DDSIntelThe Transition Layer
MenuClose
  1. Home
  2. By audience
  3. What does a dental practice transition mean for IT and managed-service providers?

What does a dental practice transition mean for IT and managed-service providers?

For firms that serve dental practices, a practice transition triggers IT work on migration, access, backups and security, and the stakes are visible: 710 healthcare data breaches affecting 500 or more people were listed on the HHS Office for Civil Rights breach portal in 2025, according to HIPAA Journal. A sale is when access and responsibility change hands.

By DDSIntel Editorial· Published · Data as of

Key numbers

What IT work does a practice sale create?

A sale can trigger migration of practice-management and imaging data, changes to user access, backup and licensing review, device inventory and a handover of security responsibilities. Each is an opportunity or a risk for the provider serving the practice. See IT during a dental practice sale.

How common are healthcare data breaches?

HIPAA Journal counted 710 data breaches of 500 or more records on the HHS Office for Civil Rights portal in 2025, and reported that 35.8% occurred at business associates, which include IT and managed-service providers handling protected data. See dental breach reporting rules.

The national dentist count that these practices sit within is on how many dentists are in the U.S..

What do HIPAA rules require of a practice and its IT provider?

The HIPAA Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to electronic protected health information, and a covered entity may permit a business associate to handle that information only with satisfactory assurances that it will be safeguarded. Have counsel confirm how the rules apply in a given deal.

How can an MSP anticipate transitions?

An MSP learns of a sale from its customers, usually late. Aggregate dental transition signals by region help plan capacity and outreach to likely buyers. They never mean an owner intends to sell, so contact an owner only about the owner’s own IT needs. See the DSO hub for how buyers expand.

Frequently asked questions

Who is responsible for security during a sale?

The agreement should say. Until closing the seller remains responsible, and responsibility shifts at a defined point. Have counsel confirm.

What does a breach after closing trigger?

Notice to individuals without unreasonable delay and no later than 60 calendar days after discovery, plus notice to HHS.

Do large breaches get reported to HHS differently?

Breaches of 500 or more individuals are reported to HHS contemporaneously with individual notice; smaller ones within 60 days after year end.

Where is the daily news briefing for IT and MSPs?

It is embedded on this hub when the it-msp lens is live.

Sources

  1. HIPAA Journal, from the HHS Office for Civil Rights breach portal. 2025 healthcare data breach report. hipaajournal.com.
  2. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.404, Notification to individuals. law.cornell.edu.
  3. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.408, Notification to the Secretary. law.cornell.edu.
  4. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.308, Administrative safeguards. law.cornell.edu.
  5. ADA Health Policy Institute. The U.S. Dentist Workforce, 2025 update. ada.org.

Questions or corrections: request a correction. Markdown version: /for/it-msps.md.