every remaining month's fee.

16. Do you mark up hardware and software, and in whose name are licences and warranties registered?

Why it matters. Some providers resell computers, firewalls and licences. That is convenient, but the markup should be visible and the licences, warranties and subscriptions should sit in the practice's name. If a firewall subscription or a Microsoft 365 tenant is registered to the provider, leaving becomes harder and slower.

Clear answer: "Hardware is quoted at this margin, or you can buy it yourself and we will install it. Licences, warranties and subscriptions are registered to the practice."

Red flag: A refusal to support equipment you buy elsewhere, or licences registered in the provider's name.

Exit and data: how do you leave cleanly if it doesn't work out? (questions 17–20)

Exit questions cover the help you receive when the agreement ends, who controls the administrator accounts throughout, what documentation comes back to you and how your data is returned or destroyed. Asking them at the start says nothing about doubting the provider. It makes sure leaving would be an orderly process.

If you are already planning a move from a current provider, our guide to switching dental IT providers without downtime covers the transition itself.

17. What offboarding help is included when the agreement ends, and for how long?

Why it matters. The day you give notice, the outgoing provider still holds most of the knowledge about your office. The agreement should say what they will do during the notice period: hand over documentation, transfer credentials, work with the incoming provider, keep monitoring and backups running until the switch. Without that, cooperation depends on goodwill.

Clear answer: "During the notice period we continue full service, hand over the items in this exhibit, and meet with your next provider. Transition work beyond that list is billed at this rate."

Red flag: No offboarding clause, or a clause that lets the provider stop service or withhold handover while a billing dispute is open.

18. Will the practice hold its own administrator accounts from the first day?

Why it matters. Administrator access to your Microsoft 365 or Google Workspace tenant, server, firewall, backup console and practice software is the key to everything else. Microsoft's own guidance recommends creating "two or more emergency access accounts" so an organisation is not locked out, and lists the departure of the person holding the most recent Global Administrator access as one of the situations they protect against. CISA's advisory tells customers to disable MSP accounts that are no longer managing their infrastructure, which is far simpler when the practice already holds its own access.

Clear answer: "Yes. The practice holds an owner-level administrator account for each system, stored where you control it. Our technicians use their own named accounts, which you can disable."

Red flag: The provider holds the only administrator credentials, or shares one login among all its technicians.

19. What documentation comes back to us at exit, and in what format?

Why it matters. Question 12 covers access to documentation during the term; this one covers the final handover. A new provider needs the network diagram, inventory, configuration exports, vendor contacts and licence records to take over without guesswork. Format matters: a PDF of a screenshot is not a firewall configuration.

Clear answer: "At exit you receive the items in this list, in these formats (configuration exports, spreadsheet inventory, diagram files), within this many days of notice."

Red flag: "We'll give you what we have," with no list and no timing.

20. How will our data be returned or destroyed, and how will you confirm it?

Why it matters. At the end of the relationship, copies of your practice's data may remain in the provider's backup storage, ticketing system and remote tools. The business associate contract provisions in 45 CFR 164.504(e) address what happens to protected health information at termination (see question 9). The service agreement should say the same thing in practical terms: what is returned, in what form, what is deleted, and who confirms it.

Clear answer: "Backup data is returned in this format or transferred to your new provider; remaining copies are destroyed within this period, and we confirm destruction in writing. Our remote tools are removed and our accounts disabled on the exit date."

Red flag: Data returned only after an extra fee that is not in the fee schedule, or no written confirmation of what was deleted.

What to ask your IT provider: all 20 questions on one page

This table is the one-page version for printing and taking into the signing meeting. Each row holds the question, what a clear answer includes in short, and the red flag that means the clause needs work before you sign. Leave the margin free for the provider's written answer and the section of the agreement it points to.

If you only ask five, which five should they be?

If the meeting is short, ask questions 2, 9, 10, 15 and 18. Together they cover what the fee leaves out, the BAA, proof that backups restore, the term and renewal rules, and who controls the administrator accounts. Each one is hard to fix after signing and easy to fix before.

1. 1. Question 2, exclusions. The exclusions list is the rest of the price. Everything else on the invoice depends on it.
2. 1. Question 9, the business associate agreement. It is a separate document with contents the regulation describes, and you should see it before you sign rather than after.
3. 1. Question 10, restore evidence. It is the difference between "we back up" and "we can show you a restore."
4. 1. Question 15, term, renewal and notice. This is the clause owners most often regret, because it decides how long a poor fit lasts.
5. 1. Question 18, administrator accounts. If the practice holds its own access, almost every exit problem becomes smaller.

How do you use these questions in the signing meeting?

Send the questions to the provider a few days before the meeting, ask for written answers, and use the meeting to go through the gaps. The goal is an agreement where every answer is either in the contract or attached to it as an exhibit both sides sign, so nothing depends on memory.

A routine that works for most single-location practices:

1. 1. Send the list ahead. Email the printable table to the provider with the date of the meeting. A provider with clear answers will usually fill in most of it before you meet.
2. 1. Bring the right people. The owner decides; the office manager knows how the office really runs (early starts, Saturday clinics, which vendor calls go wrong); your attorney, or whoever reviews your other contracts, should read the term, renewal, liability and exit sections and the BAA.
3. 1. Read the agreement in its own order. Go through scope, support, security, money and exit with the agreement open, marking each answer with the section number where it appears.
4. 1. Write the gaps into an exhibit. Where an answer was given in the meeting but is not in the agreement, ask for it to be added in a short signed exhibit. A verbal "don't worry, that's covered" has no force once the agreement is signed.
5. 1. Do not sign with blanks. Missing attachments, an unsigned BAA or an empty inventory exhibit are reasons to wait a week.
6. 1. Diary the dates on signing day. Put the renewal date and the last day to give notice in the practice calendar, with a reminder well before the notice window opens.
7. 1. Book the first review. Agree a review after the first ninety days against the onboarding checklist and the support reporting, so the agreement is measured against what was promised.

The complete guide to dental IT support explains how the pieces of a support relationship fit together if you want the wider picture before the meeting.

How does Legend Networking answer these questions in its published wording?

The table below sets each statement Legend Networking publishes, in the company's approved wording, beside the question it answers and what to ask for in writing. Treat it exactly as you would any provider's answers: as a starting point to confirm in the agreement.

For the term, renewal, notice and offboarding terms (questions 15 and 17–20) and the business associate agreement (question 9), ask Legend Networking for the documents in writing before you sign, as you would with any provider.

For background on the company: Legend Networking has served over 3,500 practices since 2004 and is headquartered in Dallas. Its review record is 4.8 rating · 173 Google reviews. Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps.

To see how Legend's dental IT support for practices is set out, or how its dental IT services are structured as a managed plan, both pages describe the service in more detail.