Dental Practice Acquisition IT Due Diligence Checklist: Technology, Software, Security and Hidden Costs

The letter of intent is signed and the closing date is on the calendar. Your attorney is reading the lease, your CPA is working through three years of collections, and the broker's checklist gives the practice's technology a single line: "computers and software included." That line is where buyers get surprised.

Here is the direct answer. IT due diligence when buying a dental practice means confirming four things before you close: who owns the practice software and its data, whether the servers, workstations and network are still supported, whether the backups can actually be restored, and who holds every administrator login. Then plan the first 30 days so patients keep being seen while control changes hands.

This guide is written for the buyer: an associate buying a first practice, or an owner adding a second or third office. It gives you a packet to request from the seller this week, a pre-close risk table you can hand to your attorney and CPA, and a 30-day handover worksheet for the weeks after closing.

Acquisition IT Diligence Room

A diligence room is a simple scorecard for the incoming practice: eight evidence folders, each rated green, yellow or red, with the remediation it needs and how much money that remediation could move. Rate each folder from documents and tests, not from what anyone tells you on the walkthrough.

Use the eight cards below as the folder structure. Green means the evidence is in hand and nothing needs fixing before or soon after close. Yellow means the evidence is incomplete or a fix is needed within the first 90 days. Red means a finding that should be quoted in writing and raised with your attorney before you sign, because it may become a price adjustment, a credit or a closing condition. The exposure bands are deliberately not dollar figures: the same finding costs very different amounts in a four-operatory office and a twelve-operatory office, so get a written quote for every yellow and red card.

What does IT due diligence include when you buy a dental practice?

IT due diligence covers twelve areas you will inherit at closing: practice software and data, imaging, servers, workstations, network, backups, security, remote access, email and domain, phones, contracts and vendor agreements, and administrator credentials. For each, request evidence, know the red flag, estimate the cost exposure and name who can confirm it.

The table below is the pre-close risk table. Send the "What to request" column to the seller (through the broker if that is how the deal runs) and hand the finished table to your attorney and CPA. "Who confirms" matters because the seller's word is not evidence: most rows can only be confirmed by a vendor, the incumbent IT provider or a test.

Two notes on using the table. First, cost exposure is a band, not a price: a "high" row means get a written quote before you sign, so the number exists when your attorney decides whether it becomes a closing condition, a holdback, a credit or a price adjustment. Second, a row the seller cannot answer is itself a finding. A practice that cannot produce a backup report or a list of who has administrator access is telling you how the technology has been run. If the answers point to a fresh start after closing, it may be simpler to switch to a managed IT plan than to inherit the seller's arrangement.

Request an IT Diligence Packet Before the Site Visit

Do not start with "what computers do they have?" Start by requesting evidence that reveals ownership, supportability and recoverability before you spend onsite time. The site visit should confirm the packet, not replace it.

Send the request in writing, as one list, early enough that the seller's IT provider has time to answer before closing. A practical packet looks like this:

1. 1. A hardware inventory: every server, workstation (front desk, operatories, doctor's office, sterilization), printer, scanner and network device, with age and operating system.
2. 1. The PMS licence or subscription agreement, the vendor support contract and the current version.
3. 1. A list of imaging devices and software, with where images are stored.
4. 1. The last three months of backup job reports and the date and result of the last test restore.
5. 1. The IT provider agreement, plus internet, phone and copier contracts.
6. 1. Domain registrar, DNS and email tenant details, with the current administrator list.
7. 1. A list of remote-access tools and the vendors who use them.
8. 1. Any security risk analysis or security assessment the practice has on file.
9. 1. A list of vendors that handle patient data for the practice, with their business associate agreements.
10. 1. A named contact at the incumbent IT provider who will attend a handover meeting.

You do not need patient charts to answer any of this. Ask for system reports, inventories and contracts, and leave clinical records out of the request. The HIPAA Privacy Rule's definition of health care operations names the sale, transfer, merger or consolidation of a covered entity and "due diligence related to such activity" (45 CFR 164.501); how that applies to your transaction, and what your purchase agreement should say about it, is a question for your transaction attorney.

Watch how the packet comes back. Some sellers produce everything in a week; others cannot pull basic reports. A seller who cannot produce a backup report or a hardware list is not necessarily hiding anything, but the gap belongs in the risk table as a red or yellow row, and it usually means more of the work lands on you after close. Line up your own dental practice IT support before closing, so someone is ready to take over credentials, backups and security from the first day.

Confirm Who Owns the PMS, Data and Export Rights

The buyer needs more than the software name. Confirm licensing and account ownership, database hosting, data-export rights, conversion availability, contract transfer and how historical access will work after closing.

Ask the PMS vendor directly, and get the answers in writing. Desktop systems such as Dentrix, Eaglesoft and Open Dental usually run on a server in the office; cloud systems such as Denticon or Curve run on the vendor's platform under an account in the practice's (or the seller's) name. Either way, the questions are the same:

• • Whose name is the licence or subscription in today, and what does the vendor need to move it to the new owner or the new legal entity?
• • Is there a fee, a waiting period or a new agreement?
• • Can the practice produce a full export of patient, ledger, insurance and clinical data, and in what format?
• • Are images stored in the PMS database or in a separate imaging store, and are both included in any export?
• • If you later convert to another system, which data converts and which stays behind as read-only history?
• • Will the seller, or anyone acting for the seller, keep access to the system after closing, and how is that access removed?

If the answers point towards a software change, do not plan it for closing day. Price it separately, and read our breakdown of dental software migration cost and timeline before you agree to anything with a date in it.

Inventory Infrastructure and Price the Lifecycle Gap

Technology value should reflect age, support status and replacement need, not just whether the device turns on today. Price likely server, workstation, firewall, switch, Wi-Fi and UPS replacements into the integration plan.

Support dates are the fastest way to separate "old but fine" from "a replacement you are buying." Microsoft's lifecycle pages list Windows 10 Home and Pro as reaching end of support on October 14, 2025, and Windows Server 2016's extended support as ending in January 2027. A Windows 10 workstation in an operatory today needs either an extended security update arrangement or a replacement, and a server on Server 2016 is a project you will run in your first year whether or not you planned it.

Get the inventory from a scan or the IT provider's management console rather than a spreadsheet the seller filled in from memory. Then put each line into one of three buckets: keep, replace within 90 days, or replace within the first year. That gives your CPA a capital plan rather than a single scary number. For the server itself, the choice between replacing it and moving to hosted services is its own decision; our guide to dental server replacement vs cloud migration walks through it.

Infrastructure Lifecycle Gap & Remediation Table

Verify Backups with Restore Evidence

Ask for evidence of successful backup jobs and evidence that critical data can be restored. A practice with "backups" but no tested recovery may carry materially more operational risk than the diligence packet suggests.

The HIPAA Security Rule lists a data backup plan and a disaster recovery plan as required parts of a covered entity's contingency plan, and testing and revision of those plans as an addressable one (45 CFR 164.308(a)(7)). For a buyer, the practical question is simpler: if the server failed the week after closing, could the practice get its schedule, ledger and images back?

What counts as restore evidence:

• • A dated record of a test restore of the PMS database, showing that the restored copy opened and the latest appointments were present.
• • A dated record that imaging files restored and opened, since images are often backed up by a different job, or not at all.
• • Job reports showing where each copy lives: on the server, on a device in the office, and off site or in the cloud.
• • Confirmation that at least one copy is kept off the practice network, so a problem on the network does not reach every copy.

If none of that exists, do not argue about it before close; record it as a red row and plan a witnessed test restore in the first week you own the practice. Our dental backup and disaster recovery checklist has the full restore-test steps.

Assess Cybersecurity and Access Before Credentials Change Hands

Pre-close diligence should reveal high-level security posture; Day 1 should establish buyer control over identity and administrative access without unnecessarily disrupting clinical systems.

Before close, you are looking for signs, not running a full audit. Three checks carry most of the weight. First, remote access: CISA's guidance on the misuse of remote monitoring and management software tells organisations to "audit remote access tools on your network to identify currently used and/or authorized RMM software." Every remote tool on the seller's machines should map to a vendor you can name. Second, administrator accounts: list who has them and whether each still works at the practice. Third, email: confirm multi-factor authentication on the email tenant, because email is where invoices, insurance correspondence and password resets land.

If something looks wrong, such as an unexplained remote tool, an administrator account nobody recognises or signs that someone else has been in the system, stop and tell your attorney. That is a finding to resolve before closing, not a cleanup task for later. For a structured self-check you can run after close, use our dental cybersecurity risk assessment checklist.

Access Control & Credential Transition Matrix

On the email tenant, Microsoft's own guidance describes the situation buyers inherit: one of its listed reasons for emergency access accounts is that "the person with the most recent Global Administrator access leaves the organization." Microsoft recommends two or more cloud-only emergency access accounts, validated at least every 90 days. Setting those up on Day 1 means a departing owner cannot lock you out by accident. The Security Rule also lists procedures for terminating access when a workforce relationship ends (45 CFR 164.308(a)(3)(ii)(C)); the closing date is a natural point to apply whatever termination procedures the practice has.

Read the Incumbent IT and Software Contracts

Review term, auto-renewal, termination, change-of-control, hardware ownership, backup and data access and offboarding requirements before close. The technical handoff can be constrained by contracts the buyer never saw.

Read these with your attorney, who decides what they mean for the deal. From the IT side, the questions are:

• • Term and notice. When does the IT agreement renew, and how much notice does ending it require? A 60- or 90-day notice period that starts after closing can mean paying two providers.
• • Change of control. Does the agreement continue automatically with a new owner, or end on a sale?
• • Hardware ownership. Is the firewall, backup device or server leased or owned by the IT provider? If so, it leaves with them.
• • Data and backup access. Where are backup copies stored, under whose account, and how are they handed over? Business associate contracts are expected to provide that, at termination, the vendor returns or destroys the patient information it still holds where feasible (45 CFR 164.504(e)(2)(ii)(J)), so ask what the incumbent will hand over and what it will destroy, and when.
• • Responsibilities. CISA advises managed service customers that the contract should state "whether the MSP or the customer owns specific responsibilities." If the seller's agreement is silent on backups, patching or security monitoring, assume nobody was doing them.
• • Offboarding. Is there a documented exit process: credentials handed over, monitoring agents removed, vendor accounts disabled?

Business associate agreements with vendors that handle patient data (the PMS host, the backup vendor, the IT provider, a billing service) need the same attention. Whether the seller's agreements carry over or you sign new ones is a contract question for your attorney; the IT task is to make sure you have a complete vendor list so nothing is missed. If you decide to change IT providers after closing, the steps in how to switch dental IT providers without downtime apply directly.

What should the first 30 days after closing look like?

The first 30 days should move control of every system to the new owner without interrupting the schedule: credentials on Day 1, a witnessed backup restore by Day 3, contracts and licence transfers in week 1, an imaging bridge test in week 2, and a Day 30 sign-off that moves every open item to the 90-day plan.

This is the post-close handover worksheet. Print it, give each line an owner, and keep the evidence column filled in: it becomes the record your next IT review, your insurer or a future buyer will ask for.

Two habits make the worksheet work. Keep the evidence in one folder rather than in someone's inbox, and do not tick a line on a verbal "it's done." The Day 3 restore in particular should be watched by someone from the practice, because it is the only line that proves the most important asset you bought can be recovered.

Separate Day-1 Controls From the 90-Day Integration Roadmap

The buyer's first objective is safe operational control, not instant standardization. Day 1 should secure ownership and access and maintain patient care. Standardize systems after discovery and prioritization.

The 30-day worksheet is about control. The 90-day roadmap is about improvement, and it should be built from what the first month found rather than from a template. That order protects production: a practice that changes owner, IT provider, passwords, workstations and software in the same week is a practice where the schedule slips.

30 / 60 / 90 Day Integration Roadmap

Do Not Force a PMS Migration on Closing Day

A same-day software conversion adds training, data, imaging and integration risk to an already complex ownership transition. When possible, stabilize access and support first, then migrate with a dedicated plan.

A conversion touches everything the team uses: the schedule, ledgers, insurance, treatment plans, clinical notes and the imaging bridge. Doing it on closing day means the staff learn a new owner, a new system and possibly a new IT provider at once, with no way to tell whether a problem comes from the conversion or from the handover. If the deal or a group standard requires a change, schedule it after the Day 30 sign-off, run a test conversion first, and keep the old system available read-only until the new one has been checked against it. Our dental PMS migration cutover plan sets out the freeze, test-conversion and rollback steps.

What should you do with the seller's old server, records and imaging archive?

Decide before closing who will own the old server, the PMS history and the imaging archive, how patients' history stays reachable for the whole retention period, and how the hardware is wiped when it is finally retired. These systems still hold patient information after a conversion, so each needs a named owner.

Most acquisitions keep the old systems for a while, either because the practice keeps using them or because history did not convert cleanly. Before any drive or machine leaves the building, work through this list:

• • Name an owner for the old server, the imaging archive, old backup drives and any cloud accounts the seller used.
• • Ask your attorney how long records must be kept in your state. HIPAA's documentation rule requires that policies, procedures and similar required documentation be retained for six years (45 CFR 164.316(b)(2)); how long patient charts themselves must be kept is a separate question for your attorney and your state dental board.
• • Keep history searchable. Patients can request copies of their records, and the Privacy Rule gives a covered entity 30 days to act on a request, with one 30-day extension if it tells the patient in writing why and when (45 CFR 164.524(b)(2)). An archive nobody can open makes that deadline hard to meet.
• • Keep the old system off the production network if it runs an unsupported operating system, and limit who can log in.
• • Sanitize before disposal. When a drive is retired, wipe or destroy it following NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (published September 2025); file the sanitization certificate alongside the practice's compliance records.
• • Close the old vendor accounts last, after you have the data you need, and ask each vendor what it returns or destroys.

Is IT due diligence different for a DSO or multi-location group?

For a group, the question is not only whether the acquired office works but how it connects to everything else. Linking a new office to shared email, a central PMS database or site-to-site networking before its security is brought to the group's baseline extends its weaknesses to every location, so connect it last, not first.

Groups should add three things to the process above: a readiness check against the group's own baseline (identity, endpoint protection, backups, network segmentation) before the office joins shared systems; a standard handover worksheet used at every acquisition so results are comparable; and a timeline for bringing the office onto the group's PMS and imaging standards as a separate project. For the group-level view, see our DSO IT support services guide, and for how Legend approaches groups, our DSO and multi-location dental IT support page.

Build a Red/Yellow/Green Technology Risk Register

Translate technical findings into deal and integration language: severity, evidence, operational impact, estimated workstream and when it must be addressed. Record missing elements with a red flag for post-close adjustment.

The risk register is the pre-close table turned into one row per finding. Use the same colours as the diligence room, and keep these columns:

Keep the "deal treatment" column for the people who own it. The IT job is to make sure every red row has evidence and a written quote behind it; what happens to that number in the purchase agreement is a decision for the buyer and their advisors. The same register, updated after the Day 30 sign-off, becomes the practice's technology plan, and it is the document a lender or a future buyer will want to see if the practice changes hands again, whether through a sale or a dental practice transition to a partner.

What to ask your IT provider before closing

Whether you are asking the seller's incumbent provider, your own provider or one you are considering, these questions turn the diligence room into answers you can check:

1. 1. Can you produce a hardware inventory from your management console, with operating system, age and warranty for every device?
2. 1. When was the last test restore of the PMS database and of the imaging files, and can we see the record?
3. 1. Where does each backup copy live, and is one kept off the practice network?
4. 1. Which remote-access and remote-management tools are installed, and who uses each one?
5. 1. Who holds administrator access to the server, firewall, email tenant and domain registrar today?
6. 1. Which devices or appliances in the office belong to you rather than the practice?
7. 1. What does your agreement require on notice, and what is your offboarding process when a client leaves or is sold?
8. 1. Which vendors do you coordinate with for this practice, and are their contacts and agreements documented?
9. 1. Which workstations or servers are on an operating system past or near its end of support?
10. 1. Will you attend a handover meeting with the new owner's IT provider before closing, and hand over credentials on the closing date?

A provider who answers quickly and in writing has probably been running the office well. A provider who cannot answer several of these is giving you rows for the risk register.

Your Practice Needs Clear Technology Ownership

After closing, every system in the office needs a named owner: someone who holds the administrator login, knows when the next renewal or end-of-support date falls, and answers when an operatory cannot open an image. Buyers who settle that in the first month spend the rest of the year improving the practice instead of rediscovering it. Keep the risk register and the signed 30-day worksheet together, and review them each quarter.

If you want to know who would stand behind the technology after closing, these are the Legend Networking facts to put next to any other provider's answers:

• • Track record: Served over 3,500 practices since 2004.
• • Engineers: In-house engineers; no outsourced first-level triage.
• • Monitoring: 24/7 monitoring.
• • Onsite: Onsite dispatch by appointment across served dental markets; remote-first nationwide.
• • Operations: Legend's operations are led by Ian Lynch: 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps.
• • Reviews: 4.8 rating · 173 Google reviews.