Free clinic self-assessment

Who actually controls your clinic’s technology?

Use this detailed ownership and recovery review to find accounts, systems, vendors, and workflows that may fail during an outage, employee departure, vendor change, or emergency.

Start the assessment

How to use this assessment

Do not mark an item confirmed just because someone knows a password.

The clinic should control ownership, billing, administrator access, MFA, recovery methods, and vendor relationships. Recovery should be possible without depending on one employee, one personal phone, or the current IT provider.

For each checklist section, choose the one status that best describes your clinic today.

Use the same four choices throughout the assessment. A section should be marked Confirmed and tested only when the clinic controls the account or system and has recently proven that access or recovery works.

Confirmed and testedThe clinic controls the system, the details are documented, and access or recovery was recently verified.

Documented, not testedThe clinic has written information and believes it has access, but recovery or transfer has not been proven.

Partially knownSome ownership or recovery details are available, but one or more important gaps remain.

Unknown or vendor-controlledThe clinic cannot independently access, recover, administer, or transfer the system.

Immediate red flags

A former employee or outside vendor owns the domain, firewall, backup platform, Microsoft tenant, Google Workspace, or Zoho organization.
Only one person has administrator access, or MFA is tied to one personal phone.
No one can explain exactly what is backed up or demonstrate a successful restore.
Remote-access tools are installed, but the clinic does not know who can connect.
Shared files, scanning, or another critical workflow depends on one workstation or one employee account.
Billing and renewal notices go only to an outside vendor or former manager.

Detailed review

Open each section and mark what your clinic can actually verify.

At the end of each section: select one of the four statuses above based on the weakest unresolved item in that section.

Domain, DNS, website, and email ownershipReview section

The clinic knows its domain registrar—not merely the website company or DNS provider.
The registrant, account owner, billing method, and recovery contacts are clinic-controlled.
At least two appropriate clinic representatives can access the registrar and DNS.
MFA and recovery methods have been tested.
Name servers, important DNS records, website hosting, and email-routing services are documented separately.
The clinic can remove a former web developer or IT provider without losing the domain or website.

Section status:

Microsoft 365 and EntraReview section

The clinic knows its Microsoft tenant name, primary domains, subscriptions, and billing owner.
At least two clinic-controlled Global Administrators exist.
Administrator MFA, session revocation, password reset, and account recovery have been tested.
Emergency or break-glass access is documented and protected.
The clinic knows whether computers are Entra joined, registered, or using local accounts.
Former administrators, devices, app access, authentication methods, and sessions can be revoked.

Section status:

Google Workspace and Zoho WorkplaceReview section

The clinic knows whether Google Workspace or Zoho Workplace is purchased directly, through a reseller, or through another provider.
At least two appropriate clinic-controlled administrators exist.
Google Super Administrator or Zoho organization administrator recovery has been tested.
Recovery email addresses, phone numbers, MFA devices, and billing belong to the clinic.
Google Shared Drives, Zoho WorkDrive Team Folders, groups, calendars, forwarding, and sharing rules are documented.
The clinic can revoke sessions, app passwords, passkeys, connected applications, and former vendor access.
The clinic understands that Google, Zoho, Microsoft 365, Windows sign-in, and the domain registrar are separate systems unless intentionally integrated.

Section status:

Durable support and recovery accountsReview section

The clinic has named support and recovery accounts that remain clinic-owned when vendors change.
Accounts are not permanently tied to one technician’s or employee’s personal email or phone.
Routine users do not share emergency credentials.
Passwords, MFA, recovery methods, and trusted devices can be rotated.
Local workstation recovery accounts are documented separately from cloud administrator accounts.

Section status:

Internet, firewall, switches, and Wi-FiReview section

The ISP account number, authorized contacts, support PIN, service address, and billing owner are documented.
Firewall, switch, access-point, and controller ownership is known.
Administrative credentials and MFA belong to the clinic.
Guest and business networks are separated where appropriate.
Unused port forwarding and obsolete vendor access have been removed.
Remote Desktop is not exposed directly to the public internet.
A basic network diagram identifies the gateway, switches, access points, servers, printers, scanners, and critical workstations.
Configuration backups and equipment replacement information are available.

Section status:

Computers and administrative accessReview section

Every clinic computer has an asset name, location, assigned user or purpose, serial number, operating system, and replacement age.
Routine staff do not have unnecessary local-administrator rights.
Approved support and recovery administrator accounts are documented and tested.
BitLocker or other disk-encryption recovery keys are stored in a clinic-controlled location.
Former staff profiles and access have been removed or secured.
Unsupported, unpatched, or aging computers are identified.
The clinic knows which computers perform critical shared functions.

Section status:

Remote support, VPN, guest Wi-Fi, and network segmentationReview section

A separate Wi-Fi name does not necessarily mean a separate network.

Guest devices should be prevented from reaching clinic computers, shared files, printers, scanners, administrative interfaces, and one another. Separation should be verified with firewall rules and an actual connection test.

Section status:

Files, shared drives, and data ownershipReview section

The clinic knows where active business files are stored.
Local folders, mapped drives, Google Drive, Zoho WorkDrive, OneDrive, SharePoint, EHR storage, and personal cloud accounts are distinguished.
Shared files are not dependent on one employee’s personal account.
Google Shared Drives or Zoho WorkDrive Team Folders are used where organizational ownership is needed.
Access groups, permissions, external sharing, and public links are reviewed.
The clinic knows which computer hosts shared folders or synchronization clients.
The clinic knows what happens if the synchronization computer or file-hosting workstation fails.

Section status:

Backups, restoration, and continuityReview section

The clinic knows exactly which systems, devices, databases, and cloud services are backed up.
Google Drive, Zoho WorkDrive, OneDrive, synchronization, Trash, and version history are not automatically treated as a complete backup.
At least one backup copy is isolated from ordinary user deletion or compromise.
Backup failures and stale jobs are reviewed by more than one appropriate recipient.
Restore tests are performed, documented, and timed.
Microsoft 365, Google Workspace, Zoho Workplace, local files, workstations, and application databases are evaluated separately.
The clinic can restore data if its current IT provider is unavailable.
Backup administration, encryption material, billing, and renewal ownership belong to the clinic.

Section status:

Printers, copiers, scanners, and clinical workflowsReview section

Each device’s make, model, IP address, location, lease, and support vendor are documented.
Scan-to-folder, scan-to-email, fax, address books, and authentication methods are documented.
The clinic knows whether scanning depends on one workstation, mapped drive, user account, or stored password.
Scan destinations are clinic-controlled, protected, and backed up where appropriate.
Drivers, utilities, configuration exports, and vendor contacts are retained.
Scanning has been tested after password changes and workstation replacement.
EHR import, document routing, fax, and other workflow dependencies are understood.

Section status:

EHR and critical vendorsReview section

Every critical technology vendor has a clinic-controlled administrative and billing contact.
Account numbers, support numbers, escalation paths, contracts, and renewal dates are documented.
The clinic knows which vendors require VPN, remote access, firewall rules, static IP addresses, or local software.
EHR administrator access does not depend on one employee.
Lab, imaging, payment, fax, phone, e-prescribing, and interface dependencies are documented.
Vendor remote access can be disabled independently.

Section status:

Telephone, fax, messaging, and patient communicationsReview section

The clinic owns the phone-provider and fax-service accounts.
Main numbers, fax numbers, extensions, call queues, voicemail boxes, routing, and after-hours messages are documented.
Number-porting PINs and authorized contacts are known.
Recovery methods do not belong to former employees or vendors.
SMS, appointment-reminder, patient-messaging, and mass-notification services are inventoried.

Section status:

Security, identity, MFA, and recoveryReview section

Recovery email addresses and phone numbers belong to the clinic.
MFA methods are assigned to named individuals and reviewed when staff change.
Old phones, authenticator registrations, passkeys, hardware keys, app passwords, and sessions can be revoked.
At least two authorized clinic representatives can begin critical account recovery.
Recovery codes are stored securely and separately from routine credentials.
Personal email addresses are not used as permanent business recovery accounts.

Section status:

Billing, subscriptions, and renewalsReview section

Every critical service has a documented billing owner and clinic-controlled payment method.
Renewal notices go to a monitored clinic-controlled address.
Monthly and annual services are inventoried.
The clinic knows what will stop working if a card expires or a subscription lapses.
Former vendors cannot continue purchasing or renewing services without approval.
Domain, cloud, backup, remote support, network, phone, website, licensing, and security renewals are tracked.

Section status:

Employee and vendor transitionsReview section

The clinic requires employees, contractors, volunteers, students, and other authorized users to sign a current confidentiality and technology-access agreement before receiving access.
A written employee onboarding checklist exists.
A written employee offboarding checklist exists.
A separate vendor-transition checklist exists.
Account disabling, session revocation, MFA removal, forwarding, file transfer, remote access, and device return are covered.
Shared passwords and security codes are rotated when someone with access leaves.
Temporary access has an expiration or review date.

Section status:

Documentation and recovery testingReview section

The clinic maintains one current technology ownership and recovery document.
The document identifies owners, administrators, vendors, billing contacts, support paths, and recovery methods.
Passwords are kept in an appropriate vault rather than directly in the general document.
A named person is responsible for keeping the documentation current.
The document was reviewed within the last six months.
A second authorized clinic representative can locate and understand it.
The clinic can access essential recovery information during an internet outage or account lockout.
Recovery procedures have been tested rather than merely written down.

Section status:

Live result

Your assessment summary

0sections rated

0uncertain sections

Not yet ratedChoose a status at the end of each section.

Privacy: Answers stay in this browser session and are not sent to ClinicsIT. Do not enter patient information or passwords.

Overall result

Count the sections that are not fully confirmed and tested.

0–3 uncertain sections

Generally organized. Review annually and after significant staffing or vendor changes.

4–7 uncertain sections

Important continuity gaps exist. Prioritize identity, data access, backups, and communications.

8–11 uncertain sections

Elevated risk during outages, departures, account lockouts, or vendor changes.

12 or more uncertain sections

Begin an ownership and recovery project before the next emergency forces the issue.

This is not a HIPAA compliance score. It is an operational ownership, continuity, and recovery assessment.

Not sure how many items your clinic can verify?

ClinicsIT can help document ownership, test recovery access, and prioritize the most important gaps without requiring a long-term IT agreement.

Schedule a Free 20-Minute Clinic IT Review

Who actually controls your clinic’s technology?

Do not mark an item confirmed just because someone knows a password.

For each checklist section, choose the one status that best describes your clinic today.

Immediate red flags

Open each section and mark what your clinic can actually verify.

A separate Wi-Fi name does not necessarily mean a separate network.

Related downloadable document

Your assessment summary

Count the sections that are not fully confirmed and tested.

Not sure how many items your clinic can verify?