What Happens to Your Data If You Leave

Every practice signs a business associate agreement with every company that touches patient information, and most owners sign it and never read it again. Inside that agreement is the only provision in federal regulation that speaks to what a vendor owes your practice when the relationship ends. It says considerably less than most owners assume.

The provision everyone thinks protects them

Here is 45 CFR 164.504(e)(2)(ii)(J), in full, describing what the business associate agreement must require:

"At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible."

Read it twice, because three things in it matter and none of them is what people expect.

It is return or destroy. The disjunctive is in the regulation, and nothing gives the practice the choice between the two. A vendor that deletes everything has complied.

It is qualified by "if feasible," twice. The second qualifier sets up an outcome where the vendor simply keeps the information under continuing contractual protections, so keeping it is expressly contemplated.

And it says nothing about format, nothing about timing, and nothing about whether the next system can open what you get back. No deadline. No usability standard.

So the one federal provision addressing the end of a vendor relationship gives the vendor an option that includes deleting your practice's history, and gives you no say in which option it picks. That is the floor. Everything above it comes from the contract you signed.

Your patient has a right you do not have

One clause up in the very same list, at 164.504(e)(2)(ii)(E), the agreement must require the business associate to make protected health information available in accordance with 164.524. That is the individual right of access, and unlike (J) it has real teeth about format:

"if the protected health information that is the subject of a request for access is maintained in one or more designated record sets electronically and if the individual requests an electronic copy of such information, the covered entity must provide the individual with access to the protected health information in the electronic form and format requested by the individual, if it is readily producible in such form and format"

HHS is explicit that this reaches information held by a vendor. Its right of access guidance says a covered entity "may not deny access because a business associate of the covered entity, rather than the covered entity itself, maintains the PHI requested by the individual," and it names the electronic health record vendor as its example. The same guidance notes that your thirty-day clock keeps running while you wait on the vendor.

Sit with the shape of that. A format-specific obligation runs to your patient. A format-silent obligation runs to you. Your patient can require of you something you cannot require of the company holding it, and you are answerable for the delay.

The rule you think covers your software probably does not

Ask a dental owner who is subject to the information blocking rules and most will say the software company is. The definitions are narrower than that.

Under 45 CFR 171.102, an actor is a health care provider, a health IT developer of certified health IT, or a health information network or exchange. A dentist is an actor as a health care provider, with no condition attached about whether the practice uses certified technology. A software company is an actor only if it holds at least one Health IT Module certified under the ONC Health IT Certification Program, and most dental practice management software holds none. Being your business associate does not put a vendor in scope either, because business associate is not one of the three categories.

This is not an interpretation. The ADA told HHS so directly in a July 2025 filing, in a section headed "Clarify Definitions in 45 CFR 171.102 and Close Information Blocking Loopholes." Dentists must comply, the ADA wrote, regardless of whether their health IT is certified. Then:

"However, dental technology vendors, who manage patient data, do not face the same sharing obligations, as their software is often not certified health IT. This situation places a significant burden on providers, who may need to manually extract data and ensure compliance when their technology lacks adequate functionality."

The ADA asked HHS to widen the definition so that this software would count as an actor. Asking for the change is the proof that it has not happened.

Worth correcting one thing in circulation: several IT guides tell dental owners that a cloud vendor cannot obstruct their retrieval of records under the Cures Act. For most dental practice management software that is not true today, and an owner relying on it is relying on a rule that does not reach the company holding their records.

There are three estates, and only one of them gets migrated

Ask a vendor about switching and you get a conversation about the practice management database. That database is one of three things your practice has accumulated, and the other two rarely come up.

The imaging archive is its own object with its own custodian. The ADA told federal regulators in March 2026 that many existing systems store decades of images in non-interoperable proprietary formats requiring extensive custom conversion work, and then the sentence every owner should read before signing anything: "Even with specialized tools, some image data cannot be fully recovered." The same letter says imaging vendors "frequently use proprietary formats as a means of customer retention," and that practices wanting to switch face "significant technical and contractual obstacles."

The patient communication history is the one almost nobody asks about, and the one most likely to disappear without anyone noticing. Every patient communication product describes at length how it captures conversations. Almost none describes how you get them out. A practice can execute a flawless practice management migration and still lose every message thread and call recording it ever had, because none of that lived in the system being migrated. It lived somewhere else, under a separate agreement, on a separate termination clock, run by a company nobody thought to call.

How many years come across is a decision, not a technical fact

Migration proposals are priced by how much history converts, and the number usually gets chosen on cost. That is a reasonable business decision. What makes it a legal one is what happens to the part left behind.

Your retention obligation for those older records is set by state law, not by your vendor and not by HIPAA. The ADA's own guidance on record retention says the period varies with state law and with contracted benefit plans, and points dentists to their state board, their attorney, and their liability carrier. There is no national number, and any article that gives you one is guessing.

The protection is in the terms, so settle them while a vendor still wants you

No regulation is coming to rescue a practice at the end of a software relationship. The floor is low, the format language runs to your patients rather than to you, and the sharing rules bind you more tightly than they bind the company holding your history.

What is left is the contract, and the only moment a vendor has much reason to negotiate it is before you sign. Ask what you get back and in what format. Ask how long it takes after you give notice. Ask whether you can pull your own routine export and hold a copy yourself, so the answer never depends entirely on somebody else's cooperation. And notice how the vendor responds to being asked, because a company that will not put its exit terms in writing has told you what its exit terms are.

Where we stand on this

Since this post argues that owners should ask, it would be poor form not to answer.

AiroDental integrates with Dentrix, Dentrix Ascend, Open Dental, and CareStack, reading from and writing to each. We do not hold or move your imaging. What we do hold is your patient communication record, which is exactly the estate nobody warns you about, so we will tell you in writing what we hand back, in what format, and how long it takes, before you sign anything. And because there are no contracts and no onboarding fee, leaving does not require a negotiation.

Ask us the same questions you should be asking everyone else. Start with a short call.

Deren Flesher, DDS. Founder, AiroDental.