Practice by Numbers
Step-by-step implementation guide — pre-implementation checklist, onboarding, staff training, go-live runbook, and ROI tracking.
Practice by Numbers — Implementation Playbook (DSO)
Practice by Numbers Implementation Playbook
Analytics & Business Intelligence for Dental Service Organizations
1. Executive Summary
What Practice by Numbers Does
Practice by Numbers (PBN) is a comprehensive analytics and business intelligence platform that aggregates data from practice management systems, imaging software, and other dental technologies to deliver real-time operational insights, automated reporting, and predictive analytics. The platform transforms fragmented location-level data into unified, actionable intelligence across clinical performance, revenue cycle management, patient acquisition, and provider productivity.
Why DSOs Benefit from Analytics & Business Intelligence AI
At scale, DSOs operate with a fundamental disadvantage: data fragmentation. Each location generates thousands of data points daily across disparate systems, but without centralized analytics, identifying underperformance, replicating success, and making evidence-based decisions becomes nearly impossible. Practice by Numbers addresses this by:
- Eliminating manual reporting burden: Regional managers currently spend 8-12 hours weekly compiling spreadsheets from individual locations—PBN automates this entirely
- Enabling apples-to-apples comparison: Standardized KPIs allow true benchmarking across locations, providers, and time periods regardless of underlying PMS differences
- Accelerating pattern recognition: AI-driven anomaly detection surfaces revenue leakage, scheduling inefficiencies, and clinical outliers that would take months to identify manually
- Supporting M&A integration: New acquisitions can be onboarded into your analytics infrastructure within days, providing immediate visibility into acquired operations
Expected Timeline: Decision to Full Deployment
| Phase | Duration | Locations Covered |
|---|---|---|
| Pre-Implementation & Pilot Prep | Weeks 1-2 | Central team only |
| Wave 1 Pilot | Weeks 3-5 | 2-3 locations |
| Wave 2 Expansion | Weeks 6-9 | 5-8 locations |
| Wave 3 Scale | Weeks 10-14 | Remaining locations |
| Optimization & Stabilization | Weeks 15-18 | All locations |
Total timeline for 15-50 location DSO: 14-18 weeks to full deployment
2. Pre-Implementation Checklist (Weeks 1-2)
Technical Requirements
Hardware
☐ Verify minimum workstation specifications at each location:
- Windows 10/11 or macOS 10.15+
- 8GB RAM minimum (16GB recommended for power users)
- Modern browser (Chrome, Edge, Safari—latest two versions)
- Dual monitors recommended for dashboard users (regional managers, office managers)
☐ Confirm network infrastructure:
- Minimum 25 Mbps upload/download per location
- Stable internet connection (99.5%+ uptime)
- Firewall rules allowing outbound HTTPS traffic to PBN endpoints
Software
☐ Document current PMS versions at all locations:
- Dentrix (G7.0 or higher recommended)
- Eaglesoft (21.0 or higher recommended)
- Open Dental (21.1 or higher recommended)
- Other PMS systems—confirm API availability with PBN
☐ Document imaging systems:
- Dexis, Patterson Imaging, Romexis, etc.
- Note version numbers and integration capabilities
☐ Identify existing BI tools being replaced or consolidated
Enterprise-Level Requirements
☐ 🟣 Determine hosting architecture:
- Cloud-hosted (standard) vs. hybrid deployment
- Data residency requirements (if multi-state with specific compliance needs)
☐ Configure SSO integration:
- SAML 2.0 compatibility with existing identity provider (Okta, Azure AD, Google Workspace)
- 🔵 Coordinate with PBN technical team for SSO configuration
☐ Establish centralized credentialing approach:
- Role-based access control (RBAC) hierarchy:
- Executive view (all locations, all metrics)
- Regional view (assigned locations, all metrics)
- Location view (single location, operational metrics)
- Provider view (individual production data)
☐ Document network standards across locations:
- VPN requirements (if applicable)
- Proxy configurations
- SSL certificate management
Vendor Onboarding Steps
| Step | Action | Owner | Timeline |
|---|---|---|---|
| 1 | Execute master services agreement and BAA | Legal/Compliance | Day 1-3 |
| 2 | 🔵 Schedule kickoff call with PBN implementation team | VP Operations | Day 2 |
| 3 | 🔵 Receive dedicated Customer Success Manager contact | PBN | Day 3 |
| 4 | 🔵 Obtain access to PBN implementation portal | IT Lead | Day 3-4 |
| 5 | 🔵 Complete PBN enterprise questionnaire | VP Ops + IT | Day 4-5 |
| 6 | 🔵 Schedule technical integration planning session | IT Lead + PBN | Day 5-7 |
| 7 | Establish escalation contacts and SLA expectations | VP Operations | Day 7 |
Key Vendor Contacts to Establish
☐ Implementation Project Manager (day-to-day coordination) ☐ Technical Integration Specialist (API/PMS questions) ☐ Customer Success Manager (strategic alignment, ongoing relationship) ☐ Support desk contact and ticket submission process ☐ Executive sponsor at PBN (for escalations)
Data/Access Prerequisites
Per-Location Requirements
☐ PMS administrative credentials or API keys ☐ Read access to PMS database (PBN operates read-only) ☐ Imaging system credentials (if integrating imaging data) ☐ Patient communication platform access (if applicable) ☐ Payroll/HR system credentials (if tracking labor costs)
Centralized Requirements
☐ Master location list with:
- Location ID/name
- Address and time zone
- PMS type and version
- Office manager contact
- Provider roster
☐ Organizational hierarchy definition:
- Regional groupings
- Reporting relationships
- Brand/sub-brand structure (if applicable)
☐ Historical data scope decision:
- ⚠️ Determine how much historical data to ingest (recommendation: 24 months minimum for meaningful trending)
- 🔵 Confirm PBN's data ingestion timeline based on volume
Internal Stakeholder Alignment
Stakeholder Alignment Map
| Stakeholder Level | Role | Engagement Type | When | Owner |
|---|---|---|---|---|
| Board/Investors | Awareness | Quarterly update inclusion | Pre-decision | CEO |
| C-Suite | 🟣 Approval | Initiative approval, budget sign-off | Week -2 to 0 | CEO/CFO |
| CDO | 🟣 Approval | Clinical metric selection, provider communication | Week 1 | VP Operations |
| CFO | 🟣 Approval | ROI targets, budget allocation | Week -1 | VP Operations |
| VP Operations | Driver | Full ownership of implementation | Ongoing | — |
| Regional Managers | Co-pilots | Wave planning, location selection, daily coordination | Week 1+ | VP Operations |
| IT Leadership | Enabler | Technical architecture, security review | Week 1-2 | VP Operations |
| Compliance/Legal | Gate | HIPAA review, BAA execution | Week 1 | IT Leadership |
| Office Managers | Informed → Involved | Location-level coordination, champion identification | Week 2+ | Regional Managers |
| Providers | Informed | Communication about metrics visibility | Week 3+ (pre-Wave 1) | CDO |
| HR/Training | Enabler | Training logistics, competency tracking | Week 2+ | VP Operations |
Approval Milestones
☐ 🟣 Budget approval (software licensing + implementation support) ☐ 🟣 Timeline approval (including productivity dip expectations during rollout) ☐ 🟣 Data governance approval (what data is shared, who sees what) ☐ 🟣 Metric standardization approval (CDO sign-off on clinical KPIs) ☐ 🟣 Communication plan approval (what and when providers are told)
Baseline Metrics to Capture
⚠️ Critical: Without standardized baseline metrics, ROI measurement is impossible. Capture these BEFORE any location goes live.
Financial Metrics (per location, trailing 12 months)
| Metric | Source | Standardization Notes |
|---|---|---|
| Collections per month | PMS | Gross vs. net collections—define once |
| Production per month | PMS | By provider, by procedure category |
| Accounts receivable aging | PMS | 30/60/90/120+ buckets |
| Collection rate | Calculated | Collections ÷ Adjusted Production |
| Revenue per patient visit | PMS | Define "visit" consistently |
Operational Metrics (per location, trailing 6 months)
| Metric | Source | Standardization Notes |
|---|---|---|
| Patient visit volume | PMS | Unique patients vs. visits—define |
| New patient volume | PMS | Define "new" (never seen vs. lapsed) |
| Case acceptance rate | PMS | By treatment category, by provider |
| Hygiene reappointment rate | PMS | Before patient leaves chair |
| Chair time utilization | PMS/Schedule | Define "utilization" formula |
| Cancellation/no-show rate | PMS | Distinguish cancellation types |
Clinical Metrics (per location, trailing 6 months)
| Metric | Source | Standardization Notes |
|---|---|---|
| Average diagnosis time | PMS + Workflow | Time from imaging to treatment plan |
| Treatment completion rate | PMS | % of accepted treatment completed |
| Hygiene to doctor referral rate | PMS | Procedures referred during hygiene |
| Perio percentage | PMS | % of hygiene visits coded perio |
Revenue Cycle Metrics (per location, trailing 6 months)
| Metric | Source | Standardization Notes |
|---|---|---|
| Claim denial rate | PMS/Clearinghouse | By denial reason code |
| Days in A/R | PMS | Define calculation method |
| Write-off percentage | PMS | By write-off reason |
| Insurance verification rate | PMS | Pre-appointment verification % |
Standardization Protocol for Cross-Location Comparison
☐ Create metric definition document with:
- Exact formula for each metric
- Data source specifications
- Inclusion/exclusion rules
- Time period definitions
☐ 🟣 CDO and CFO approval on metric definitions
☐ Assign one analyst to pull baseline data for ALL locations using identical methodology
☐ ⚠️ Do not allow locations to self-report—central data pull ensures consistency
☐ Store baseline in centralized repository with location-level breakouts
3. Location Readiness Assessment
Scoring Framework
Score each location on these five factors (1-5 scale). This produces a composite readiness score (5-25) used to sequence rollout waves.
Factor 1: IT Infrastructure Maturity (Weight: 1.2x)
| Score | Network Speed | Hardware Age | PMS Version | Description |
|---|---|---|---|---|
| 5 | 100+ Mbps | <2 years | Latest | Excellent infrastructure, no upgrades needed |
| 4 | 50-99 Mbps | 2-3 years | Current-1 | Good infrastructure, minor updates only |
| 3 | 25-49 Mbps | 3-4 years | Current-2 | Adequate, may need minor remediation |
| 2 | 10-24 Mbps | 4-5 years | Current-3 | Requires pre-rollout upgrades |
| 1 | <10 Mbps | 5+ years | Outdated | Significant infrastructure investment needed |
Factor 2: Staff Tenure and Adaptability (Weight: 1.0x)
| Score | Turnover Rate | Tech Comfort | Training History | Description |
|---|---|---|---|---|
| 5 | <15% annually | Highly tech-savvy | Completed 3+ recent tech trainings | Change-ready team |
| 4 | 15-25% | Comfortable with tech | Completed 2 recent trainings | Adaptable team |
| 3 | 25-35% | Average tech skills | Completed 1 recent training | Standard readiness |
| 2 | 35-50% | Some tech resistance | No recent tech training | Will need extra support |
| 1 | >50% | Significant resistance | Training failures noted | High change risk |
Factor 3: Patient Volume (Weight: 0.8x)
| Score | Monthly Patients | Consideration |
|---|---|---|
| 5 | 200-400 | Ideal testing volume—meaningful data without chaos |
| 4 | 401-600 | Good volume, manageable complexity |
| 3 | 100-199 | Lower impact but also lower risk |
| 2 | 601-800 | High volume, higher risk during transition |
| 1 | 800+ or <100 | Very high-volume risk OR insufficient data |
Factor 4: Tech Stack Compatibility (Weight: 1.1x)
| Score | PMS Integration | Imaging Integration | Other Integrations |
|---|---|---|---|
| 5 | Native integration available | Native integration | All key systems integrate |
| 4 | Standard API available | API available | Most systems integrate |
| 3 | Requires custom work | Requires custom work | Some gaps |
| 2 | Limited integration | Limited | Significant manual work needed |
| 1 | No integration path | No integration | Would require workarounds |
Factor 5: Local Champion Availability (Weight: 1.0x)
| Score | Champion Description |
|---|---|
| 5 | Tech-forward provider AND engaged office manager both identified |
| 4 | Strong office manager champion with provider support |
| 3 | Office manager willing to champion, provider neutral |
| 2 | Office manager willing but stretched, no provider engagement |
| 1 | No clear champion, leadership gaps at location |
Composite Score Calculation
Formula: (Factor 1 × 1.2) + (Factor 2 × 1.0) + (Factor 3 × 0.8) + (Factor 4 × 1.1) + (Factor 5 × 1.0) = Weighted Score
Max Possible: 25.5 points
Readiness Tiers
| Tier | Score Range | Rollout Recommendation |
|---|---|---|
| A (High Readiness) | 21.0 - 25.5 | Wave 1 candidate |
| B (Good Readiness) | 16.0 - 20.9 | Wave 2 candidate |
| C (Moderate Readiness) | 11.0 - 15.9 | Wave 3 (with remediation) |
| D (Low Readiness) | 5.0 - 10.9 | Defer until remediation complete |
Sample Location Scoring Matrix
| Location | IT (×1.2) | Staff (×1.0) | Volume (×0.8) | Tech Stack (×1.1) | Champion (×1.0) | Raw Total | Weighted Score | Tier |
|---|---|---|---|---|---|---|---|---|
| Springfield | 4 (4.8) | 4 (4.0) | 5 (4.0) | 4 (4.4) | 5 (5.0) | 22 | 22.2 | A |
| Riverside | 5 (6.0) | 3 (3.0) | 4 (3.2) | 5 (5.5) | 4 (4.0) | 21 | 21.7 | A |
| Oak Park | 3 (3.6) | 4 (4.0) | 3 (2.4) | 4 (4.4) | 4 (4.0) | 18 | 18.4 | B |
| Downtown | 4 (4.8) | 2 (2.0) | 2 (1.6) | 4 (4.4) | 3 (3.0) | 15 | 15.8 | C |
| West End | 2 (2.4) | 2 (2.0) | 3 (2.4) | 2 (2.2) | 2 (2.0) | 11 | 11.0 | D |
Rollout Sequence Recommendations
Wave 1 Selection Criteria (2-3 locations):
- Tier A scores (21.0+)
- Geographic diversity (different regions if possible)
- Different PMS systems represented (to validate all integrations)
- At least one location with a newer acquisition (tests onboarding complexity)
- NOT your highest-revenue location (protect flagship during learning phase)
Wave 2 Selection Criteria (5-8 locations):
- Tier B scores (16.0-20.9) plus remaining Tier A
- Geographic clustering with Wave 1 locations (leverage nearby champions)
- Prioritize locations in same region as Wave 1 success stories
Wave 3 Selection Criteria (remaining locations):
- Tier C locations with completed remediation
- Pair each Tier C with a nearby Wave 1/2 champion for support
- Extend timeline if needed
Defer/Remediate (Tier D locations):
- Create remediation plan addressing lowest-scoring factors
- Re-score after 60 days
- Include in Wave 4 or subsequent wave
4. Rollout Strategy
Wave Structure Overview
| Wave | Locations | Timeline | Primary Goal |
|---|---|---|---|
| Wave 1 (Pilot) | 2-3 | Weeks 3-5 | Validate integration, refine training, establish baselines |
| Wave 2 (Expansion) | 5-8 | Weeks 6-9 | Scale processes, identify regional patterns |
| Wave 3 (Completion) | Remaining | Weeks 10-14 | Full deployment, address outliers |
| Stabilization | All | Weeks 15-18 | Optimization, embed in operations |
Wave 1: Pilot Phase (Weeks 3-5)
Selection Criteria for Wave 1 Pilot Locations
☐ High Readiness Score: Minimum Tier A (21.0+ weighted score)
☐ Manageable Risk Profile:
- Not your highest-revenue location
- Not undergoing other major changes (renovation, provider transition, etc.)
- Stable staffing (no planned departures of key personnel)
☐ Representative of Portfolio:
- Include at least 2 different PMS systems
- Include general dentistry AND at least one specialty (if applicable)
- Mix of geographic regions (tests remote support model)
☐ Champion Quality:
- Identified office manager willing to provide detailed feedback
- At least one provider actively interested in data/analytics
☐ Learning Potential:
- Location leadership willing to participate in weekly debrief calls
- Staff comfortable with being "guinea pigs"
Wave 1 Timeline
| Week | Activities |
|---|---|
| Week 3, Day 1-2 | 🔵 Complete integrations, run test data pulls |
| Week 3, Day 3-4 | Validate data accuracy against PMS source |
| Week 3, Day 5 | Champion training (office managers) |
| Week 4, Day 1-2 | Staff training (all roles) |
| Week 4, Day 3 | Go-live Day 1 |
| Week 4, Day 4-5 | Daily check-ins, rapid issue resolution |
| Week 5 | Stabilization, gather feedback, document learnings |
Wave 1 Go/No-Go Criteria
To proceed to Wave 2, ALL of the following must be true:
☐ Data integration validated: PBN data matches PMS data within 1% variance
☐ Critical dashboards functional: All core reports generating correctly
☐ Zero unresolved critical issues: No blocking bugs, security concerns, or data integrity problems
☐ Staff adoption threshold met: >80% of users logged in and completed basic tasks
☐ Champion confidence: Office manager rates readiness to recommend 7/10 or higher
☐ Documented learnings: Training adjustments, FAQ document, troubleshooting guide updated
⚠️ If any go/no-go criterion is not met:
- Extend Wave 1 by 1 week
- Escalate to VP Operations for remediation plan
- Do not proceed to Wave 2 until resolved
Wave 2: Expansion Phase (Weeks 6-9)
Timeline per Location Cluster
| Week | Cluster A (3-4 locations) | Cluster B (3-4 locations) |
|---|---|---|
| Week 6 | 🔵 Integration setup | — |
| Week 7 | Training + Go-live | 🔵 Integration setup |
| Week 8 | Stabilization | Training + Go-live |
| Week 9 | Buffer/remediation | Stabilization |
Wave 2 Enhancements from Wave 1 Learnings
☐ Updated training materials incorporating Wave 1 feedback ☐ Known issues documented with workarounds ☐ Champions from Wave 1 paired with Wave 2 locations for peer support ☐ Refined go-live checklist based on Wave 1 experience
Wave 2 Go/No-Go Criteria
Same as Wave 1, evaluated across all Wave 2 locations in aggregate:
- Data accuracy validated at each location
80% staff adoption
- No unresolved critical issues
- Regional manager sign-off for their locations
Wave 3: Scale Phase (Weeks 10-14)
Timeline
| Week | Locations | Notes |
|---|---|---|
| Week 10-11 | Group 3A (larger batch) | Deploy 5-8 locations simultaneously |
| Week 12-13 | Group 3B (remaining) | Include Tier C locations with completed remediation |
| Week 14 | Buffer week | Address stragglers, remediation carry-overs |
Wave 3 Efficiencies
- Deploy in larger batches (5-8 simultaneously)
- Leverage regional champions from Waves 1-2 for local support
- Reduce training time (optimized materials, video modules)
- Centralized support model (less on-site presence)
Rollback Plan
⚠️ If a wave fails (defined as: critical data integrity issues, security incidents, or staff rejection >30%):
Immediate Actions (Day of Failure Identification)
☐ VP Operations convenes emergency call with vendor, IT, and regional manager
☐ Determine scope: single location failure vs. systemic issue
☐ 🟣 Executive decision: pause vs. rollback
Rollback Protocol
☐ Disable PBN access at affected location(s)
☐ Verify PMS systems unaffected (PBN is read-only, so minimal risk)
☐ Communicate to staff: "We're pausing to resolve [specific issue]"
☐ Continue unaffected locations (if issue is location-specific)
☐ Conduct root cause analysis within 72 hours
☐ 🔵 Escalate to PBN executive contact if vendor-side issue
☐ Re-attempt rollout only after root cause addressed and verified
Isolation Measures
- Each location's integration is independent—one location's failure does not cascade
- Centralized dashboards can exclude specific locations from aggregate views
- Regional managers continue receiving manual reports during rollback period
5. Configuration & Integration (Weeks 2-3)
Step-by-Step PMS Integration
Dentrix Integration (Version G7.0+)
| Step | Action | Owner | Duration | Notes |
|---|---|---|---|---|
| 1 | 🔵 Request Dentrix API credentials from PBN | IT Lead | 1 day | PBN is a certified Dentrix partner |
| 2 | Verify Dentrix eCentral connectivity at location | Location IT | 2 hours | Required for cloud sync |
| 3 | 🔵 Configure connection in PBN portal | IT Lead + PBN | 2 hours | Per-location setup |
| 4 | Run initial data sync (may take 24-48 hours for historical data) | PBN | 1-2 days | Automatic after configuration |
| 5 | Validate sync: Compare PBN dashboard figures vs. Dentrix reports | Office Manager | 2 hours | Check 3-5 key metrics |
| 6 | ⚠️ Troubleshoot discrepancies before go-live | IT Lead + PBN | Variable | Common: inactive providers, duplicate patients |
Eaglesoft Integration (Version 21.0+)
| Step | Action | Owner | Duration | Notes |
|---|---|---|---|---|
| 1 | 🔵 Obtain Patterson eServices credentials | IT Lead | 1-2 days | May require Patterson support |
| 2 | Configure Eaglesoft cloud services if not enabled | Location IT | Variable | Prerequisite for integration |
| 3 | 🔵 Establish secure connection via PBN portal | IT Lead + PBN | 2-3 hours | SSL required |
| 4 | 🔵 Map Eaglesoft fields to PBN schema | PBN | 4 hours | Customize for your procedure codes |
| 5 | Run initial sync | PBN | 1-2 days | Historical data ingestion |
| 6 | Validate data accuracy | Office Manager + IT | 2 hours | Production, collections, appointments |
Open Dental Integration (Version 21.1+)
| Step | Action | Owner | Duration | Notes |
|---|---|---|---|---|
| 1 | Enable Open Dental API in Program Links | Location IT | 30 minutes | Requires administrator access |
| 2 | Generate API keys | Location IT | 15 minutes | Store securely |
| 3 | 🔵 Input API credentials into PBN portal | IT Lead | 30 minutes | Per-location configuration |
| 4 | 🔵 Run test queries | PBN | 1 hour | Verify connectivity |
| 5 | Execute full historical sync | PBN | 1-2 days | Depending on data volume |
| 6 | Validate against Open Dental reports | Office Manager | 2 hours | Compare production, scheduling |
Imaging System Integration
General Process (Dexis, Patterson Imaging, Romexis, etc.)
| Step | Action | Owner | Duration |
|---|---|---|---|
| 1 | Document imaging system version and export capabilities | IT Lead | 1 hour |
| 2 | 🔵 Confirm integration pathway with PBN (API, file export, direct connection) | IT Lead + PBN | Call: 1 hour |
| 3 | Configure export settings or API connection per PBN specifications | Location IT | 2-4 hours |
| 4 | 🔵 Run test sync | PBN | 2 hours |
| 5 | Validate imaging data appearing correctly in PBN | Office Manager | 1 hour |
⚠️ Note: Imaging integration is optional for PBN core functionality but enhances clinical analytics. Prioritize PMS integration; add imaging in Wave 2+.
Test Environment Setup
Centralized Test Environment (Recommended for DSO)
☐ 🔵 Request PBN sandbox environment with synthetic data
☐ Configure sandbox with:
- Simulated multi-location hierarchy matching your org structure
- Sample data mimicking your PMS mix
- Test user accounts for each role type
☐ Conduct integration testing in sandbox before any production connection
☐ Validate:
- Data flows correctly through hierarchy
- Aggregations calculate properly
- Role-based permissions restrict views appropriately
- SSO authentication works for all user types
☐ ⚠️ Do NOT use production patient data in test environment
Validation Checklist
| Test | Pass Criteria | Owner |
|---|---|---|
| Single-location data pull | Data matches PMS within 1% | IT Lead |
| Multi-location aggregation | Sum of locations = enterprise total | IT Lead |
| Provider-level filtering | Each provider sees only their data | IT Lead |
| Regional rollup | Regional views show correct location subset | Regional Manager |
| Historical data accuracy | Trends match known historical performance | Office Manager |
| Real-time refresh | Data updates within stated latency (typically 24 hours) | IT Lead |
Data Migration / Historical Data Ingestion
| Step | Action | Owner | Duration |
|---|---|---|---|
| 1 | 🟣 Determine historical data scope (recommend: 24+ months) | VP Operations | Decision: 1 hour |
| 2 | 🔵 Confirm ingestion timeline with PBN based on volume | PBN | Call: 30 minutes |
| 3 | Run initial ingestion in off-hours to minimize bandwidth impact | PBN | 1-3 days per location |
| 4 | Validate historical data against archived reports | Office Manager | 2-4 hours |
| 5 | ⚠️ Document any data gaps (missing periods, corrupted data) | IT Lead | Variable |
Security and HIPAA Compliance Verification
Enterprise HIPAA Checklist
☐ Business Associate Agreement (BAA)
- 🔵 Execute BAA with PBN before any data transfer
- Store signed BAA in compliance repository
- Confirm PBN's subprocessor list and their BAAs
☐ Data Governance
- Document what PHI is transmitted to PBN
- Confirm data encryption in transit (TLS 1.2+) and at rest (AES-256)
- 🔵 Review PBN's SOC 2 Type II report
- Confirm data retention and deletion policies
☐ Access Controls
- Role-based access control (RBAC) configured and tested
- SSO enforced for all users (no local PBN passwords)
- Access logging enabled
- Quarterly access review process defined
☐ Audit Capabilities
- Confirm PBN provides access logs
- Define audit review frequency (recommend: quarterly)
- Establish breach notification protocol
☐ Location-Specific Considerations
- Verify each location's firewall rules allow only necessary traffic
- Confirm no PHI is stored on local workstations (browser-only access)
- Train staff on security protocols
Standardized vs. Location-Specific Configuration
Standardize Centrally (Apply Identically to All Locations)
| Configuration Item | Rationale |
|---|---|
| User role definitions (Executive, Regional, Location, Provider) | Consistent access control |
| KPI definitions and formulas | Cross-location comparability |
| Dashboard layouts for each role | Reduces training complexity |
| Report scheduling (when reports generate/email) | Operational consistency |
| Alert thresholds (e.g., A/R aging triggers) | Standardized intervention points |
| Data refresh frequency | Predictable data availability |
Allow Location-Specific Configuration
| Configuration Item | Rationale |
|---|---|
| Provider names and credentials | Location-specific roster |
| Fee schedules | May vary by market |
| Operatory names/numbers | Location-specific physical layout |
| Local benchmark targets (after initial standardization period) | May adjust for market conditions |
| Individual provider dashboard preferences | Provider autonomy within guardrails |
| Specialty-specific metrics (ortho, perio, oral surgery) | Only applicable to specialty locations |
6. Team Training Plan
Train-the-Trainer Model
For a 15-50 location DSO, direct training from central team or vendor for every staff member is impractical. Instead:
Champion Selection Criteria
Each location must identify one primary champion (ideally office manager) and **one
AI-generated implementation guide based on public vendor information. Verify specifics directly with Practice by Numbers.