How to Choose a Dental IT Company: 10 Criteria, a Scoring Sheet and the Questions to Ask

You have two or three proposals open. Each one is confident, each is priced a little differently, and no two describe your office the same way. Choosing well is less about who sounds best and more about who can prove what they say.

The short answer: write down your environment once and send the same summary to every candidate. Then score each one on the same 10 weighted criteria, from dental software depth and imaging to restore proof, admin-credential ownership, contract exit terms and references, using evidence you can check. Compare scope line by line before you compare price, and let the scoring sheet show you where the candidates really differ.

Quick answer: how to choose a dental IT provider

Choose a dental IT provider by testing claims, not marketing. Ask for evidence of dental software experience, a written support and escalation model, the real scope of the agreement, documented restore testing and comparable references. Score every candidate on the same criteria, compare proposals line by line rather than by monthly price, and confirm what onboarding covers before you sign.

In practice that takes about four weeks and one person who owns the process. The steps below are written so an owner or office manager without a technical background can run them, and so that every candidate, including us, is held to the same test.

This guide is about the selection process itself. It does not list every service a provider might sell, it does not quote a price table, and it does not rank companies. If you want a service-by-service view of what support covers, see our dental IT support services page. If you are weighing a dental specialist against a general MSP, read dental IT support vs general IT support. If you are still building a shortlist, our comparison of the top dental IT companies in America covers who is out there. If proximity and onsite coverage are your main concern, read how to evaluate a dental IT support company near you.

For the wider picture of how support works day to day, start with what dental IT support covers. For a line-item view of scope, see what dental IT services include. When you reach the paperwork, the clause-by-clause contract questions linked near the end of this guide pick up where it stops.

What should you look for in a dental IT company? The 10 criteria

Look for a company that can prove ten things: depth in your practice software, command of your imaging, security it can describe as a process, backups with dated restore proof, a clear helpdesk model, a workable onsite model, documentation and admin credentials you own, fair contract and exit terms, comparable references, and reporting you can read.

Those ten are not a list of nice-to-haves. Each one maps to a way a dental day goes wrong: a chart that will not open, a sensor that will not capture, a phishing click, a server that will not come back, a call nobody answers, a cabling job nobody owns, a password only the old provider knew, a renewal that locks you in, a promise nobody else can vouch for, and a year with no plan. The table is the overview. Each criterion has its own section further down with the evidence to request.

The weights are a starting point. A practice with an imaging-heavy specialty will move weight to criterion 2, and a practice that has never seen a restore test will move it to criterion 4. Set the weights before any proposal arrives, so they reflect your priorities rather than your favourite candidate. The section on weights by practice type below shows common adjustments.

Dental IT support or managed IT services: which are you buying?

Before you compare providers, decide which of two things you are buying, because proposals for each are written differently. Dental IT support means someone fixes problems when your team reports them: a help desk, remote fixes and onsite visits when needed. It answers "who do we call?"

Managed IT means the provider takes ongoing responsibility for the environment between tickets: monitoring, patching, security tools, backup checks, documentation and planning, usually for a flat monthly fee. It answers "who keeps this healthy?" If that is what you want, compare candidates against what managed IT for dental practices includes, not against a help-desk quote.

Many proposals blend the two. The table below shows where responsibility usually sits, so you can see which column each quote really falls into.

If your office has had repeat outages, unpatched machines or untested backups, you are probably shopping for managed IT even if the proposals call it support. If your environment is stable and you mainly need someone to answer the phone and fix things, a support agreement may be enough. Either way, the evaluation below works the same, and so do the 10 criteria: a support-only proposal simply leaves more of them for the practice to own, and the scoring sheet should show that.

Start by writing down what you are buying

Before you contact anyone, write a one-page summary of your environment and your priorities. Most weak selection processes fail here: the practice compares three proposals that were scoped from three different assumptions.

Include the following:

• • Number of locations, operatories, workstations, servers and users.
• • Practice management system and imaging software, plus version and hosting model (on-premises, vendor-hosted or cloud).
• • Imaging hardware and sensors, and which vendor supports each.
• • Current backup method and the last time a restore was tested.
• • Where your data lives, including any cloud services such as Microsoft 365.
• • Known pain points, in your own words, with rough frequency.
• • What "resolved" looks like to you: fewer tickets, faster chairside recovery, better documentation, a clearer compliance position, or a specific project.
• • Your phone system, internet circuits and firewall, with the company that provides each, so candidates can see where their responsibility would start and stop.
• • Who holds administrator passwords today (the domain registrar, Microsoft 365, the firewall, the server), and whether the practice has its own copy.
• • Plans for the next 24 months: an added location, a remodel, new imaging equipment, a software change or a partner joining.
• • Who will make the decision and who will be consulted, usually the owner, the office manager and one clinical lead.

Send the same summary to every candidate. Comparable inputs produce comparable proposals.

A useful test of the summary: hand it to someone outside the practice and ask whether they could tell how many computers you have, which software runs at the front desk and chairside, and what has gone wrong in the last six months. If they cannot, the candidates cannot either, and each will fill the gaps with their own assumptions.

One more line is worth adding at the bottom: the three things that would make you leave a provider. Writing them down before the sales calls start keeps them from being talked away, and they become the knock-out bars on the scoring sheet later in this guide.

Run the evaluation in four weeks

A short, fixed timeline keeps the process from drifting and gives every candidate the same window. Four weeks is enough for two or three providers. Assign one owner, usually the office manager, to keep notes and chase documents, and agree in advance who scores.

Scoring alone before comparing is the step most practices skip. When two people score a candidate 2 and 5 on the same row, that gap is the conversation to have, and it is usually about evidence one of you saw and the other did not.

If a candidate cannot meet the timeline for proposals or evidence, record that on the scorecard. How a provider handles a deadline during the sale is a fair preview of how it will handle one after you sign.

Evaluation criteria and the evidence to request

Treat each criterion as a claim that needs supporting evidence. A provider that cannot produce evidence may still be a reasonable fit, but you should know that before signing rather than after.

The sections below follow the 10 criteria in the table above. Some sections cover two criteria, and two criteria have their own new sections. Proposals tend to say most about the first two and least about documentation, credentials, exit terms and reporting, which is where providers differ most.

Dental software and imaging familiarity

Criterion 1, dental software depth, with the platform side of criterion 2. Ask which practice management and imaging platforms the provider supports day to day, and how they handle version upgrades, sensor drivers and bridge integrations. Evidence to request: the names of platforms currently supported for other clients, a description of a recent upgrade or migration they handled, and how they coordinate with the software vendor when the fault is in the application rather than the network.

Name your own systems rather than asking a general question. "Do you know dental software?" invites a yes. "We run Dentrix on a local server with a DEXIS sensor in four operatories; walk us through the last upgrade you did on a setup like that" invites a description you can judge. The same applies to Eaglesoft, Open Dental, Curve, Denticon, Carestream, Planmeca Romexis or whatever is on your summary. Ask who, by role, would do that work at your office.

A strong answer names the steps (backup first, vendor release notes, workstation order, sensor driver checks, a test chart), and is honest about where the software vendor's responsibility begins.

Depth also shows in the small things. Ask how they handle the PMS database service on the server, the shared folder the imaging software writes to, the workstation that runs the insurance clearinghouse connector, and the one old PC that a piece of equipment still depends on. A provider with real dental exposure will recognise each of those without a pause and ask a follow-up question of its own.

Imaging, sensors and bridges

Criterion 2 is about what happens between the sensor in a hygienist's hand and the image in the chart. That path runs through a USB port or network jack, a driver, the capture software, a bridge that passes the patient into imaging, and a storage location that has to be backed up. A failure at any point looks the same to the clinical team: the image does not appear.

Ask each candidate to describe how it would diagnose "the sensor will not capture in operatory 3" from the first call to the fix. A useful answer separates the layers (cable and port, driver, capture software, bridge settings, storage path) and says which of those the provider owns and when the imaging vendor is brought in. A weak answer goes straight to "we reinstall the software".

Then ask three practical questions. How do you keep sensor drivers and capture software in step with operating system updates, so a Windows update does not break capture on a Monday? How do you test a bridge after a PMS upgrade? Where do our images live, and are they in the same backup as the PMS database? If your office runs a CBCT, a panoramic unit or an intraoral scanner, name it and ask for a recent example on similar equipment.

Support model and coverage

Criterion 5, the helpdesk model. Ask how tickets arrive, who answers them, and what happens outside stated business hours. Evidence to request: written support hours, the escalation path from first contact to senior engineer, and how urgent chairside issues are separated from routine requests. Ask how remote and onsite work are divided, and what triggers an onsite visit.

"24/7" means different things in different proposals. It can mean that systems are monitored around the clock, that a staffed helpdesk answers at any hour, or that an engineer is on call for emergencies only. Ask each candidate which of those it means, who answers, and what happens next. Then compare what each one has written down, not what was said on the call. The SLA guide linked in the contract section below explains how response and resolution targets differ.

Ask too whether first-level calls are answered by the provider's own staff or passed to an outside service, and how a call that starts with a front-desk printer is escalated when it turns out to be a server.

Onsite model

Criterion 6. Remote support resolves a large share of everyday requests, but some work needs a person in the building: new cabling, a failed switch, a workstation that will not power on, an imaging unit that needs its cable and driver checked together, or an opening-day setup in a new operatory. The question is not whether a provider is "local" but how onsite work actually happens.

Ask four things in writing. How is an onsite visit requested, and who decides that one is needed? How is it scheduled, and what does the practice do while it waits? Is onsite work inside the monthly fee, billed per visit, or billed as a project? Who comes: the provider's own technician or a subcontractor, and how is that disclosed? Score the clarity of the answers, not the promise of speed. A provider that explains its dispatch model plainly is easier to plan around than one that says "we'll be there whenever you need us".

Security and HIPAA process

Criterion 3, security as a process. No product or provider delivers a practice's HIPAA compliance on its own. What a provider can do is help support your obligations with technical safeguards and documentation. Evidence to request: how they document administrative, physical and technical safeguards; how access is granted and removed; how they handle patching and endpoint protection; whether they will sign a business associate agreement; and how they support your risk analysis process. Compliance also depends on your policies, training and workforce practices, which sit with the practice.

Two parts of the HIPAA Security Rule are useful anchors for the conversation. The rule asks covered entities to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic patient data (45 CFR 164.308(a)(1)), so ask how the provider contributes to that assessment and how findings are tracked. A business associate agreement is the contract under which a vendor handling patient data agrees to "use appropriate safeguards" and to report uses or disclosures the contract does not allow (45 CFR 164.504(e)). How those obligations apply to your practice is a question for your compliance adviser; what you are testing here is whether the provider can talk about them specifically.

Then ask about the controls themselves: multi-factor authentication on email and remote access, how administrator accounts are separated from everyday logins, how quickly a departing employee loses access, and how a lost laptop or a phishing click would be handled. A strong answer describes layers and a process. A weak one lists product names.

Ask, finally, how the provider protects its own access to you. A provider's remote tools and admin accounts reach every machine in the office, so they are worth protecting as carefully as your own. CISA's advisory for customers of managed service providers recommends that contracts "require MFA to be enforced on all MSP accounts used to access customer environments" (CISA AA22-131A, 11 May 2022). A candidate that can describe how its technicians sign in, and how that access is logged, is answering the right question.

Backup and recovery

Criterion 4, backup with restore proof. Ask what is backed up, how often, where copies are held, how long they are retained, and how restores are tested. Evidence to request: a description of the last restore test performed for a client of similar size, and what the documented recovery process looks like when a server is unavailable. A backup that has never been restored is an assumption, not a safeguard.

The Security Rule's contingency-plan standard lists a data backup plan, a disaster recovery plan and "periodic testing and revision of contingency plans" (45 CFR 164.308(a)(7)). Use that language with candidates: ask what their testing schedule is and whether you receive the results.

Be specific about what matters most in a dental office. The practice management database, the imaging archive and Microsoft 365 mailboxes are usually backed up by different tools. Ask about each one, and ask how long it would take to have the front desk and one operatory working again if the server failed on a Monday morning. You are asking for their process and their honest estimate, not a promise. Our backup and disaster recovery page covers restore testing and the recovery targets worth agreeing in advance.

What counts as restore proof? A dated record that names what was restored (the PMS database, a set of images, a mailbox), where it was restored to, whether the restored copy opened and how long it took. A screenshot of a green "backup succeeded" status is not restore proof; it shows that a copy was written, not that it can be read. On the scoring sheet, this criterion carries a knock-out bar for that reason.

Documentation and continuity

Criterion 7, documentation and admin-credential ownership. Ask what documentation they maintain about your environment and whether you receive a copy. Evidence to request: a sample (redacted) network diagram, asset inventory or standard operating document. If the provider is the only holder of your credentials and topology, you have a continuity risk regardless of quality.

Ask where the documentation is stored, whether your office can open it without the provider's help, and how it is kept current after changes. The test is simple: if the provider disappeared tomorrow, could the next one find your firewall settings, your Microsoft 365 administrator account and your imaging bridge configuration from what you hold?

Who holds the administrator credentials?

The practice should. The provider needs working admin access to do its job, but the top-level accounts for the domain name, Microsoft 365, the firewall, the server, the backup service and the PMS should sit in the practice's own name, and the practice keeps its own copy of each credential somewhere it controls. Ask each candidate to say so in writing.

Three follow-up questions separate a confident provider from a nervous one. Will the provider work through named admin accounts for its own technicians rather than one shared login? Will it tell you when an admin credential is changed? Will it hand over every credential and the current documentation at the end of the agreement, without a separate fee? A provider that hesitates on any of these is telling you what leaving would be like.

Reporting and planning

Criterion 10. Ask what you receive between incidents. Evidence to request: a sample monthly or quarterly report, and a description of how technology planning and budgeting conversations happen.

A useful report shows activity and health in terms you can follow: how many tickets were raised and what kind, which machines are behind on updates, whether backup jobs succeeded and when a restore was last tested, and which devices are approaching end of warranty or support. Planning should turn that into a short list for the next year, with rough budgets you can put into your own numbers. Ask how a growing practice is handled: what changes when you add a location, and whether a second office gets the same standard set-up and security policy as the first.

Communication and staff experience

This scores inside criterion 5, the helpdesk model, and it often decides the first year. Your front desk and clinical team are the people who call the provider. Ask how staff raise a request, whether they can do it without a long form, and how the provider explains a fix to someone who is not technical.

Evidence to request: a sample of the update a staff member receives when a ticket is opened and closed, and the name or role of the person who reviews the account with the owner. On reference calls, ask to speak to an office manager, not only the doctor. Plain, specific explanations during the sales process are a fair sign of how routine communication will go.

Contract terms and exit

Criterion 8. At the choosing stage you are not reviewing every clause; you are checking that each candidate's terms are clear enough to compare and fair enough to live with. Ask for the full agreement, not a summary, and look for six things: the initial term, whether it renews automatically, the notice period, how and when the price can change, what is excluded, and what happens at exit.

Exit deserves the most attention because it is the clause nobody thinks about while things are going well. A fair exit clause says what the provider returns (credentials, documentation, backup data), in what format, within what period, and whether any offboarding help is included or billed. Score a candidate that writes this down above one that says "we've never had anyone leave". The section on what a good contract contains, later in this guide, gives a clause-by-clause view of good and weak wording.

References and track record

Criterion 9. References are the only outside check on everything else on the sheet, so ask for ones that look like you: a similar number of operatories, the same PMS, and an onboarding within the last two years. A reference that matches on those three points is worth more than three that do not.

Ask each reference about process rather than satisfaction (the questions are in the references section further down), and listen for specifics: a date, a system, a name of a role. Score the references on how closely they match your practice and how specific they were, not on how warm they sounded. If a candidate cannot offer any comparable reference, record that honestly. It may still be a fit, but the other nine criteria then carry the whole decision.

Questions for the discovery call

Ask questions that make a candidate describe what it would do in your office, not what it believes in general: which of your systems it already supports, who answers a call and what happens next, how it tests restores, who holds your admin accounts, and what leaving would involve. Ask every candidate the same questions in the same order.

Bring these to the first call and take notes in the same order for each candidate. This is your sales-call list for the choosing stage; questions about contract wording come later, at the signing stage.

Scope and fit

• • Which dental practice management and imaging systems do you support today?
• • How many dental clients do you currently support, and what size are they?
• • What is explicitly out of scope in your standard agreement?
• • Who else will you need to coordinate with, and who owns that coordination?
• • Which parts of our environment summary would you change, or question, before quoting?

Support and response

• • What are your stated support hours, and what happens after them?
• • How do you classify an urgent chairside issue, and what changes when you do?
• • Who is my day-to-day contact, and who is the escalation point?
• • How is onsite work requested, scheduled and billed?
• • When your proposal says "24/7", which service does that describe?

Security and compliance

• • Which technical safeguards are included at the base tier and which are add-ons?
• • Will you sign a business associate agreement, and what does it commit you to?
• • How do you handle offboarding a staff member's access?
• • How do you support our risk analysis and remediation tracking?
• • What would you do in the first hour if a staff member clicked a phishing link?

Data protection

• • What exactly is backed up, and what is not?
• • How and how often are restores tested, and do we receive the results?
• • What is the documented process if a server or imaging workstation is lost?

Relationship

• • What does the first ninety days look like?
• • What are the most common reasons clients leave you?
• • May we speak with two references that look like our practice?

Communication and planning

• • How will our staff raise a request, and what will they hear back?
• • What does a typical monthly report look like? May we see a redacted sample?
• • How often would we review technology plans and budget, and with whom?

Imaging and equipment

• • Walk us through how you would diagnose a sensor that will not capture in one operatory.
• • How do you keep capture software and sensor drivers working through operating system updates?
• • Are our images in the same backup as the PMS database, and how would we restore one patient's images?

Credentials and exit

• • Will the practice hold the top-level admin accounts from the first day, in its own name?
• • Do your technicians use named accounts, with multi-factor sign-in, when they reach our systems?
• • If we leave, what do you hand back, in what format, how quickly, and is any of it billed?

Write the answers down in the same order for each candidate, and mark which answers came with evidence and which were verbal. That distinction is what the scorecard measures.

Two listening tips help on the call itself. First, notice who asks the questions. A candidate that spends the first ten minutes asking about your software, your imaging and your plans is scoping; one that spends it presenting is selling. Second, ask the same question twice in different words if the first answer was general. "How do you handle backups?" and "When did you last restore a PMS database for a practice our size, and what happened?" are the same question, but only the second one has an answer you can score.

Reviewing the proposal, SLA and contract

Read the agreement before the pricing page. Most disagreements later trace back to scope, not rate.

• • Covered assets. Confirm which devices, servers, users and locations are counted, and what happens when the count changes.
• • Inclusions and exclusions. Look for projects, hardware, third-party software, after-hours work, onsite visits and travel. Ask for the exclusions in writing if the proposal only lists inclusions.
• • Response commitments. Note whether the agreement states a response target, a resolution target, or neither, and how each is measured. A response target is not a repair time.
• • Coverage windows. Confirm the hours each commitment applies to, and the cost of work outside them.
• • Onboarding. Confirm what the onboarding period includes, whether it is billed separately, and what "complete" means.
• • Term, renewal and notice. Note the initial term, auto-renewal behavior and the notice period required to leave.
• • Price adjustments. Note when and how rates can change during the term.
• • Data and exit. Confirm that documentation, credentials and backup data are returned to you at termination, and in what format.
• • Business associate agreement. Confirm it exists as a separate signed document, not a paragraph in the service terms.
• • Subcontractors. Ask whether any part of the service is delivered by a third party, and how that is disclosed.

Ask each provider to map its proposal to the same list. Differences in price often turn out to be differences in scope.

At the choosing stage you only need enough of the contract to compare candidates fairly. When you have a preferred provider, the full pre-signature review, clause by clause, is covered by the contract questions linked in the last section of this guide.

What should a good dental IT contract contain?

A good dental IT contract names what is covered and what is excluded, says who owns each responsibility, defines how service is measured, sets out the term, renewal, notice and price-change rules, includes a separate business associate agreement, and says what is returned to the practice at exit. If any of those is missing, ask for it in writing.

The table below is a comparison tool, not legal advice. It shows what clear wording tends to look like next to wording that leaves room for a later argument. Use it to compare the two or three agreements in front of you; have your own adviser review the one you intend to sign.

Service levels deserve their own reading, because the same words mean different things from one agreement to the next. Our guide to what a dental IT SLA should say covers priority definitions, escalation and how to measure service after you sign.

Compare proposals line by line

Two quotes for the same practice can differ by a wide margin and both be honest, because they describe different work. Before comparing totals, put every proposal into the same grid. Where a proposal is silent, write "not stated" and ask. Do not assume.

When the grid is full, the cheapest proposal is often no longer the cheapest. If one candidate's number still looks low, ask what work it assumes you will do yourselves. For how monthly pricing is usually built, see what dental IT support costs and why quotes differ.

Keep the price grid and the scoring sheet separate. The grid tells you what each proposal buys; the sheet tells you how well each candidate can deliver it. Deciding on one without the other is how practices end up with either an inexpensive provider that cannot do the work or a capable one whose scope they never checked.

Provider scorecard

Score each candidate 0–5 on each criterion, where 0 means no evidence offered and 5 means clear evidence you could verify. Weight the rows that matter most to your practice, and record the evidence rather than the impression.

The 13 rows below are the evidence log. Fill one copy per candidate during weeks 2 and 3, then carry the scores into the side-by-side scoring sheet in the next section.

A scorecard is a decision aid, not a verdict. Use it to make disagreements between partners or office managers explicit, and to notice when a low price is buying a narrower scope.

The thirteen rows group into the 10 criteria. Weight each criterion before the proposals arrive, so the weights reflect your priorities rather than your favourite candidate.

To total a candidate, multiply each criterion's average score (0–5) by its weight, add the results and divide by five. A perfect candidate scores 100. Treat a difference of a few points as a tie and decide on the rows where the gap is widest.

A worked example (hypothetical). Two candidates finish within three points of each other. Candidate A scores 5 on support model but 1 on restore testing, because no one could describe a recent test. Candidate B scores 3 and 4 on the same rows. If your practice has never tested a restore, criterion 4 matters more than the total suggests, and B is the safer choice unless A produces evidence before you decide.

How do you compare two or three dental IT providers side by side?

Put every candidate on one weighted scoring sheet. Apply three knock-out bars first: no dated restore evidence, no separate business associate agreement or no practice-held admin credentials rules a candidate out until fixed. Then score each of the 10 criteria from 0 to 5, multiply by the weight, total out of 100 and decide on the rows with the widest gap.

This is the sheet the rest of the guide feeds. Print it or copy it into a spreadsheet, one column pair per candidate. Each scorer fills it alone first. The weighted score for a row is the score multiplied by the weight, divided by five, so a row's weighted score can never exceed its weight.

Step 1: the knock-out bars. Before adding anything up, check three things. A candidate that fails any of them is not eligible until it fixes the gap, whatever its total:

• • Restore proof (criterion 4) scores at least 2: the candidate has described a dated restore test on a similar setup, or has offered to run one during onboarding and share the result.
• • A business associate agreement will be signed as a separate document.
• • The practice will hold the top-level admin credentials (criterion 7) in its own name.

Add your own knock-outs from the "three things that would make you leave" line on your environment summary.

Step 2: score and weight. The worked example below uses three hypothetical candidates and the starting weights. The scores are invented to show the arithmetic; they describe no real company.

Step 3: read the sheet, not just the total. In the example, Provider 1 gave the most impressive sales call: it knew the software and the helpdesk answers were excellent. But it could not describe a recent restore test, and its documentation answer was vague. It fails the restore knock-out, so it is not eligible until it produces evidence. Provider 2 has no single standout row but no weak one either, and it leads on the two heaviest criteria. Provider 3 has the best onsite answer, which matters if your office has a build-out coming, but trails on security and contract terms.

The decision in this example is Provider 2, unless Provider 1 produces a dated restore record and a clear credentials statement before you decide. If it does, rescore criteria 4 and 7 and compare again. This is the most useful property of a weighted sheet: it tells you exactly what evidence would change the answer.

Step 4: tie-break rules. If two eligible candidates finish within five points of each other:

1. 1. Compare criteria 4 and 7 first. Recovery and the ability to leave are the hardest things to fix after signing.
2. 1. Then compare the row where the scorers disagreed most, and ask that candidate for the missing evidence.
3. 1. Then call one more reference for each, chosen by you rather than offered by them if your peers can suggest one.
4. 1. Only then let price break the tie, using the normalised grid rather than the headline monthly figure.

Step 5: keep the sheet. File the filled sheet with the signed agreement. At 90 days, score the provider you chose on the same ten rows. A falling score on a specific row is a specific conversation, backed by a record of what was promised.

How should a solo office, a group or a specialty practice weight the criteria?

Weight what is most likely to hurt your kind of practice. A solo general office usually leans on the helpdesk, backup and credentials. A two- or three-location group leans on documentation, reporting and onsite coverage. An imaging-heavy specialty moves weight to imaging and software. A practice buying or opening an office moves weight to onsite work and contract terms.

The starting weights earlier in this guide suit a typical one-location general practice. The table shows common adjustments. Each column still adds to 100; move points between rows, never add them.

Two notes on using the table. First, "imaging-heavy" means more than one imaging system or a CBCT, a panoramic unit and intraoral scanners in daily use; a single sensor set does not need the specialty column. Second, a practice that is opening a new office has its own checklist for the build itself, which belongs to dental startup IT; the weights here only cover choosing who will support it.

What counts as evidence, and what is only a claim?

Evidence is something you can see, keep or check: a document, a redacted sample, a dated record, a walk-through of your own systems, or a reference who describes a specific event. A claim is a statement about the provider that you cannot check. Score evidence; note claims, and ask for the evidence behind them.

Most sales conversations are full of claims, and that is normal. The point of the sheet is to convert as many of them as possible into evidence before you decide. The table gives one example of each for every criterion.

A reasonable rule for scoring: a verbal answer that is specific and consistent across two people at the provider can earn a 2 or 3. A written answer earns a 3 or 4. A document, sample or record you could show someone else earns a 4 or 5. Nothing earns a 5 without something you could keep.

Onboarding and transition questions

The transition is where most of the early risk sits, especially if you are replacing an incumbent provider.

• • What is the sequence of the first thirty, sixty and ninety days, and who owns each step?
• • What information do you need from us, and by when?
• • How will you document our environment, and when do we receive that documentation?
• • How will credentials be transferred, rotated and stored?
• • What happens if the outgoing provider is slow or uncooperative?
• • Which changes are planned during onboarding, and which are deferred until later?
• • How will patient-facing disruption be minimised during any cutover, and what is the rollback plan?
• • What will you tell us if you find something worse than expected?
• • Who signs off that onboarding is complete, and against what checklist?
• • Which work will happen after hours, and how will the team know what changed when they arrive in the morning?
• • When will the first restore test under your management take place, and will we see the result?

Agree in advance on how discovery findings are handled. It is common for onboarding to surface unbacked-up data, unsupported operating systems or undocumented equipment, and it is better to know how that conversation will run before it happens.

Ask each finalist how it would price those findings: as part of onboarding, as a separate project, or as a recommendation for you to decide on later. The answer tells you whether the onboarding fee is a fixed price or a starting point. The step-by-step handover itself is covered in our guide to how to switch dental IT providers without downtime.

Red flags, stated fairly

The choosing-stage red flags are vague scope, compliance or security guarantees, no restore evidence, no escalation beyond one person, pressure to sign, no comparable references, reluctance to sign a BAA, speed numbers without definitions, credentials only the provider holds, and exit costs nobody mentions. None disqualifies a provider on its own; each needs one more question.

These are flags in a sales process. If you are asking a different question, whether your current provider is the problem, the red flags with your current IT company are covered on their own page.

None of the following automatically disqualifies a provider. Each is a prompt to ask one more question.

• • Vague scope. A proposal that lists benefits but not covered assets and exclusions is difficult to hold anyone to.
• • Compliance guarantees. A provider that says its tooling delivers your HIPAA compliance is overstating what any vendor can do. Compliance depends on your policies, training and practices as well as technology.
• • Absolute security claims. Language such as "eliminates the risk of ransomware" describes an outcome no control can promise. Ask instead about layered controls, detection and tested recovery.
• • No restore evidence. If nobody can describe the last restore test, backups are unverified.
• • Single point of contact with no escalation. Convenient until that person is unavailable.
• • Pressure to sign quickly. A short-dated discount is a sales tactic, not a fit assessment.
• • No references. Confidentiality is a legitimate constraint, but most providers can arrange at least one comparable conversation.
• • Reluctance to sign a BAA. For a provider handling systems with patient data, this is a basic requirement.
• • Everything is included. Very broad claims with no exclusions usually mean the exclusions are elsewhere in the contract.
• • Speed promises without definitions. A fast-sounding number that does not say what it measures (first reply, a technician starting work, or the fix) cannot be compared with anything. Ask what is measured and when the clock starts.
• • Credentials only they hold. If the proposal does not say you keep a copy of administrator passwords and documentation, ask why.
• • Product lists instead of process. A slide of security brand names says what was bought, not how it is run, watched or tested.
• • No questions about your office. A provider that quotes without asking about your software, imaging and plans is quoting a template.
• • Exit costs nobody mentions. If leaving involves a fee or a delay in returning your data, it should be written down now.

How a red flag is answered matters as much as the flag. A candidate that says "we don't do that, and here is who does" is often a better partner than one that says yes to everything.

Checking references usefully

Two focused conversations are worth more than a page of logos. Ask references about process, not satisfaction:

• • What happened the last time something broke during patient hours?
• • How long did onboarding actually take, and what surprised you?
• • What do you handle yourselves that you expected the provider to handle?
• • Has anything in scope or price changed since you signed?
• • What would you check more carefully if you were choosing again?
• • Who from the provider do you actually speak to in a normal month?
• • Have you seen a restore test result, or a report you found useful?
• • If you added a location or new equipment, how did they handle it?

Public reviews are useful for patterns rather than verdicts. Read the substance of what reviewers describe, note the dates, and treat a small number of reviews as thin evidence in either direction.

Ask for references that resemble you: a similar number of operatories, the same practice management system and an onboarding within the last two years. If you can, speak to the office manager as well as the owner, because they make most of the calls. Apply the same test to us. Legend Networking's public record is a 4.8 rating · 173 Google reviews; read what reviewers describe rather than the number.

When you read public reviews for any candidate, sort them into three piles: reviews that describe a specific event (an outage, a move, an onboarding), reviews that describe a feeling, and reviews that describe the sales process. Only the first pile tells you much about the work. Look at how the provider replied to critical reviews, too. A specific, calm reply that says what was done is a fair sample of how it handles a problem.

Apply this scorecard to us

We wrote this guide to be used on every candidate, so here is what we can state, in the same terms, for the criteria above. Legend Networking is headquartered in Dallas and has served over 3,500 practices since 2004. This guide's author is Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps.

• • Helpdesk model (criterion 5): a staffed 24/7 helpdesk at 1-800-794-1588, plus 24/7 monitoring. In-house engineers; no outsourced first-level triage.
• • Onsite model (criterion 6): onsite dispatch by appointment across served dental markets; remote-first nationwide.
• • Dental software depth and imaging (criteria 1 and 2): the platforms whose IT environment we support include Dentrix, Eaglesoft, Open Dental and Archy, and DEXIS, Vatech, Carestream, Planmeca/Romexis and Dolphin Imaging.
• • Contract terms (criterion 8): pricing for our dental IT support is starting at $360 per month; hardware procurement, major cabling projects and software licensing are quoted separately, and new-practice (startup) projects are custom quoted.
• • References (criterion 9): our public record is a 4.8 rating · 173 Google reviews. Ask us for references that match your practice, as you would anyone else.

Everything else on the scorecard, including security as a process, restore testing, documentation and credentials, reporting and comparable references, is something to ask us for in writing, the same as anyone else. Score our answers on the same sheet, with the same knock-out bars.

What to ask your IT provider: the one-page version

If you only have time for ten questions, ask one per criterion and score each answer from 0 to 5 on the spot. These are the questions that most quickly separate evidence from claims; the longer lists above are for the full discovery call.

1. 1. Dental software depth. "Walk us through the last upgrade you did on our practice management system, step by step, and tell us who did it."
2. 1. Imaging. "Our sensor will not capture in operatory 3. What do you check, in what order, and when do you call the imaging vendor?"
3. 1. Security. "What happens in the first hour after a staff member clicks a phishing link? And how do your own technicians sign in to our systems?"
4. 1. Backup with restore proof. "When did you last restore a PMS database and images for a practice our size, and may we see the record?"
5. 1. Helpdesk model. "When our front desk calls at 7:45 on a Monday, who answers, and what happens if that person cannot fix it?"
6. 1. Onsite model. "How is an onsite visit requested, scheduled and billed, and who comes?"
7. 1. Documentation and admin credentials. "Will the practice hold every top-level admin account in its own name from day one, and may we see a redacted sample of your documentation?"
8. 1. Contract terms and exit. "What is the term, does it renew automatically, what is the notice period, and what do you hand back if we leave?"
9. 1. References. "May we speak to two practices with our number of operatories and our PMS, including an office manager?"
10. 1. Reporting and planning. "May we see a redacted monthly report, and how often would we sit down to plan?"

Bring this list to every call, in this order. When the answers are in, you have a first-pass scoring sheet before the proposals even arrive.

After you choose: contract, then transition

Choosing is the middle of the process, not the end. Two steps follow, and each has its own guide.

First, the contract. With one preferred provider, go through the agreement clause by clause: scope, exclusions, term, renewal, exit and the business associate agreement. Our 20 questions to ask before signing a dental IT contract is built for that stage, and the guide to what dental IT services include, linked at the top of this page, helps you check that nothing you scored is missing from the scope.

Second, the transition. Give your current provider notice in the way the old contract requires, collect credentials and documentation, and agree a cutover plan with the new provider before any change is made. The switching guide linked in the onboarding section walks through the handover in order.

Keep your scorecard. At the 90-day mark, score the provider you chose against the same rows. Where the score has fallen, you have a specific conversation to have, and a record of what was promised.