Ask three dental IT companies to quote a new office and you will get three very different answers, all confidently presented. The reason is that most of the decisions are tradeoffs rather than right answers, and the tradeoffs depend on things the quote never asks about: how many operatories will have a sensor, whether you are adding CBCT, whether you will scan chairside, how long you plan to own the practice, and how much downtime you can absorb.
This is a specification guide. It will not tell you which vendor to use. It will tell you which questions determine the design, which numbers to plan around, and which shortcuts come back later. Security controls sit alongside this in the realistic dental cybersecurity threat list, and if you are building out a new space, read it with operatory design and buildout.
Key takeaways
- The on-prem versus cloud decision is mostly about who carries the operational burden, not about cost. Cloud moves backups, patching, and uptime to a vendor and makes your internet connection a single point of failure.
- Imaging is what fills drives. Plan storage around a multi-year growth curve, not today's database size, and size CBCT separately because a single volume can be hundreds of megabytes.
- Every server, every network switch, and the phone system need a UPS with automatic graceful shutdown. Workstations need one only where an unexpected loss matters.
- Segment the network. Imaging devices, CAD/CAM mills, and legacy machines running unpatched operating systems do not belong on the same flat network as workstations.
- Guest Wi-Fi must be isolated from the practice network with client isolation on. This is a 10-minute configuration that removes an entire category of risk.
- Workstations are a 4 to 6 year asset with a replacement budget, not a surprise. Build a rolling schedule so you never replace ten at once.
- Get every support arrangement in writing: scope, response times, what is monitored, who can remotely connect, and what they produce if you are audited.
Decision one: on-premises or cloud practice management
This is the fork that shapes everything else. Both models work. They fail differently.
| Consideration | On-premises server | Cloud or vendor-hosted |
|---|---|---|
| Up-front cost | Server, operating system, UPS, backup hardware: a meaningful capital item | Low, folded into a monthly fee |
| Ongoing cost | IT support, backup service, hardware refresh every 5 to 7 years | Per-provider or per-user monthly fee that never ends |
| Who owns uptime | You and your IT vendor | The software vendor |
| Internet dependency | Works locally if the internet drops | No internet, no practice. A second connection becomes essential |
| Backups | Your responsibility, including the offline copy and restore testing | Vendor's responsibility, but confirm what you can restore and how fast |
| Patching and OS lifecycle | Yours, including the server OS end-of-life problem | Vendor's for the application; you still manage workstations |
| Imaging integration | Generally the most mature path for sensors, pan, CBCT, and mills | Improving quickly, but verify every imaging device and bridge you own |
| Large image files | Move across your local network at gigabit speed | Move across your upload bandwidth, which is usually the constraint |
| Practice transitions | Data is in your building; export is a project | Data is in the vendor's system; read the contract's exit terms |
Hybrid arrangements are common and often sensible: cloud practice management with imaging stored locally, or an on-prem database with off-site cloud backup. The question to ask any vendor is not "is it cloud" but "where does each of my data types physically live, and what happens when the link to it breaks."
If you go cloud, buy two internet connections. A primary business fiber or cable circuit plus a secondary connection from a different provider, with a firewall that fails over automatically. A cellular failover is acceptable as the second path for a practice that mostly needs the schedule and charting to keep working. Budget for it up front rather than discovering the need on a day the neighborhood loses service.
If you go on-premises
A few specification points that hold regardless of software:
- Dedicated server. Not a workstation at the front desk doubling as the database host. Software vendors, including Open Dental in its published requirements, recommend dedicated hardware so the database is not competing for resources.
- Supported server operating system, with its end-of-support date written on your replacement plan. A server OS that leaves support while it is still hosting patient data is a Security Rule problem, not just an IT preference.
- Solid state storage for the database, sized generously, with mirrored or redundant drives. Redundancy protects against a drive failure. It is not a backup.
- RAM sized for the database engine, not just the operating system. Most dental systems use MySQL or MariaDB, and database memory settings are frequently left at defaults that no longer fit a 10-year-old practice.
- Virtualization is fine if the host is not also running five other things. Vendors generally warn about resource contention, and recommend dedicated storage and CPU allocation.
Decision two: storage, sized for growth
The single most common planning error is sizing storage against the current database. The database is small. The images are not, and imaging grows every day you are open.
Rough orders of magnitude, which vary widely by sensor, software, and compression settings:
| Image type | Typical file size range | Notes |
|---|---|---|
| Single intraoral radiograph | Hundreds of kilobytes to a few megabytes | A full-mouth series multiplies it by 18 or 20 |
| Panoramic image | Several megabytes | Higher with larger sensors and less compression |
| CBCT volume | Tens to hundreds of megabytes per scan | Field of view and voxel size drive this. The biggest single consumer |
| Intraoral scan case | Tens of megabytes | Plus design files if you mill or print in house |
| Intraoral camera photos | A few megabytes each | Volume adds up fast in a practice that photographs routinely |
| Scanned documents | Small individually | Large in aggregate over years |
How to plan it. Take your current total image folder size, divide by the number of years you have been capturing digitally, and you have an annual growth rate. Multiply by the planned life of the server, then double it to cover growth in patient volume and any new modality. If you are adding CBCT, model that separately: estimate scans per month times an average volume size times 12, and you will usually find it dominates everything else. CBCT field of view and dose covers the clinical side of that choice, and the digital sensor buying guide covers sensor selection.
Two practical implications: storage for imaging should be expandable without replacing the server, and your backup capacity and bandwidth need to grow with it. A cloud backup plan sized for a 40 GB image folder becomes expensive at 900 GB.
Power: UPS, and what actually needs one
Dental offices are electrically noisy environments with compressors and vacuum pumps cycling, and a hard power loss during a database write is a genuine way to corrupt a database.
- Server: a line-interactive or online UPS sized for enough runtime to shut down gracefully, typically 10 to 20 minutes, with USB or network communication to the server so it triggers an automatic orderly shutdown. A UPS without that signal just delays the crash.
- Network gear: firewall, switches, and wireless access points on protected power. Otherwise the server stays up and nothing can reach it.
- Phone system and internet equipment: a VoIP system with no UPS means you cannot take calls during an outage, which is often the most expensive consequence.
- Workstations: selectively. The front desk machine mid-transaction and any workstation driving an imaging capture are worth protecting. A hygiene operatory computer generally is not.
- Imaging equipment: follow the manufacturer's guidance. Some panoramic and CBCT units have specific power requirements and should not be placed behind a consumer UPS.
- Maintenance: UPS batteries last roughly 3 to 5 years and fail quietly. Put a self-test and a battery replacement date on the equipment maintenance log.
Surge protection is not power protection. A power strip with a surge rating does nothing for a brownout or a five-second outage, which is what usually corrupts a database. If the only thing between your server and the utility is a $30 strip, fix that before anything else in this article.
Network design: flat networks are the problem
Most dental offices are built as one flat network: everything plugged in can talk to everything else. That is convenient, and it means one compromised device reaches the server, the imaging store, and the backup destination.
Segmentation in plain terms
Segmentation divides the network into separate zones (usually VLANs) with rules about what may cross between them. A workable small-practice layout:
| Zone | What goes in it | Rule of thumb |
|---|---|---|
| Clinical and administrative | Workstations, server, printers | Full access to practice systems it needs, nothing more |
| Imaging devices | Pan and CBCT units, sensor bridge PCs, scanner carts, mills and printers | Allow only the specific traffic to and from the systems they must reach. Many of these run embedded operating systems that will never be patched |
| Legacy or unsupported machines | The old PC that runs one piece of software from 2011 | Isolate, restrict internet access entirely, and plan its replacement |
| Building systems | Cameras, door access, thermostats, TVs, digital signage | No path to the clinical zone. Consumer smart devices are a common weak point |
| Guest Wi-Fi | Patient and visitor devices, staff personal phones | Internet only, no access to any internal zone |
Segmentation does not require enterprise gear. A business-class firewall and managed switches handle it. The work is in the configuration and the documentation, which is why it needs to be a written requirement in your IT scope rather than a hope.
Wireless
- Separate SSIDs for practice devices and for guests, on separate VLANs.
- Client isolation on the guest network, so guest devices cannot see each other. This protects your patients from each other as well as protecting you.
- WPA3 where supported, WPA2 with a long passphrase otherwise, and a guest password that changes on a schedule. A printed password in the reception area is fine for a properly isolated guest network and unacceptable on the practice network.
- Wired for anything that matters. Workstations, the server, and imaging capture stations should be on cable. Wireless is for tablets, laptops, and guests. Intraoral scanner carts and portable devices are the common exception, and they belong in the imaging zone.
- Coverage planning. Lead-lined walls in radiography rooms and long narrow floor plates defeat single-access-point designs. Plan for multiple access points on ceiling mounts rather than one router in the server closet.
Cabling, which you only get one cheap chance at
During a buildout, pull more than you need. Cable is inexpensive while the walls are open and expensive afterward. A reasonable minimum per operatory is two data drops at the chair position plus one at any wall-mounted imaging unit, all terminated in a patch panel in a ventilated, lockable closet or rack. Run at least Category 6. Add drops at the front desk, consult rooms, sterilization, the lab, private office, and every planned access point location. See equipment planning for coordinating this with the rest of the trades.
Workstations: specification and lifecycle
Workstation requirements in dentistry are driven by imaging, not by the practice management software, which is typically light. The machine that captures and displays radiographs needs more than the machine at the front desk.
- Business-line hardware with a professional operating system edition. Home editions have networking and management limitations that cause real problems, and vendors generally recommend against them.
- Solid state drives everywhere. This is the cheapest perceived-speed upgrade available.
- RAM generously specified on any machine that opens imaging or 3D software.
- Displays sized for radiographs. Operatory monitors need adequate resolution and brightness, and clinicians should be able to control room lighting. Consider two displays at the front desk for insurance and scheduling work.
- Mounting and infection control. Keyboards and mice in operatories need to be cleanable or barrier-protected, and screens need to be positioned for patient education without exposing other patients' information to the hallway.
- Encryption on every device, which is what turns a stolen laptop into a police report rather than a mass notification.
The rolling replacement schedule
Plan on a 4 to 6 year workstation life and a 5 to 7 year server life, and replace on a rolling basis so you are buying two machines a year rather than twelve at once. Two things force earlier replacement: an operating system reaching end of support, and imaging software that raises its requirements. Track both.
IT asset inventory to maintain
- Every workstation, server, tablet, and phone with purchase date, warranty end, and OS version
- Network equipment: firewall, switches, access points, with firmware versions
- Imaging devices and the software and driver versions they depend on
- Every software product, license count, renewal date, and vendor support contact
- Where each category of data lives, including cloud services
- Every account with administrative rights, and who holds it
- UPS units with battery installation dates
- Planned replacement year for each asset
This inventory is not busywork. It is the foundation of a HIPAA security risk analysis, it is what an insurer asks for, and the proposed Security Rule update would make a maintained asset inventory and network map explicitly mandatory. Keep it current and you get three obligations done with one document.
Vendor support agreements: what to put in writing
Most dental IT is delivered by small local providers, and the quality varies enormously. The contract is where you find out which kind you hired. Require answers, in the agreement:
- Scope. Exactly which devices and systems are covered, and which are explicitly excluded (imaging vendors' software is a frequent gap).
- Response and resolution targets, separately for "the practice is down" and "one workstation is slow," including hours of coverage and how after-hours works.
- What is monitored and patched, on what schedule, with a monthly report you actually receive.
- Backup responsibility. Who configures it, who verifies it daily, who is accountable if a restore fails, and who performs the annual restore test.
- Remote access controls. Which tool they use, whether MFA is enforced on their console, whether technicians have named accounts, and whether you are notified when someone connects.
- A signed business associate agreement, because they can access ePHI.
- Documentation you own. Network diagram, IP addressing, credential inventory held in escrow or a shared password manager, and license keys. If your IT company disappeared tomorrow, could a replacement take over in a day?
- Exit terms. Cooperation during transition, return of documentation, and removal of their access.
Coordinate this with your equipment service relationships too. Imaging vendors, practice management vendors, and your IT provider each tend to blame the other two, and the only cure is knowing in advance who owns which boundary.
A sensible build order
For a startup or a full refresh, sequence it: choose practice management and imaging software first, because they set the hardware requirements; then design the network and pull cable while the walls are open; then specify the server or the second internet connection; then workstations; then power protection; then segmentation and wireless configuration; then backups, with a documented restore test before you see a single patient. Turning it on in that order avoids the expensive reversals.
For an acquisition, treat IT as a diligence item. Ask for the asset inventory, the last restore test, the OS versions, the support contract, and whether the amalgam separator and x-ray registrations transferred. Our acquisition due diligence checklist covers the rest, and the acquisition guide covers the deal itself.
Then close the loop on security: the realistic cybersecurity threat list, ransomware prevention and recovery, and the HIPAA security checklist.
This article is educational and not a substitute for advice from your software vendors, your IT provider, and a licensed electrician or low-voltage contractor. Confirm all manufacturer requirements before purchasing, and confirm HIPAA obligations with a healthcare attorney.
Educational content only. It is not legal, financial, tax, or clinical advice. Prices and ranges are approximate and vary by region, condition, and year. Verify current rules with your state dental board and qualified professionals. ChairsideSource is not affiliated with any manufacturer, the ADA, or the DAT.