Most practices pick an IT company the same way: a referral, a quick call, a quote that looks reasonable. Then they find out what they actually bought the first time a server dies on a surgery day. This guide is the checklist we would want a practice owner to use on any IT company, including us. It applies to dental offices, oral surgery groups, DSOs and medical practices alike.
1. Will they sign a Business Associate Agreement?
Any IT company that can see or touch patient data is a business associate under HIPAA. That means a signed Business Associate Agreement (BAA) before they log in to anything. If a provider hesitates, says it is not needed because they “only do the network,” or asks you to sign their paper without reading it, keep looking.
Ask: “Can you send your BAA before we sign the service agreement?”
2. Who does your HIPAA risk assessment?
HIPAA requires a security risk analysis. The best answer is not “we do it.” An IT company grading its own work has an obvious conflict. The assessment should come from a cybersecurity and compliance firm, and the IT company should take the findings and fix them.
At Xceltek, the yearly assessment comes from a compliance firm such as our sister company Cytek, or the firm you already use. We take the report and remediate every finding on your network and devices.
Ask: “Who does the risk assessment, and what happens to the findings?”
3. Do they know your software and imaging?
A generic IT company will learn your practice management system on your time. Ask for specifics: Dentrix, Eaglesoft, Open Dental, DSN Software, CareStack, Carestream, your EHR, and the CBCT, pano and intraoral imaging you run. Ask how they handle imaging workstations, storage growth and software updates without breaking integrations.
Ask: “Which practices like ours do you support today, on the same software?”
4. What happens when something breaks?
Response time is the number that matters most on a busy clinic day. Ask how fast a real person answers, what the after-hours and weekend process is, and how emergencies are escalated. Get it in writing.
Ask: “If our server goes down at 7:30 on a Monday, who picks up and how fast?”
5. Can they put someone in your office?
Most problems get fixed remotely, but some need hands: a failed switch, a new workstation, a scanner that will not connect. A local-only shop may not cover your other locations. A remote-only provider may not show up at all. Ask whether they can send a technician on-site at every location you have, and how quickly.
6. How do they protect against ransomware?
Healthcare is one of the most targeted industries for ransomware. The baseline should include endpoint protection with monitoring, email security, multi-factor authentication on remote access and email, patching on a schedule, and encrypted backups that are tested, not just running.
Ask: “When did you last test a full restore for a client, and how long did it take?”
7. Are backups stored where ransomware cannot reach them?
A backup on the same network as your server can be encrypted along with it. Ask where copies live, how long they are kept, whether at least one copy is offline or immutable, and how long a full recovery would take.
8. How is pricing built?
Be careful with all-inclusive bundles that charge a small practice for a large group’s services. Pricing per device or per site is easier to understand and to grow with. Ask what is included, what is billed hourly, and what a new office or new workstation would add.
9. How long is the contract, and how do you get out?
Long contracts without a clear termination clause protect the provider, not you. Ask for the term, the exit terms, and what happens if service is not delivered.
10. Will they hand everything over if you leave?
This is the question most practices forget. Ask in writing: if we end the relationship, will you hand over every password, admin account, license, document and backup, without delay or extra fees? An IT company that holds your systems hostage is a risk to your practice.
11. Can they support growth and multiple locations?
If you plan to add a location, a new doctor or a new build-out, ask how they handle network and cabling design, standard setups across sites, and centralized management. Groups and DSOs should ask whether one BAA and one security standard cover every location.
12. What do their clients say?
Read reviews from practices like yours, and ask for a reference you can call. Look for specifics: response times, how a crisis was handled, whether leadership is reachable.
A quick scorecard
- Signs a BAA before touching patient data
- Risk assessment comes from an independent compliance firm
- Hands-on experience with your practice software and imaging
- Written response times, including after hours
- On-site support at every location
- Monitored security, MFA, patching, tested and isolated backups
- Clear pricing per device or per site
- Fair contract term with a clean exit
- Full handoff of passwords, data and documentation if you leave
- Real reviews and references from practices like yours
How Xceltek answers these questions
We sign a BAA before we touch patient data. Your yearly risk assessment comes from a compliance firm such as Cytek, and we fix the findings. We support Dentrix, Eaglesoft, Open Dental, DSN Software, CareStack, Carestream and the major CBCT and imaging systems. We put a technician on-site wherever your offices are, backed by a network of 4,000+ IT experts nationwide. We price per device or per site, our contracts are shorter than the industry norm with a fair exit, and if you ever leave we hand everything over. You can read what our clients say on our reviews page.
If you want an outside look at your current setup, book a free 30-minute IT and security review. You will come away knowing what is fine, what needs attention, and what it would take to fix, whether or not you work with us.
Related: HIPAA compliant IT services · Dental IT · Oral surgery IT · Healthcare and medical IT
