Dental Vendor Inventory: 2026 Third-Party Risk Checklist
Build a dental vendor inventory for IT, PMS, imaging, cloud, backups, remote access, security, phones, payments, ownership, access, and offboarding.
Dental practices rely on a broad technology supply chain: PMS vendors, imaging companies, cloud hosts, backup providers, MSPs, security platforms, payment processors, phone providers, internet carriers, website vendors, laboratories, and specialized clinical systems. NIST's Cybersecurity Framework 2.0 includes supply-chain governance, and its C-SCRM Quick-Start Guide focuses on establishing supplier-risk processes and communicating requirements to suppliers. For a dental practice, the first practical step is often simpler: build a current vendor inventory that connects each relationship to systems, data, access, contracts, owners, and offboarding responsibilities.
Key Takeaways
Inventory technology vendors by relationship, not only by invoices. Record the systems and data they touch, administrative access, business owner, technical owner, agreement, and offboarding path.
Do not assume every technology vendor is automatically a HIPAA business associate. Evaluate the actual relationship and ePHI handling, then maintain required agreements where applicable.
Review vendor access and ownership after staff changes, acquisitions, MSP transitions, new locations, major software migrations, and contract termination.
What belongs in a dental vendor inventory?
Include the vendor name, service, business owner, technical owner, systems supported, data handled, administrative or remote access, account ownership, contract or renewal information, security contacts, support path, and offboarding procedure. Record whether the relationship has been evaluated for business-associate requirements when ePHI is involved.
The inventory should be usable during an incident or transition. A list of company names without access and ownership details does not tell the practice who can reach a server, reset a cloud account, restore a backup, or revoke a remote tool.
Which vendors are easiest to forget?
Look beyond the PMS and imaging vendors. Include DNS and domain registrars, website administrators, online forms, payment systems, texting platforms, patient communication tools, VoIP providers, internet carriers, remote-support utilities, backup vendors, security consoles, cloud file services, e-prescribing tools, and local contractors with administrator access.
Acquisitions and staff turnover create hidden relationships. A former office manager may own a domain login, a past MSP may still have RMM agents installed, or an imaging vendor may retain unattended access after a project ends.
How should HIPAA business-associate status be handled?
Do not label every vendor the same way. A business associate generally performs functions or services for a covered entity involving creation, receipt, maintenance, or transmission of protected health information, subject to the rule's definitions and exceptions. Evaluate what the vendor actually does and document the resulting agreement requirement.
The vendor inventory can record whether a BAA exists, the date reviewed, and who owns the relationship without storing confidential contract details in a broadly accessible spreadsheet.
What cybersecurity questions should be connected to each vendor?
Document how the vendor authenticates, whether remote access is persistent or on demand, what privileges are granted, how incidents are reported, what systems depend on the service, and what happens if the vendor is unavailable. For critical suppliers, record backup, export, recovery, or transition options.
NIST's C-SCRM guidance encourages organizations to define and communicate supplier requirements. A small dental practice can apply that principle by making security, access, incident notification, data handling, and termination expectations explicit where the relationship warrants them.
How should vendor access be reviewed?
Compare the inventory to actual accounts, remote agents, firewall rules, VPNs, service accounts, API integrations, and cloud administrators. Remove access that no longer has a business purpose and replace generic or undocumented paths with named, controlled access where supported.
Review after projects and role changes rather than waiting for an annual cleanup. Vendor access can outlive the work that justified it if offboarding is not a defined step.
What should happen when a vendor relationship ends?
Revoke accounts, tokens, remote tools, VPNs, firewall rules, and administrative rights; transfer ownership of domains, cloud tenants, backups, documentation, and licenses; retain required records; and confirm that the replacement team can operate before the old access is removed when continuity requires sequencing.
Document completion. A closed invoice does not prove that technical access or data custody has ended.
Sources and References
Primary sources used for this article
Regulations, product support information, and incident details can change. Review the linked primary sources for the latest status.
NIST guidance on establishing cybersecurity supply-chain risk management and communicating supplier requirements.
Current NIST overview of technology supply-chain cybersecurity risks across the system lifecycle.
HHS guidance on business associates and contractual responsibilities involving protected health information.
Common Questions
Frequently asked questions
Is every dental IT vendor a HIPAA business associate?
No. Business-associate status depends on the function or service and whether protected health information is created, received, maintained, or transmitted on behalf of the covered entity, subject to HIPAA definitions and exceptions.
Should the inventory include vendors that never see patient data?
Yes if they are operationally important or have privileged access. A firewall, DNS, phone, ISP, or building-technology vendor may matter to continuity and security even when the relationship does not involve ePHI.
How often should vendor access be reviewed?
Use a documented risk-based cadence and event-driven reviews after projects, staff or ownership changes, acquisitions, software migrations, contract changes, and terminations.
Should passwords be stored in the vendor inventory?
No. Record ownership and the approved credential-management location or process, but avoid turning the inventory into a plaintext password repository.
What is the biggest risk during an MSP change?
Losing administrative ownership or leaving stale access behind. Inventory domains, cloud tenants, backups, firewalls, remote tools, security platforms, and vendor accounts before the transition.
Can one person own every vendor relationship?
A small practice may centralize business ownership, but technical and security responsibilities should still be clear. The key is that the relationship does not depend on undocumented knowledge held by one individual.