Managed IT for Maryland Dental Practices, From Baltimore to Kent Island: The Plan, the Contract and the Cost

Tuesday, mid-morning, a perio block in Towson: the imaging PC lost its link to the server, two patients were rescheduled, and the IT company, which bills by the hour, could come Thursday.

On Thursday the technician rebooted the server, said the imaging share had dropped, and left an invoice. Nothing in that arrangement was watching the share between visits, and nobody was paid to.

The rest of this page is for the owner of one or two locations in the Baltimore area or elsewhere in Maryland (Towson, Columbia, Ellicott City, Annapolis, Bel Air, Jessup, Kent Island) who has just had a week like that one and is starting to compare. It covers what a plan should be watching while nobody is calling, the two lines of Maryland law that belong in any conversation about an IT agreement, what the three common arrangements cost, what to sort out before the next big storm, how a Dallas-headquartered provider reaches a Maryland office, and what to ask before you sign anything.

What should a Maryland dental practice expect a managed plan to do every week?

A managed plan should do work every week that nobody in the practice asks for: install patches on a set night, confirm last night's backup finished and can be restored, watch the firewall and server for warnings, and keep staff Microsoft 365 accounts tidy, leaving a record the practice can ask to see.

The Towson morning above is the sort of failure that tends to have a history. An imaging share that drops usually dropped before, quietly, after a Windows update or a power blip, and somebody reconnected it without writing anything down. Under an hourly arrangement no one is paid to notice that pattern. Under a managed plan, noticing it is the job.

The cleanest way to judge a plan is to split the office into the things the provider is paid to watch and the things the practice still owns no matter who its provider is. Proposals tend to blur that line. The table below draws it for the systems a one- or two-location Maryland office actually runs.

Two things are worth noticing in that table. First, the right-hand column is the useful one. A provider that is really watching can show you a dated record without much effort; a provider that is guessing will talk about "proactive service" instead. Second, the middle column is where vendors and your own staff meet. The plan can see that the imaging PC has lost its share, but the imaging software licence is still between you and the imaging company. A good agreement says plainly which side picks up the phone to whom.

For the general description of the service, outside any one state, start with Legend's page on managed IT services for dental practices and the dental managed IT buyer's guide, which goes component by component.

On the software side, a Maryland office running Dentrix, Eaglesoft, Open Dental or Archy, with images in DEXIS, Vatech, Carestream, Planmeca/Romexis or Dolphin Imaging, is running products whose IT environment Legend supports. That is a statement about the computers, network and backups those products run on. What happens when the fault is inside the vendor's own software is a separate question, and it belongs in the agreement, in writing, before you sign.

What does Maryland law say about the contract with your IT provider?

Maryland's Personal Information Protection Act requires a business that hands Maryland residents' personal information to an outside service provider under a written contract to require, in that contract, reasonable security from the provider. A separate line gives a business that holds data it does not own 10 days to tell the owner about a breach.

This section quotes the statute and stops there. It is not legal advice, and how these lines apply to a particular practice is a question for the practice's own counsel. What follows is the part that is useful in a buying conversation: where in a managed agreement each line would show up.

Md. Code, Commercial Law §14-3503(a). This is the baseline the contract line builds on. Anyone keeping personal information about people who live in Maryland has to run security measures appropriate to the kind of data held and to the scale of the operation, which for a dental office means patient charts, insurance details and images. (statute text)

§14-3503(b). This is the line about outside vendors. When patient information passes to a provider such as an IT company "under a written contract", the practice "shall require by contract that the third party implement and maintain reasonable security procedures and practices." It reaches agreements signed "on or after January 1, 2009." Read from the practice's side of the desk: the provider's security duties belong on paper, in the agreement itself, rather than in a sales conversation.

§14-3504(c). This is the line about a provider that is breached while holding your data. It must tell you as soon as it reasonably can and within 10 days at the outside (the full clock is set out in our breach rules guide); it "shall share with the owner or licensee information relative to the breach"; and it "may not charge" you for the information you need to send your own notices. (statute text)

§14-3507(d). Maryland's subtitle also has a deemed-compliance provision for businesses that are subject to and comply with HIPAA (statute text). The breach guide sets out its exact wording; whether it reaches a particular practice, and how, is for that practice's counsel.

The table starts from each statute line and walks it to the place in a managed IT agreement where you would look for it; it is a reading aid for your agreement, not a legal opinion on it.

The fee row is the one most agreements trip over. An agreement that bills every incident hour at the standard rate, with no carve-out for the information the practice needs, deserves a question before signing. For the notice clocks themselves (who tells patients, the Attorney General and the credit bureaus, and when), see the sibling guide to dental data breach rules across DC, Maryland and Virginia; this page deals only with the contract.

Break-fix, an "IT person" or a managed plan: what does each cost a Baltimore-area office?

Break-fix bills each visit by the hour, an independent IT person usually does the same with more familiarity, and a managed plan charges a fixed monthly fee with exclusions listed in writing. Legend's managed plans are Starting at $360 per month. Hardware procurement, major cabling projects and software licensing are quoted separately.

Most Maryland practices that are thinking about switching are on one of three arrangements:

• • Break-fix from a local shop. You call, they schedule, they bill. One provider's published comparison puts industry break-fix rates at roughly $75 to $200 per hour. The cost is unpredictable and so is the arrival date, which is the Towson problem.
• • An independent IT person. Often excellent, often the person who wired the office originally. The knowledge of the practice lives with one person, and when that person is booked, on holiday or unwell, nothing else happens.
• • A managed plan. A fixed monthly fee for a written scope. The same published comparison puts general managed service at roughly $100 to $250 per user per month across the market, and it describes per-user, per-device and flat pricing models, which makes quotes hard to compare line by line.

Those market ranges come from a provider's own page and describe the market as a whole. They are not a Maryland survey and they are not Legend's prices.

Legend publishes its own starting point.

• • Managed plans: Starting at $360 per month.
• • Offsite copies of your data: Backup protection from $39.99 per month (storage-dependent).
• • Quoted separately: Hardware procurement, major cabling projects and software licensing are quoted separately.

What a given practice pays above the starting figure depends on the practice, and the page does not try to guess. The useful exercise is not price against price; it is scope against scope. Put the current arrangement next to any proposal and ask the same questions of each. Who watches backups between visits? Who patches the server? What happens to the bill in a month with a failure? Which items are on a separate invoice? A practice paying a modest amount per visit may find the year's real cost is the visits plus the rescheduled patients plus the days spent waiting.

The national comparison of the two models is in managed dental IT versus break-fix, and the wider budget picture, including one-time costs, is in the 2026 dental IT support cost guide.

What should the plan do before BGE storm nights and snow days?

Before a storm, a managed plan should confirm that the latest backup finished and that an offsite copy exists, check that battery backups can carry the server through a short outage and shut it down cleanly, and know how staff will reach the helpdesk if the office is closed. Afterwards, it should bring systems back in order.

Central Maryland weather is not hypothetical for an office server. The National Weather Service office for Baltimore/Washington lists the January 22–23, 2016 storm as Baltimore's largest two-day snowfall on record, 29.2 inches at BWI. More recently, the January 5–6, 2025 storm left 6.6 inches at BWI, and the NWS write-up describes closures across the region that lasted several days. Summer brings wind instead of snow: when the June 29, 2012 derecho crossed Maryland, the NWS logged a 66 mph peak gust at BWI. (NWS records, 2025 storm, 2012 derecho)

For most Baltimore-area offices the utility is BGE, and power at the building is outside anyone's IT plan. What sits inside the plan is how the office's systems behave when the power goes and when it comes back.

A short pre-storm list for a Maryland practice:

1. 1. The night before: confirm the most recent backup finished and the offsite copy is current. Ask for the confirmation in writing, by email or ticket.
2. 1. Battery backups: make sure the server's battery unit is set to shut the server down cleanly before the battery runs out, rather than letting it drop.
3. 1. Imaging and sensors: know which workstations must be shut down rather than left on, and who brings them back.
4. 1. Remote work: if the front desk will confirm or move appointments from home on a snow day, check that remote access works with multi-factor sign-in before the storm, not during it.
5. 1. Phones: decide where the main number forwards if the office is closed.
6. 1. The morning after: power back first, then network, then server, then workstations, with someone checking the practice software and imaging share before the first patient.
7. 1. Afterwards: a note of what failed and what was replaced, kept with the rest of the plan's records.

Backups and restores have their own service page: dental backup and recovery.

How is support delivered to Towson, Columbia or Kent Island from a Dallas headquarters?

Legend is headquartered in Dallas, and support for an office in Towson, Columbia or on Kent Island starts remotely: 24/7 monitoring of the practice's systems, a helpdesk staffed 24/7 at 1-800-794-1588. Staffing, in Legend's published wording: In-house engineers; no outsourced first-level triage. Onsite work is by appointment, in the wording quoted below.

Legend's published wording for onsite work is: Onsite dispatch by appointment across served dental markets; remote-first nationwide. In practice, most of what failed in Towson, a dropped share, a stalled update, an expired password, is the kind of fault that is fixed from a remote session. Physical work such as replacing hardware is the kind that needs someone in the building, and that is a question to settle by appointment in writing for your address.

Maryland runs on Eastern time and the Dallas headquarters runs on Central. With a helpdesk staffed 24/7 the time difference does not change when a Maryland front desk can call. There is one general number, 1-800-794-1588, for the helpdesk.

The company record, in Legend's published wording: Served over 3,500 practices since 2004 · 22+ years in dental IT (since 2004) · 4.8 rating · 173 Google reviews. The leadership line on the same page reads: Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps.

For what the helpdesk itself should handle, see what a staffed dental help desk should cover and the dental IT helpdesk service. For the city view, see Legend's Baltimore dental IT page.

Which Maryland practices has Legend worked with?

Two Maryland openings are on Legend's published record: Smile Craft Orthodontics in Jessup, and Anchor Periodontics in Stevensville, out on Kent Island. Both were new-office builds rather than years of managed service. For an ongoing-support example, the nearest published case sits across the Potomac: Little Chik Pediatric Dentistry in Fairfax, Virginia.

Being specific about what each project shows is more useful than a list of logos.

Smile Craft Orthodontics, Jessup, Maryland. Jessup lies on the corridor between Baltimore and Washington. Per the /work entry, Smile Craft "is now open in Jessup, Maryland", and Legend Networking "supported the startup launch by helping establish a reliable, secure technology foundation designed for smooth day-one operations in a modern orthodontic office."

Anchor Periodontics, Stevensville, Maryland. For a Baltimore or Annapolis reader, this is the office at the eastern end of the Bay Bridge. In a September 2026 post, Legend reports that the technology infrastructure for Dr. Elizabeth Polak's new practice is being wrapped up; the scope it names is "network infrastructure, workstations, clinical technology and imaging connectivity." Queen Anne's County, the county Kent Island belongs to, went from 49,881 residents in April 2020 to 54,448 in July 2025, according to Census Bureau Vintage 2025 estimates. (Census)

Little Chik Pediatric Dentistry, Fairfax, Virginia. Included because it shows support continuing after opening day, though the office is in Virginia rather than Maryland. Legend announced the opening in August 2025, in posts that "cover the setup of workstations, displays and networking, backed by ongoing support."

Neither project sits inside Baltimore city limits, so for the metro as a whole, from Towson to Columbia, use the page on IT support for Baltimore-area dental offices.

If you are comparing providers, ask each one the same thing: which practices in your state are on a managed plan today, and may you speak to one? A provider's answer, including how specific it is, tells you a lot. Maryland is one piece of a three-jurisdiction market, and our DC, Maryland and Virginia dental IT guide lays out the whole of it. Orthodontists and periodontists, like the two Maryland openings above, will find their own concerns in specialty dental practice IT in the DC area.

How do you move from your current provider without losing a day?

You move by collecting the practice's own access and records before notice is given, so the new provider starts from a complete inventory rather than from what the outgoing one remembers. Then the new provider takes over monitoring and backups while the old arrangement is still in place, and only afterwards does the old access come off.

The step-by-step version is in changing dental IT providers without downtime. The Maryland angle is narrower and worth having before you give notice. Maryland's 10-day line in §14-3504(c) applies to a business holding data it does not own. Before you leave a provider, you want a clear picture of what that provider holds on your behalf, because those are the systems an incident clause in your agreement needs to cover.

What the practice should already hold, in its own name, before the switch:

• • The administrator logins for the server, firewall, Wi-Fi and every workstation, stored somewhere the practice controls.
• • Microsoft 365 global administrator access for at least one person at the practice.
• • The domain registrar and DNS login for the practice website and email.
• • The backup console and the backup encryption key. A backup the practice cannot open without the old provider is not the practice's backup.
• • A list of every place patient data lives: the server, the imaging share, any cloud backup, any hosted service the provider set up, and any copies on the provider's own tools.
• • A copy of the current IT agreement, with the security and incident clauses marked.
• • The vendor contacts for the practice software, imaging, phones and internet, with account numbers.
• • A named person at the practice who receives any incident notice, and the channel it will arrive by.

Most of these items can be gathered in an afternoon if the outgoing provider cooperates, and every one of them is easier to collect before the relationship ends than after.

What to ask your IT provider before you sign

Bring this list to every proposal, including a renewal with the provider you already have. Write the answers down; the useful ones will be specific.

For cybersecurity questions that go beyond the contract, Legend's dental cybersecurity service sets out its own security work.