An IT provider may administer a system, but the clinic should remain the legal and practical owner of the primary account, billing relationship, recovery methods, and data.

Systems the clinic should own

  • Domain registrar and DNS account
  • Microsoft 365 or Google Workspace tenant
  • Website hosting and Cloudflare or other DNS/CDN account
  • Backup platform, password vault, phone system, copier portal, and internet provider account
  • Primary recovery email addresses and billing contacts

A safer access model

  • Create the primary owner account in the clinic’s name.
  • Keep owner credentials private and protected with clinic-controlled MFA.
  • Invite the IT provider through a named administrator, delegated role, partner relationship, or collaborator account.
  • Remove delegated access without transferring ownership when vendors change.

Warning signs

  • The clinic cannot receive password resets.
  • Billing is tied only to a former employee or outside vendor.
  • Multiple technicians share one unnamed administrator login.
  • The vendor refuses to provide ownership records or export options.

Related ClinicsIT guidance

Practical note: Technology, licensing, vendor capabilities, and regulatory obligations vary. Confirm the clinic’s current configuration before making changes.

Ownership model

The clinic should own the primary registrar, DNS, cloud tenant, backup, website, and phone-system accounts. The IT provider should receive a named delegated role rather than hold the only owner password.

Why it matters

Vendor-owned primary accounts can delay provider changes, incident response, billing disputes, and emergency recovery. Clinic ownership also makes administrator activity easier to attribute and revoke.

Implementation

Create the primary account with a clinic-controlled address and payment method, enable MFA, invite the provider's named account, limit the assigned role, and test that the clinic can remove or replace the provider without losing service.

Need help applying this to your clinic?

ClinicsIT can review the current environment and build a practical, documented next-step plan.

Request a consultation