October 2nd, 2026
Dental Practice Acquisition IT Due Diligence: The Checklist Brokers Miss
Industry Research — DSO
Most dental practice acquisitions are won or lost on the financials, the lease, and the patient base. The part that quietly wrecks deals after closing is the one nobody scrutinizes with the same rigor.
I’ve sat on the buy side of $1B+ in dental practice M&A diligence, and IT diligence on dental practice acquisitions is where I’ve seen the pitfalls that can haunt what looked like a promising deal. The pattern is almost always the same: the buyer valued the equipment they could see and never priced the risk they could not. That gap is not just an operational headache, it is enterprise value, because the IT posture you inherit either protects your multiple or quietly discounts it. What follows is the checklist, the red flags brokers and CPAs routinely miss, what changes when you are folding the practice into a group, and what to do with the old server once the deal closes.
Why IT Diligence Is the Line Item That Quietly Blows Up Dental Deals
Financials get audited. The lease gets read line by line. IT usually gets a single bullet on someone else’s checklist, and that is exactly where the six-figure surprises hide. A practice that looks clean on paper can carry an end-of-life server, an unpatched network, an unresolved breach, or software the seller does not actually have the rights to move, and none of it shows up on the profit and loss statement.
The reason is structural. Your attorney can read a contract and your CPA can validate the numbers, but neither can tell you whether the network you are buying is already compromised. That is a dental IT question, and it belongs in diligence before you sign, not in a cleanup project after.
The Dental Practice Acquisition IT Due Diligence Checklist
IT due diligence on a dental practice comes down to eleven areas, and each one needs three answers: what to request from the seller, what counts as a red flag, and how that red flag moves the price or the terms of the deal.
IT diligence is not a checkbox. It is risk pricing. Underneath every row is one question: whether your newly acquired offices can actually function on Monday morning after close.
| Area | What to request | Red flag | How it prices into the deal |
|---|---|---|---|
| Servers and workstations | Age, operating system and warranty for every machine | Windows 10 (non-LTSC) past October 14, 2025 without paid updates, or Server 2016 (ends January 12, 2027) | Replacement quote taken off the price or paid as a seller credit |
| Backups | Backup reports and proof of a recent test restore | No test restore, or backups on the live network with no immutable copy | Holdback released once backups are isolated or immutable and pass a test restore |
| Active compromise | A compromise assessment before close: logs, admin accounts and remote-access tools | Unknown remote-access tools or admin accounts nobody can explain | Suspicious findings resolved before close, as a closing condition |
| Breach and cyber insurance history | Current policy, applications, claims and any breach notices | Declined or non-renewed coverage, or no policy at all | Specific indemnity for incidents that began before close |
| HIPAA risk analysis | Most recent Security Risk Analysis and its remediation plan | None on file, or one nobody has updated in years | Cost of a new risk analysis and fixes as a credit |
| Vendors and BAAs | Every vendor that handles patient data for the practice, with signed BAAs | Missing BAAs, or vendors nobody at the practice can name | Your own BAA with each vendor you keep, as a closing condition |
| Practice management software | License, support agreement, transfer terms and export rights | A license that will not transfer, or no full data export | Conversion quote priced in, transfer as a closing condition |
| Imaging | Sensors, imaging software, CBCT and where images are stored | Images stored apart from the PMS with no tested backup of their own | Tested imaging backup, directly or through migration, added to the remediation quote |
| Network and firewall | Firewall model, support status and internet circuits | An unsupported or consumer-grade firewall | Replacement quote off the price |
| IT provider contract | The current MSP or IT services agreement | Auto-renewal or a change-of-control clause | Seller terminates before close, or exit cost as a credit |
| Logins and access | User account list and how passwords are stored | Shared logins, or former employees still active | Cleanup cost as a credit |
My default is to price every finding from a written quote. A quote turns a red flag into a line your attorney can paper as a price change, a credit, a holdback or a closing condition. Which of those fits is a deal call, but the number has to exist first.
The seller can share most of this without a privacy problem. HIPAA counts due diligence tied to the sale or merger of a covered entity as health care operations, as long as the buyer is or will become a covered entity. The minimum necessary standard still applies, so ask for system details and reports and leave patient charts out of it.
The IT and Cybersecurity Red Flags Brokers and CPAs Miss
This is the layer a transition attorney or accountant cannot evaluate, and it is where the real inherited risk lives. The table covers each area in a line. These are the ones that need more than a line, because each can become your problem at close whether or not anyone checked for it.
An Inherited Breach You Do Not Know About Yet
Cybersecurity is often overlooked during acquisitions, but it’s a critical area. In my experience, many breaches at individual practices go undetected for a long time, because a lot of dental offices run on small IT providers that lack the resources to detect or handle a security incident. An attacker can sit inside a network for weeks or months, and if that intrusion is still active after close, it is now running on your network. Depending on how the deal is structured, the breach notification obligations and the liability can land on you. Confirm your cybersecurity terms cover incidents that began before the acquisition, and have the network checked for an active compromise, not just for antivirus and a firewall.
The Practice’s Cyber Insurance and Breach History
Ask for the seller’s cyber insurance history and any prior claims. A policy that was declined, non-renewed, or priced unusually high is a prompt to ask what the underwriter saw. A practice with no cyber coverage at all deserves the same questions. This history rarely appears in a standard diligence packet, and it is one of the cleanest early reads on the real security posture you are buying.
End-of-Life Servers and the Real Remediation Cost
An unsupported operating system is not a minor line item. Once vendor support ends, it stops receiving security patches unless an extended update program exists and the practice has enrolled, and that makes it much harder to meet the HIPAA Security Rule safeguards a risk analysis is measured against. Ask the practice’s cyber insurer how it treats unsupported systems, too. A server past its service life adds a separate risk, which is hardware failure. Price the remediation before you close. Replacing an aging server, migrating the practice management data, and bringing the network to a defensible baseline is real money. Get it quoted, because it is far cheaper to negotiate that cost as a price adjustment than to absorb it as a surprise in month two.
Who Actually Owns the Practice Management Data
Confirm the practice management software, its licensing, and its data-export rights transfer cleanly to you. Dentrix, Eaglesoft, and Open Dental each handle ownership, hosting, and conversions differently, and a practice does not always hold the export rights a buyer assumes it does. Verify that patient records, images, and the underlying database can be exported or migrated in a usable format, because a PMS you cannot cleanly move is a hidden switching cost, and images in particular often live outside the main database in a separate file store that a rushed conversion leaves behind. Vendors quote that work in separate pieces, so price the switching cost before you close rather than treating it as a post-closing detail.
HIPAA Risk-Analysis Gaps and Inherited Business Associate Agreements
Ask to see the practice’s most recent HIPAA Security Risk Analysis. Many practices have never completed one, and federal regulators notice. The HHS Office for Civil Rights runs a dedicated Risk Analysis Initiative, and each of the four ransomware settlements it announced on April 23, 2026 found a failure to conduct an accurate and thorough risk analysis. The seller’s Business Associate Agreements may not carry over to you, so inventory every vendor that handles patient data on the practice’s behalf and plan for a current, valid BAA with each one you keep. Ask how credentials are stored as well. A buyer taking over shared logins and browser-saved passwords is inheriting an access problem that has to be rebuilt, and the cost of moving it onto a password manager the group can administer is straightforward to price before close. After close, those gaps are yours to fix, and if the practice never completed a risk analysis, the HHS risk analysis guidance is the place to start.
The Incumbent IT or MSP Contract
Read the existing IT provider’s contract before you close, specifically for the term, auto-renewal language, and any change-of-control clause. A managed services agreement that renews automatically or survives a sale can lock you into the very provider whose thin coverage created the problems you found in diligence. Knowing the exit terms in advance lets you plan a clean transition rather than discovering you are contractually stuck the week after closing.
Backups That Have Never Been Test-Restored
A practice can have a backup running and still have no ability to recover, because a backup that has never been restored is an assumption, not a safeguard. Confirm that backups exist, that they are isolated or immutable rather than sitting on the same network as the live data, and ask for evidence of a successful test restore. Solid backup and disaster recovery is often what separates a short recovery from a long shutdown if something goes wrong after you take over.
Look Beyond Digital Equipment
A practice can have a CBCT and still be running on a server that belongs in a museum.
The equipment is only as good as the infrastructure carrying it. A practice can own state-of-the-art imaging and still choke on it, because the network bandwidth and storage behind it cannot keep up. Check that the digital tools you are paying for actually integrate with, and run well on, the systems already in place.
Trust but Verify
Use the practice’s current IT provider to gather the starting data, the equipment specs, ages, operating systems, and software versions. Then verify all of it independently. IT providers vary widely in quality, from reactive break-fix shops to full managed teams, and if the practice you are buying needs a new partner after close, our comparison of the best dental IT support companies covers who fits which situation. Note that the support model the practice runs on tells you a lot about the shape it is in. Leaning on an unvetted vendor’s word is how inaccuracies slip into a purchase decision. An independent check gives you a clear, honest picture of the IT health you are actually buying.
Cross-check what you were given against an independent audit. An outside IT firm brings an objective read and surfaces the issues an incumbent vendor either missed or had no reason to raise. That is what makes the information behind your acquisition decision something you can actually trust.
For DSOs: Folding an Acquired Practice Into the Group
For a dental group, IT diligence does not end at the practice line. Every acquisition either raises or lowers the security baseline of the entire organization, because the moment you connect a new office to shared identity, a central database, or site-to-site networking, its weakest control can become everyone’s weakest control. The practice you acquired last quarter, still running the legacy setup it came with, is very often the softest entry point in the whole group.
That reality changes what diligence has to accomplish. Beyond assessing the single office, a group has to plan how the acquired practice will be brought onto a standardized security baseline, a common identity and access model, and consistent monitoring, and how quickly. A per-location readiness view is what keeps one acquisition from quietly degrading the posture of every location you already own. This is the same discipline that runs through our DSO technology playbook, and it is why integrating new acquisitions consistently ranks among the hardest IT challenges a growing group faces.
What to Do With the Old Server, PMS and Imaging Archive
The old practice’s server, practice management software and imaging archive usually still hold patient records, so decide before close who owns them, how they stay accessible for as long as they must be kept, and when the hardware can be safely retired.
This is the part of an acquisition, or a closure, that nobody puts on the integration plan. Even after a conversion, what we commonly see left behind is years of history that did not convert cleanly, an imaging store that sits outside the main database, scanned documents, old backups on drives or cloud accounts, and remote-access tools the previous IT provider installed. Each of those either holds patient data or opens a door to it, and every piece you take on at close needs a named owner.
| Option | When it fits | Main risk | Who owns it |
|---|---|---|---|
| Keep the old server running, read-only | A short bridge while you check the conversion | An aging, unpatched server stays on your network | Group IT lead |
| Virtualized read-only copy | Years of history and images you still need to look up | Licensing for Windows, the database and old viewers, plus access control | Group IT, with the compliance officer approving access |
| Vendor archive or hosted copy | The old vendor offers a way to keep data reachable | Cost, terms and export rights you did not get in writing | Compliance officer, with the vendor |
| Export, then retire | Records are fully moved or retained somewhere else | Destroying records you are still required to keep | Practice owner or records custodian, with IT |
| Convert into the group’s PMS | Active patients you will keep seeing | Images and notes that do not come across | Group IT and the PMS vendor |
My default for a group is a virtualized read-only copy, kept off the production network, with access limited to a short list of people and logged. It retires the old hardware and keeps the history searchable, but the old software still runs inside it, so it needs backups and the same monitoring as anything else holding patient data. If you go the vendor route, ask in writing what the vendor offers, what it costs and how you get the data back out. Conversion is its own project with its own pricing, covered in our breakdown of what a PMS data conversion costs.
Before any hardware leaves the building, check two things. First, how long the records have to be kept. HIPAA does not set a retention period for patient charts. HHS says state laws generally govern it, and HIPAA’s six-year rule covers compliance documentation such as policies and risk analyses. The ADA’s guidance on dental record retention points practices to state law, benefit-plan contracts and their malpractice carrier, so confirm the rule with your state dental board. Second, patients keep their right to request copies for as long as you maintain the records, and HIPAA gives you 30 days to act on a request, plus one 30-day extension if, within those first 30 days, you tell the patient in writing why and when. An archive nobody can search makes that deadline hard to hit.
When a drive is finally retired, sanitize or destroy it to NIST SP 800-88 (Revision 2, published September 2025) and keep the certificate with your HIPAA documentation. Our HIPAA compliance checklist covers device disposal, and the old vendors deserve the same attention, because vendors that held the practice’s patient data need to return or destroy it once the relationship ends, where that is feasible. If the practice closed rather than sold, the same choices apply, and someone still has to act as records custodian. HHS notes that many states may require records to stay available for a limited time after a business closes.
Turning IT Diligence Into Deal Leverage
Every finding above is a number you can bring to the table. An end-of-life server, an uncovered breach, a missing risk analysis, or a locked-in IT contract is a documented cost, and a documented cost gives you something to negotiate, such as a price adjustment or a remediation credit.
I’ve said publicly that full integration can increase valuation by 2-4x EBITDA. Unaddressed technology and security risk is a discount a future buyer’s diligence team will find and price into your multiple, exactly the way you should be pricing it into the practice you are acquiring now. A clean, standardized, defensible IT stack is not just an operational win. It is enterprise value. You can see how the largest failures played out in our breakdown of the biggest dental data breaches, and how to choose a partner built for this work in our guide to the best IT providers for DSOs.
Dental Acquisition IT Due Diligence FAQs
What does IT due diligence cover when buying a dental practice?
IT due diligence is a pre-close assessment of everything technology-related you are about to inherit: a full hardware and software inventory with each system’s age and remaining life, the network and server condition, cybersecurity posture and any active or unreported breach, HIPAA risk-analysis and Business Associate Agreement status, practice management software ownership and data-export rights, the seller’s cyber insurance and claim history, the incumbent IT contract terms, and the state of the backups. The goal is to price the real remediation cost before you sign rather than absorb it afterward.
Can you inherit a data breach when you acquire a dental practice?
You can. If an attacker is still inside the practice’s network after the sale, the intrusion is now on your systems, and depending on how the deal is structured, the incident, its cost and the HIPAA notification work can land on you. Asset and stock purchases treat the seller’s past liabilities differently, so cover this in diligence and make your purchase terms address incidents that began before close. A practice on a small IT provider with no real monitoring is a likely place for an undetected compromise to be sitting.
Why is acquisition IT diligence harder for a DSO or multi-location group?
Because the risk does not stay in the acquired office. Once a new practice is connected to a group’s shared identity, database, or network, its weakest security control becomes a risk to every location. A single acquired office with a legacy setup can lower the security baseline of the entire organization, so a group has to plan not only whether to buy, but how and how fast to bring the practice onto a standardized, monitored security posture before it becomes the group’s soft entry point.
Posted in DSO
