What Do Dental IT Services Include? A Layer-by-Layer Scope Map for Comparing Quotes

Two proposals are on the desk. One is a page and a half with a monthly figure and the phrase "fully managed." The other runs to six pages, costs more, and lists things you did not know you needed. Your office manager wants to know which one covers the sensor in operatory three, and nobody can say.

That is the short answer. The useful answer is a map, because two quotes can use the same words and buy different things. This guide splits the work into thirteen layers and, for each, shows what is normally inside a monthly plan, what is normally a project, what belongs to the software or equipment vendor, and what your practice keeps. It describes common market practice, not any one provider's plan. For the commercial side of dental IT services and how a managed plan is delivered, see that page; for the wider picture of how support works, start with our complete guide to dental IT support.

How should you read a dental IT quote: by layer or by line count?

Read it by layer. A quote with forty lines is not twice as complete as one with twenty; it may just describe the same help desk in more ways. Sort every line into one of four buckets, usually monthly, usually project, vendor's job or practice's job, then look for the layers that land in no bucket at all.

Four terms do most of the work, and each has a one-sentence meaning:

• • Monthly (recurring) service: work the provider does continuously or on request for a fixed fee, such as answering calls, applying updates and watching backups.
• • Project: a piece of work with a start and an end, quoted on its own, such as replacing a server, adding operatories or moving to a new practice-management platform.
• • Vendor's job: anything only the maker of a product can fix, such as a defect in the practice-management software, a sensor firmware fault or a phone carrier outage.
• • Practice's job: decisions and duties that cannot be handed over, such as who gets access to patient data, which policies apply, and approving spending.

A managed service provider, or MSP, is a company that takes on the monthly bucket for a fixed fee under a written agreement. A dental MSP does the same work with knowledge of the software, imaging devices and patient-data rules a dental office lives with. "What does a dental MSP do?" is really the question "what is in their monthly bucket?", and the honest answer differs from provider to provider. That is why the matrix below asks a question in every row rather than assuming an answer.

Two cautions before the table. First, a word like "unlimited" in a proposal usually applies to one bucket (most often remote help desk calls) and not to projects or onsite time. Second, the gaps matter more than the lines. A layer that appears nowhere in a proposal is either included without being written down, which you want in writing, or not included, which you want to know now.

What does the full scope of dental IT services look like, layer by layer?

The matrix below is the core of this page. Each row is one layer of a dental office's technology. "Usually" means common practice among dental IT providers; individual agreements vary, and the last column is what turns "usually" into a fact for your office.

Three patterns stand out once a real quote is laid against the table. The "usually monthly" column is broadly similar from provider to provider; the differences live in the project column and in the vendor-liaison and onsite lines. The practice's column never empties, whoever you hire. And the rows most often missing from a proposal are phones, onboarding and offboarding, and planning.

What does the help desk part of the fee usually cover?

The help desk is the part of the fee your staff touch every day: a line or portal where someone takes the problem, logs it as a ticket and fixes it remotely where possible. Most monthly plans cover remote help for covered users and devices; onsite visits and after-hours work are where plans differ most and deserve a written answer.

Inside the help desk layer, the usual monthly items are remote sessions to fix a workstation, printer or account problem; password resets and lockouts; small software installs on existing machines; and a ticket record you can see later. Things that commonly sit outside it are onsite visits, which are often billed by the hour or limited to a number per year, and work that turns out to be a project, such as rebuilding a failed server.

Ask four things about this layer: which channels exist (phone, email, portal), when a person is at the desk, whether the first person you reach works for the provider, and how a problem moves from "remote" to "someone comes to the office." Never accept a response or resolution time as a promise unless it is written into the agreement with what happens when it is missed; our guide to how a dental IT helpdesk works around the clock explains what to look for without relying on timings.

For reference, Legend Networking runs a staffed 24/7 helpdesk at 1-800-794-1588, and its published position is in-house engineers; no outsourced first-level triage. Onsite work is described as onsite dispatch by appointment across served dental markets; remote-first nationwide.

What do monitoring and patching cover, and what happens after an alert?

Monitoring means software on each server, workstation and network device reports problems, such as a failing disk, a stopped backup or a missed update, to the provider before staff notice. Patching means the provider applies operating-system and approved software updates on a schedule. Both are normally inside the monthly fee; replacing machines that can no longer be patched is not.

An alert is only useful if someone acts on it. A proposal that says "24/7 monitoring" tells you the watching happens around the clock; it does not, by itself, tell you who reads the alert at night or what they do. Ask for the list of what is monitored and a sample of the monthly report, because a provider that genuinely watches your systems can show you what it saw.

Patching has a dental wrinkle. Imaging acquisition workstations and some practice-management servers can break after an update the vendor has not yet approved, so a careful provider holds certain machines back and tests them after updates. Ask which machines are deferred and how they are tested.

Patching also has an end date. Microsoft states that "Support for Windows 10 ended on October 14, 2025," and that it "no longer provides software updates, security fixes, or technical assistance to Windows 10 PCs." Tracking which of your computers are past that line is monitoring work; buying their replacements is a project. A quote that blurs the two will surprise you later.

Which security services are usually inside a monthly plan, and which are add-ons?

Most dental IT plans include endpoint protection on covered computers, management of the firewall's rules and updates, basic email filtering, and account settings such as multi-factor sign-in where the practice uses it. Advanced email security, threat-detection services, security awareness training and new firewall hardware are often priced separately. The proposal should name each tool.

Security is the layer where vague wording costs the most, because "security included" can mean anything from a basic antivirus licence to a managed detection service with people watching it. List the tools by name in both quotes and compare like with like. If one quote includes a tool the other prices as an add-on, adjust the comparison before you compare prices.

The HIPAA Security Rule asks for "Procedures for guarding against, detecting, and reporting malicious software" (45 CFR 164.308(a)(5)(ii)(B)). An IT provider can operate the tools that make that possible; your practice still decides who has access to what, and staff still decide what to click. To see how a dedicated security service fits beside a monthly plan, read about cybersecurity services for dental practices.

What does backup in a dental IT plan cover, and how do you know it works?

Backup in a monthly plan usually means the provider runs and watches backup jobs for your server, practice-management database, imaging store and shared documents, and alerts when a job fails. The part buyers miss is the restore test: proof that a copy can actually be brought back. Ask how often a restore is tested and whether you see the result.

The HIPAA Security Rule describes a data backup plan as procedures "to create and maintain retrievable exact copies" and a disaster recovery plan as procedures "to restore any loss of data" (45 CFR 164.308(a)(7)(ii)(A) and (B)). Retrievable is the key word: until a copy has actually been brought back and opened, nobody knows it can be.

Storage is the usual extra. Many plans include a set amount of backup storage and charge for more, and some price backup as a separate line. Legend's published backup line, for example, reads: Backup protection from $39.99 per month (storage-dependent). If your practice runs cloud-hosted practice-management software, the vendor backs up its own hosted data, but your imaging, documents and local machines may still need a backup of their own. Ask each provider to list which data sets their backup covers. For how a recovery plan is built, see backup and disaster recovery for dental practices.

Where does network management end and a network project begin?

Network management in a monthly plan normally covers watching the firewall, switches and Wi-Fi, keeping their firmware current and making small configuration changes. A network project is anything that adds or replaces hardware or cabling: new drops for an operatory, new access points, a second internet line or a redesign that separates guest Wi-Fi from clinical systems.

The grey zone is configuration work that takes hours rather than minutes, such as setting up a new segment for a new operatory or a remote-access change for an associate. Some providers treat that as a ticket; others quote it. Ask where the line falls and get one example of each in writing.

The internet line belongs to the carrier. When the line is down, your IT provider can confirm it, open the case with the carrier and switch to a backup connection if you have one, but the repair is the carrier's. A second internet path is usually a project and a monthly carrier cost, not part of an IT fee.

Are workstations and operatory computers supported, replaced, or both?

Support of existing workstations, including troubleshooting, software installs, printer and peripheral setup and user changes, is normally monthly. Buying, imaging and installing new computers, monitors or operatory hardware is normally a project or a hardware quote. The question that separates quotes is whether setting up a replacement computer counts as a covered request or a billable job.

Legend's published pricing puts it plainly: "Hardware procurement, major cabling projects and software licensing are quoted separately." Most providers treat hardware the same way; whether setup labour sits inside a monthly fee varies from provider to provider. When you compare, ask each provider how a replacement computer for an operatory is priced end to end: the machine, the setup time and the trip if someone has to come to the office.

Operatory computers often carry imaging drivers, intraoral camera software, signature pads and second monitors. A provider that supports "workstations" should be able to say which of those peripherals it configures and which it hands to the device vendor.

Who looks after the practice-management and imaging environment?

The IT provider usually keeps the environment healthy: the server or host, the database service, the workstations, the drivers and the network the software needs. The software or device vendor fixes defects in its own product and licenses it. Migrations to new platforms, major upgrades and new imaging devices are normally projects.

This is the boundary buyers ask about most, because a failure rarely announces whose it is. A sensor that reads "not detected" might be a USB port, a driver, a Windows update or the sensor itself. A practice-management error might be the database service on the server or a defect in the release. An experienced dental provider works through the parts it owns and brings the vendor in when the fault is in the product.

The software you name in the quote should be in the proposal by name. Legend supports the IT environment for practice-management platforms Dentrix, Eaglesoft, Open Dental, Archy, and for imaging systems DEXIS, Vatech, Carestream, Planmeca/Romexis, Dolphin Imaging; its practice-management software and imaging support page has the detail for each. Other platforms such as Denticon or Curve Dental, and other devices, should be checked by name with any provider. For where the vendor's support line stops and IT begins, see dental software support compared with IT support.

Are phones and VoIP part of dental IT services?

Sometimes. Many dental IT plans cover the network your phones depend on, such as switches and firewall rules, but not the phone service itself. The phone platform or carrier owns numbers, calls and outages. Moving to a new phone system, porting numbers and buying handsets are projects. Ask whether phones are in scope or only the network beneath them.

Phones are the layer most often left out of a proposal without anyone noticing, because the phone company and the IT company each assume the other is responsible. The practical test is a call-quality complaint: who takes it, who tests the network, and who opens the case with the carrier. If both quotes are silent, ask both.

Phones also connect to the practice-management system in many offices, for caller lookup or texting. That link depends on the phone platform, the practice-management vendor and the network all working at once, so it is worth asking which party owns the integration settings.

What about Microsoft 365, email and user accounts?

Most plans include day-to-day administration of Microsoft 365 or a similar platform: adding and removing users, resetting passwords, managing licences and mailbox settings, and email security settings. Moving from another email system or setting up a new tenant is normally a project. The practice pays for the licences and should own the tenant and the domain.

Ownership is the point to settle early. The tenant (your organisation's Microsoft 365 account), the domain name and the domain registrar account should be registered to the practice, with the practice holding at least one global administrator login. A provider can and should hold administrator access to do its work; it should not be the only one who does. If the arrangement ends, you want to change providers without asking the old one for your own email.

Email is also the most common route for phishing, so this layer overlaps with security. Check whether email filtering, multi-factor sign-in and mailbox auditing are part of the email layer, the security layer or neither.

Does "vendor liaison" mean the IT company will deal with the software vendor for you?

It might, and that is exactly why it needs a written answer. Some dental IT plans include calling the software, imaging, phone or internet vendor for you and staying on the case; some bill that time; some leave it to the practice. Whichever model a quote uses, the vendor still fixes its own product.

Vendor liaison has real value in a dental office, because the person who would otherwise sit on hold is your office manager or a front-desk lead who has patients to check in. It also has a cost to the provider, which is why it varies. Ask three things: who opens the case with the vendor, who stays on the case until it is closed, and whether that time counts against anything.

This page does not describe any provider's vendor-coordination terms, Legend's included. Get the answer from each provider in writing, and keep each vendor's own support contract active either way.

What do planning and reporting look like when they are real?

Real planning and reporting means you receive something on a schedule: a written report on tickets, patches, backups and alerts, plus a periodic review of what needs replacing and when. Many plans mention "strategic planning"; the test is whether you can name the last report you received. Detailed budgets for a new location are usually separate work.

A good report answers questions an owner actually has. How many problems did staff raise, and were any repeated? Which machines are near the end of their supported life? Did every backup run, and when was the last restore test? What would you change next year, and roughly what will it cost? If a provider's sample report cannot answer those, the planning line is decoration.

Planning is also where a provider earns its place in budgeting. Replacement cycles, end-of-support dates and the next server decision should arrive as recommendations months before they become emergencies. For price expectations by plan type, read what dental IT support costs in 2026.

Is staff onboarding and offboarding included?

Creating accounts for new staff and disabling them when people leave is normally a routine monthly request, covering sign-ins, email, practice-management access requests and devices. The practice's part is telling the provider on time. A separate question is whether the provider charges a one-time fee to take on your practice at the start; ask about both.

Offboarding deserves the most care. When an assistant or associate leaves, their email, remote access and any shared passwords should be shut off the same day you ask, and the provider should confirm it back to you in writing. Practice-management user accounts are often managed inside the software itself, so agree whether the provider or the office manager disables those.

The provider's own onboarding of a new practice, meaning documentation, installing its tools and taking over admin access, is a different item. Some providers charge for it; some absorb it. Ask for that figure separately so it does not hide inside the first invoice. The hand-over from an outgoing provider is its own topic; see how to switch dental IT providers without disrupting the practice.

What does "compliance support" include, and what stays with the practice?

Compliance support from an IT provider usually means operating technical safeguards: access controls, updates, malware protection, encryption settings, backup and logs. Formal risk assessments, written policies and training programmes are often separate. The duties themselves, including the risk analysis, policies and business associate agreements, stay with the practice. Ask each provider to put that split in writing.

The rule text helps keep this straight. The HIPAA Security Rule requires a covered entity to "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities" (45 CFR 164.308(a)(1)(ii)(A)). An IT provider can supply evidence for that assessment, such as a device inventory, patch status and backup results, and some will run the assessment as a project. Ownership of the assessment and the decisions that follow sits with the practice.

The same section of the rule (164.308(b)(1)) states that a covered entity "may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information." That agreement describes duties; it is not a certificate. This page describes common practice and quotes the rule; it is not legal advice, and a practice with a specific question should ask its own adviser.

Which line items are often excluded from a monthly dental IT fee?

The most common exclusions are new hardware, cabling, software licences, onsite time beyond a limit, after-hours project work, migrations and extra backup storage. None of these is unreasonable to exclude; the problem is discovering them after signing. Use the checklist below against each quote and mark every line included, excluded or unclear.

• • [ ] New computers, monitors, servers and network equipment (the hardware itself)
• • [ ] Setup labour for replacement or additional computers
• • [ ] Cabling, new network drops and access-point installs
• • [ ] Software licences, including Microsoft 365, practice-management and imaging licences
• • [ ] Onsite visits beyond any included number, and the trip charge
• • [ ] After-hours or weekend project work
• • [ ] Moving to a new practice-management, imaging or phone platform
• • [ ] Opening or relocating an operatory or a second location
• • [ ] Backup storage beyond the plan's allowance
• • [ ] Advanced security add-ons (named tools)
• • [ ] Formal risk assessments and policy documents
• • [ ] Phone system changes and number porting
• • [ ] Time spent with software, imaging, phone or internet vendors
• • [ ] The provider's own onboarding fee
• • [ ] Devices outside the agreed list (a personal laptop, a new tablet, a kiosk)

Mark anything "unclear" as a question for the provider rather than an assumption. Then add the cost of the excluded lines you know you will need this year to each quote; the totals are often closer than the monthly figures suggest. Whether you are comparing a managed plan with paying by the hour, the same list applies; our guide to managed dental IT compared with break-fix explains how the two models handle these lines differently.

How do you line two dental IT quotes up against each other?

Put both quotes on the scope matrix, one column each, and fill in every layer with "in the fee," "extra," "vendor" or "not mentioned." Add the extras you expect this year. Only then compare totals. Most mismatches come from three rows: onsite time, vendor liaison and the project line for hardware setup.

A simple worksheet keeps it honest:

The device count in step 1 catches more errors than anything else on the list. One quote may price ten computers and another twelve because one provider counted the imaging acquisition PC and the server and the other did not. Line them up first.

When the comparison turns from "what is included" to "what does the contract say," move to the contract-stage questions in 20 questions to ask before signing a dental IT contract. If you are still deciding between providers rather than between quotes, the dental IT provider guide covers how to evaluate them.

Where does Legend Networking fit in this picture?

Legend Networking is a dental IT company headquartered in Dallas that has served over 3,500 practices since 2004. Its published price reads "Starting at $360 per month", and startups are custom quoted. This page does not describe what any Legend plan includes; as with any provider, ask for that scope in writing.

The facts Legend publishes that bear on the layers above: a helpdesk staffed 24/7 at 1-800-794-1588 with 24/7 monitoring; in-house engineers; no outsourced first-level triage; onsite dispatch by appointment across served dental markets; remote-first nationwide; and support for the IT environment of Dentrix, Eaglesoft, Open Dental and Archy and of DEXIS, Vatech, Carestream, Planmeca/Romexis and Dolphin Imaging. Its published pricing states that hardware procurement, major cabling projects and software licensing are quoted separately. On Google, its profile shows a 4.8 rating · 173 Google reviews.

Legend's dental IT support page introduces its leadership in one line: Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps. For the dental IT support offer itself, see Legend's dental IT support for practices nationwide.

What to ask your IT provider about scope

Six questions, one per weak spot in most quotes. They are about what is covered; the contract-stage questions (term, renewal, exit, data return) are in the planned 20-question pre-signing checklist.

If a provider answers all six in writing, you can compare quotes on substance rather than on adjectives.