What is the administrator role called in each practice management system?

Each vendor uses its own word. Dentrix calls it the password administrator. Open Dental calls it the Security Admin permission; "Only users with the Security Admin security permission can access the Security area," the manual says. CareStack sets up users in Practice Settings, links them to profiles that set their access level, and limits some edits to users with the Add/Edit Users permission. Dentrix Ascend uses roles and rights; read its help pages for the current wording. The page the practice writes should use each vendor's own term so the next office manager can find it in the help documentation.

Does HIPAA say who must hold the administrator login?

No. The HIPAA Security Rule protects electronic patient information; it does not prescribe who holds a login. What it does ask is that a practice ensure its workforce has "appropriate access" to that information, determine that each workforce member's access is appropriate, and have procedures for ending access when someone leaves. HHS's own guidance asks whether the practice's termination procedures "assign responsibility for removing information system and/or physical access." You cannot assign that responsibility to someone who cannot log in as administrator.

What happens to software access when a dental office manager leaves?

Someone with the administrator role in each system removes or inactivates her account, changes any shared credential she knew, and moves the recovery email or phone number off her inbox if it was there. Open Dental's manual notes that users cannot be deleted but can be hidden, which it describes as useful when an employee leaves. The practice can only do this on the day it is needed if, before that day, it wrote down which system's administrator is who. This blog's earlier post on the person who knows everything leaving covers the rest of that day.

Where does a practice keep the list of who holds administrator access?

The list says, for each system, what that system calls its top role, who holds it, who holds it second, and where the recovery code goes. It does not contain the passwords themselves; where those live is a question for whoever advises the practice on security. Saige, the team-facing assistant in AiroDental, is where the list lives, beside the practice's other standing instructions, so the office manager who inherits the sticky note can ask who holds the administrator role for the phone system and get the practice's own answer back. Laine's administrator credential belongs on the same page.

The Admin Login on the Sticky Note

November 6, 2026 · 7 min read

There is a sentence in the Dentrix help documentation, on the page about turning on passwords, that reads: "If you enable passwords, you must set up at least one password administrator." The sentence after it is the one worth stopping on: "Consider adding a second password administrator to ensure that someone with those rights is always available in your practice."

The vendor is telling you, in its own instructions, what it has watched happen. One person held the administrator rights. That person went on leave, or quit, or was let go, and the practice found out what "administrator" meant the morning it needed to add a new hire to the system and nobody could. The help page's answer is a second administrator. This post is about the page the practice writes so that it knows who the first one is.

Every system has one

Every piece of software in a dental practice has a top credential, and every vendor calls it something different. In Dentrix it is the password administrator. In Open Dental it is a permission: "Only users with the Security Admin security permission can access the Security area," the manual says, and the Security area is where users are added, where their rights are set, and where a departed employee is hidden from the login window, which the manual notes is "Useful when an employee leaves the office," because "Users cannot be deleted." In CareStack, user accounts are set up in Practice Settings, "Users are linked to profiles to determine their access level," and "Only users with Add/Edit Users permission will be able to edit the Email address." Dentrix Ascend has its own roles and rights, described on help pages that would not open for me while I was writing this; read yours.

Then keep going past the practice management system. The phone system has an administrator who can change the greeting and the call routing. The imaging software has one. The texting platform, the website host, the email account that every password reset is sent to, the bank's online portal, the payroll service, the patient financing portal, the alarm company. Each one has a single login that can create and remove every other login in it, and in most practices that login was created once, by whoever set the system up, and has not been thought about since.

The sticky note

That is how the administrator login ends up on a sticky note under the keyboard, or on the last page of the office manager's notebook, or in the memory of the IT vendor who did the conversion years ago. It is not usually carelessness. It is the practice answering a question nobody asked out loud: who holds this? The sticky note is the answer, and it is an honest one. The person who wrote it knew the credential had to live somewhere and that nobody had said where.

This blog spent a post on who owns each piece of software in a practice, and the argument there was that ownership means the authority to decide how a tool is used. Access is the other half of that. The person who owns the phone system is not always the person who can log into it as administrator, and when the two are different people and nobody has written down which is which, the practice has a tool it can decide about and cannot change. Usually it finds out the day the one person who could change it is gone, which is the day this blog wrote about when the person who knows everything leaves.

What the rule asks, and what it does not

The HIPAA Security Rule protects electronic patient information. It does not prescribe who holds a login, and nothing below should be read as if it did.

What it does ask is narrower and useful. The workforce security standard at 45 CFR 164.308(a)(3) requires a practice to "ensure that all members of its workforce have appropriate access to electronic protected health information." One of its implementation specifications, workforce clearance, asks the practice to "determine that the access of a workforce member to electronic protected health information is appropriate." Another, termination procedures, is the one the post on the departing office manager walked through, and it will not be re-quoted here.

HHS wrote a plain-language paper on these standards, Security Series Paper 2, and its section on termination procedures carries the sentence a practice needs: "Termination procedures must be implemented to remove access privileges when an employee, contractor, or other individual previously entitled to access information no longer has these privileges." Then, in its list of sample questions a practice might ask itself: "Do the termination policies and procedures assign responsibility for removing information system and/or physical access?"

Assign responsibility for removing access. You cannot assign that responsibility to someone who does not hold the administrator credential for the system in question, and you cannot know whether you have assigned it if you do not know who holds the credential. The regulation is about protecting information. The sticky note is about whether the practice can act on that regulation at all.

The page

So the practice writes a page, and it is a list of systems, one line each, in prose or in a table, it does not matter. For each system the line says what that system calls its top role, in the vendor's own word, because "administrator" in one product is "Security Admin" in another, and the new office manager searching the help pages needs the right word. It says who holds that role today, by name. It says who holds it second, which is the Dentrix page's advice applied to everything, and the second holder is usually the owner dentist whether he wants to be or not. It says where the reset goes: the email address or phone number the vendor sends a recovery code to, which is a credential of its own and is very often a former employee's inbox. And it says, for the day the first holder leaves, what gets changed, by whom, and in what order, which is the responsibility HHS asked the practice to assign.

Then the sticky note comes off the keyboard. The login does not go on the page; the page says who has it. Where the credential itself lives is a question for whoever advises the practice on security, and the honest answer in most small offices is a password manager with the owner holding the master, which is a different post.

That page is short, it is boring, and the first time it is read for real is the worst day to be writing it.

Where it goes

Laine, the AI receptionist in AiroDental, has an administrator credential like everything else in the practice, and it belongs on that page with the rest. Saige, the team-facing assistant, is where the page lives, beside the other things the practice wrote down once, so the office manager who inherits the sticky note can ask who holds the administrator role for the phone system and get the practice's own answer back.

There is no long-term contract and no onboarding fee. See how the modules fit together.

General information, not legal advice. Whether and how the HIPAA Security Rule applies to a particular practice, system or workforce member is a question for your attorney and your security official.

Deren Flesher, DDS. Founder, AiroDental.

Frequently asked questions

Who should have administrator access to dental practice software?: A named person the practice chose, plus a second, which is the advice in Dentrix's own help documentation: "Consider adding a second password administrator to ensure that someone with those rights is always available in your practice." In most small offices the second holder is the owner dentist. The point is less who than that the practice can say who, for every system, without checking a sticky note.
What is the administrator role called in each practice management system?: Each vendor uses its own word. Dentrix calls it the password administrator. Open Dental calls it the Security Admin permission; "Only users with the Security Admin security permission can access the Security area," the manual says. CareStack sets up users in Practice Settings, links them to profiles that set their access level, and limits some edits to users with the Add/Edit Users permission. Dentrix Ascend uses roles and rights; read its help pages for the current wording. The page the practice writes should use each vendor's own term so the next office manager can find it in the help documentation.
Does HIPAA say who must hold the administrator login?: No. The HIPAA Security Rule protects electronic patient information; it does not prescribe who holds a login. What it does ask is that a practice ensure its workforce has "appropriate access" to that information, determine that each workforce member's access is appropriate, and have procedures for ending access when someone leaves. HHS's own guidance asks whether the practice's termination procedures "assign responsibility for removing information system and/or physical access." You cannot assign that responsibility to someone who cannot log in as administrator.
What happens to software access when a dental office manager leaves?: Someone with the administrator role in each system removes or inactivates her account, changes any shared credential she knew, and moves the recovery email or phone number off her inbox if it was there. Open Dental's manual notes that users cannot be deleted but can be hidden, which it describes as useful when an employee leaves. The practice can only do this on the day it is needed if, before that day, it wrote down which system's administrator is who. This blog's earlier post on the person who knows everything leaving covers the rest of that day.
Where does a practice keep the list of who holds administrator access?: The list says, for each system, what that system calls its top role, who holds it, who holds it second, and where the recovery code goes. It does not contain the passwords themselves; where those live is a question for whoever advises the practice on security. Saige, the team-facing assistant in AiroDental, is where the list lives, beside the practice's other standing instructions, so the office manager who inherits the sticky note can ask who holds the administrator role for the phone system and get the practice's own answer back. Laine's administrator credential belongs on the same page.

The Count

No practice closes the day on a feeling; the day sheet is set against the deposit. A software trial deserves the same habit. This post shows how to keep two columns, the task done in the tool and the task done the old way, who keeps them, and what to do when the count and the mood disagree.

October 16, 2026 · 6 min read

The Thing You Are Still Doing By Hand

Open the top drawer at your front desk. There is a notebook in it that was supposed to be gone when you bought the software. A by-hand process survives for one of three reasons: it is a backup, nobody was entitled to end it, or the software does not do the job. Each one calls for a different response, and none of them is throwing the notebook away.

October 9, 2026 · 6 min read

What a Trial Is Actually For

The email says your trial ends tomorrow. In a lot of practices nobody can say whether anyone used it, because nobody decided at the start that this was the thing to find out. A trial is not for confirming you like a product. It is for finding out whether your team will use it before the money is spent.

September 25, 2026 · 7 min read