# What happens to a dental practice’s IT during an ownership change? As [firms that serve dental practices](https://ddsintel.com/for) know, during an ownership change a practice’s IT must move data, user access, backups and security responsibility to a new owner, and 35.8% of the 710 large healthcare breaches listed in 2025 occurred at business associates, according to HIPAA Journal. A written handover plan reduces the risk of gaps. By DDSIntel Editorial Team. Source: DDSIntel, https://ddsintel.com/for/it-during-a-dental-practice-sale. Published 2026-10-26; data as of 2026-10-25. ## Key numbers - **710** large healthcare data breaches listed in 2025 (HIPAA Journal, from the HHS OCR breach portal, 2025; https://www.hipaajournal.com/2025-healthcare-data-breach-report/) - **35.8%** percent of those occurred at business associates (HIPAA Journal, from the HHS OCR breach portal, 2025; https://www.hipaajournal.com/2025-healthcare-data-breach-report/) - **60** calendar days, the outer limit for notifying individuals of a HIPAA breach (U.S. Department of Health and Human Services, 45 CFR 164.404, 2026; https://www.law.cornell.edu/cfr/text/45/164.404) - **175** practice locations reported sold in H1 2026, a minimum (TUSK Practice Sales, H1 2026; https://www.prnewswire.com/news-releases/tusk-practice-sales-assesses-the-state-of-the-dental-industry-in-its-q3-2026-dental-market-report-302823046.html) ## What does the IT checklist look like in a practice sale? The checklist covers an inventory of systems and devices, the practice-management and imaging data to be migrated, user accounts and access removal for departing staff, backup and recovery, software licenses and renewals, and a security review. Assign each item an owner and a date in the agreement. See the [IT and MSP hub](https://ddsintel.com/for/it-msps). ## Why are security duties easy to lose in a sale? Responsibility changes at closing, but accounts, credentials and vendor contracts often stay in the seller’s name. A departed owner’s access can remain active, and a vendor may not know who now decides. The Security Rule expects risk assessment and satisfactory assurances from vendors that handle protected information. See [breach reporting rules](https://ddsintel.com/for/dental-practice-breach-trends) and [purchase agreement clauses](https://ddsintel.com/for/dental-purchase-agreement-clauses). ## How should the agreement handle data and records? It should say who holds patient records after closing, how and when they transfer, who pays for migration, how long the seller’s systems stay available and who is responsible if an incident was discovered after closing. Counsel should draft these terms, and the IT provider should review the technical schedule. ## How can an MSP prepare for a buyer’s standards? A buyer, especially a DSO, may require its own systems and security standards, which can replace the incumbent provider. An MSP that documents its configuration, backups and security controls, and offers a clean handover, is better placed to stay or to be recommended. See [lab accounts after a sale](https://ddsintel.com/for/dental-lab-accounts-after-a-sale) for a parallel vendor story. Aggregate [signals](https://ddsintel.com/signals) show where ownership activity is rising, and [dentists by state](https://ddsintel.com/data/dentists-by-state) gives each state’s base. ## Frequently asked questions ### Who owns the imaging and practice-management data? The agreement and state law decide. Settle custody, access and retention in the contract. ### When should a departing owner’s access be removed? On a date set in the agreement. Leaving it open is a common gap. ### Does a sale change HIPAA obligations? The covered entity’s obligations continue; who is the covered entity changes with the deal. Have counsel confirm. ### Should an MSP contact owners about a sale? Only about the owner’s own IT needs. Never imply knowledge of a sale from public records. ## Sources 1. HIPAA Journal, from the HHS Office for Civil Rights breach portal. 2025 healthcare data breach report. https://www.hipaajournal.com/2025-healthcare-data-breach-report/ 2. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.404, Notification to individuals. https://www.law.cornell.edu/cfr/text/45/164.404 3. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.308, Administrative safeguards. https://www.law.cornell.edu/cfr/text/45/164.308 4. TUSK Practice Sales. TUSK Practice Sales Assesses the State of the Dental Industry in Its Q3 2026 Dental Market Report (July 10, 2026). https://pr.timesenterprise.com/article/TUSK-Practice-Sales-Assesses-the-State-of-the-Dental-Industry-in-Its-Q3-2026-Dental-Market-Report/6a514c9516e7610b3c53e15d --- DDSIntel is a dental transition intelligence platform that detects pre-market dental practice transition signals for brokers, DSOs, lenders and the firms that serve them.