IT that never stops the chair.
Practice management, imaging and claims are the three things that cannot be down. Everything we run in a dental clinic is arranged around keeping those three working while the book is full.
An empty chair costs more per hour than the entire IT budget.
That single fact reorders every priority. In an office, a slow morning is an annoyance. In a clinic, a server that will not authenticate at 8:05 means the hygienist is standing in the operatory with a patient reclined and nothing on screen. Everything below follows from designing around that moment rather than around a generic small business.
Six failures we see in every clinic.
None of these are exotic. They recur because dental estates grow by accretion — a sensor here, a second location there — and nobody is paid to look at the whole thing.
| Failure | Why it happens here | What we do about it |
|---|---|---|
| 01Imaging fails mid-appointment | Why it happens hereSensor drivers break after an unmanaged Windows update, and the workstation was patched on the vendor’s schedule rather than yours | What we do about itPatches tested and scheduled outside clinic hours, with imaging workstations in their own maintenance ring |
| 02The server is the single point of failure | Why it happens hereOne box in a cupboard runs practice management, images and the shared drive, and nobody has restored from it | What we do about itLocal image plus immutable off-site copy, with a quarterly restore test timed and documented |
| 03Claims stop submitting | Why it happens hereCDAnet or the clearing house connection depends on a certificate or a network path nobody owns | What we do about itDocumented dependency, monitored path, and a known contact at the vendor before it fails |
| 04Everyone shares one login | Why it happens hereFront desk turnover made individual accounts feel like overhead, so a generic account grew admin rights | What we do about itNamed accounts, MFA, and role-based access — which is also what an audit will ask you to show |
| 05Backups run but nobody checks | Why it happens hereThe green tick was believed. Often the imaging store or the second location was never in scope | What we do about itNightly verification, monthly spot restore, and coverage confirmed against the actual data map |
| 06Second location grew organically | Why it happens hereA separate server, separate logins and a VPN somebody set up once | What we do about itCentral identity, one baseline per site, and connectivity planned rather than improvised |
The pattern is the same each time: the clinic grew faster than anyone documented it. The first thirty days of an engagement is mostly writing down what already exists.
PHIPA sits with you. The evidence is ours.
No IT provider can make a practice compliant — the custodian is the practice. What a provider can do is put the safeguards in place and produce the records when someone asks.
The security stack
Access control you can demonstrate
Named accounts, MFA everywhere, and permissions that match role rather than history. If a hygienist can open the payroll folder, that is a finding waiting to happen.
Audit trails that survive
Sign-in and access logs retained long enough to answer a question months later — which is when questions usually arrive.
Encryption on every device
Disk encryption on workstations and laptops, enforced through policy rather than trusted to whoever set the machine up. A stolen laptop is then an inconvenience, not a notifiable breach.
A breach process written in advance
Who assesses it, who notifies the Information and Privacy Commissioner of Ontario, what gets said to patients, in what order. Written at onboarding, not drafted in a panic.
Records retention that matches the rule
Retention configured against your actual obligation rather than a default, and applied to backups as well as live data — the copy people forget.
Where the pressure actually falls.
Support demand in a practice is not evenly distributed. It spikes at open and at handover, and almost nothing can wait until tomorrow.
Open
Workstations wake, practice management authenticates, sensors initialise. Whatever does not come up here comes up at 08:00 instead — in front of the first patient.
First patient
From here the estate is load-bearing. Anything that needs a restart has already missed its window.
Imaging
Sensors, scanners and the imaging store under constant write. The one workload where a slow disk becomes a clinical delay.
Claims
Day’s submissions go out. A broken claims path discovered now is a cash-flow problem, not an IT problem.
Maintenance
Patching, updates, backup verification. All of it happens here, which is the entire reason it never happens at 07:30.
A clinic needs coverage weighted to the open, not an even service level spread across the day. That shows up in the agreement as a defined start-of-day response and a maintenance window that never touches clinic hours — two clauses that generic MSP contracts rarely contain.
For a clinic, in this order.
If budget only stretches to one of these this year, take the first. Everything else can be sequenced; recoverability cannot be retrofitted after the event. Further reading for clinics: the PHIPA compliance checklist for Ottawa clinics, and what ransomware actually looks like for a Canadian SMB. The layers behind this list are Sophos MDR, the email gateway and EDR on every endpoint.
The ones practices actually ask.
If yours isn’t here, ask it directly — you’ll get an answer from an engineer, not a form letter.
We work with the common Canadian platforms — ABELDent, Cleardent, Tracker and Dentrix among them — and with whatever imaging suite is attached to your sensors. We are not a reseller for any of them, which means when something breaks we are on your side of the support call rather than defending a product.
Maintenance runs outside clinic hours by default — evenings, or whichever weekday you are closed. Anything that must happen during the day gets scheduled around your book, not the other way round.
That is a P1. Someone is on it immediately, and the escalation path is agreed at onboarding so nobody at the front desk is deciding who to call while a patient waits in the chair.
No provider can make you compliant — PHIPA obligations sit with the custodian, which is the practice. What we do is put the technical safeguards in place, document them, and give you the access logs and restore evidence an assessment will ask for.
Canadian data residency by default for anything we control, including backups. If a vendor stores data outside Canada we will tell you where, because you need to know that before you sign with them, not after.
Yes, and it is worth planning three months out. Connectivity lead times and imaging licensing are the two things that consistently delay a clinic opening, and both are avoidable with notice.
Yes. Multi-site groups need slightly different structure — central identity, standardised imaging, and a consistent baseline per location. The engagement shape is the same; the documentation gets more important.
Next
The chair stays full.
Twenty minutes. Tell us what your practice runs and what went wrong last — we will tell you what we would fix first.