TechCentral / Henry Schein — Implementation Playbook (DSO)

TechCentral / Henry Schein Dental IT & Cybersecurity Implementation Playbook

For Dental Service Organizations (15–50 Locations)

---

1. Executive Summary

What This Tool Does

TechCentral by Henry Schein delivers enterprise-grade IT infrastructure management and cybersecurity protection purpose-built for dental environments. The platform provides centralized monitoring of network health, endpoint security, automated threat detection, data backup and disaster recovery, and HIPAA-compliant security protocols across distributed dental locations—all managed through a unified dashboard with 24/7 support.

Why DSOs Specifically Benefit from Dental IT & Cybersecurity AI

At scale, DSOs face exponentially greater cybersecurity risk than single practices. A breach at one location can cascade across your network, compromise patient data enterprise-wide, and trigger regulatory penalties multiplied across affected locations. TechCentral's centralized approach transforms IT from a fragmented, location-by-location cost center into a strategic asset:

• Scale Advantage: Unified security policies deployed once, enforced everywhere—eliminating the inconsistency of 15–50 different IT setups
• Standardization: Consistent hardware lifecycle management, patch deployment, and compliance protocols reduce audit complexity and liability
• Data Aggregation: Real-time visibility into network health, threat vectors, and incident response across all locations from a single pane of glass
• Economies of Scale: Enterprise licensing, centralized support, and standardized configurations reduce per-location IT costs by 20–35%

Expected Timeline: Decision to Full Deployment

Portfolio Size	Pilot Phase	Wave Deployment	Full Deployment
15–25 locations	3–4 weeks	6–8 weeks	12–14 weeks total
26–40 locations	3–4 weeks	10–12 weeks	16–18 weeks total
41–50 locations	4–5 weeks	12–14 weeks	20–22 weeks total

---

2. Pre-Implementation Checklist (Weeks 1–2)

Technical Requirements

Hardware Requirements

☐ Audit current workstation inventory across all locations (age, specs, OS version) ☐ Identify workstations requiring replacement (>5 years old or Windows 10 pre-21H2) ☐ Verify minimum 8GB RAM per clinical workstation, 16GB for server/imaging workstations ☐ Confirm UPS (battery backup) presence at each location for critical systems ☐ Document existing firewall hardware make/model/firmware version at each site

Network Requirements

☐ Minimum 100 Mbps symmetric internet at each location (500 Mbps recommended for imaging-heavy practices) ☐ Business-class internet with static IP or DHCP reservation capability ☐ Network diagram for each location documenting all connected devices ☐ Current WiFi infrastructure assessment (separate guest vs. practice networks required) ☐ ⚠️ VPN or SD-WAN infrastructure audit—critical for centralized management

Software Requirements

☐ Complete software inventory per location (PMS, imaging, specialty applications) ☐ Current antivirus/endpoint protection documentation (for removal/migration planning) ☐ Windows Server versions and patch levels for on-premise servers ☐ Active Directory or local account structure documentation ☐ Current backup solution inventory

Integration Requirements

☐ PMS system identification per location (Dentrix, Eaglesoft, Open Dental, other) ☐ PMS version numbers and recent update history ☐ Imaging system identification (Dexis, Schick, Carestream, etc.) ☐ HL7/API capabilities of current systems ☐ Current clearinghouse and e-prescribing integrations

Vendor Onboarding Steps

Key Contacts to Establish

☐ 🔵 Henry Schein TechCentral Account Executive (primary relationship) ☐ 🔵 Technical Implementation Lead (assigned post-contract) ☐ 🔵 24/7 Support escalation contacts and SLA documentation ☐ 🔵 HIPAA/Compliance specialist for BAA and audit support ☐ 🔵 Enterprise Account Manager for ongoing strategic reviews

Onboarding Actions

☐ 🔵 Schedule enterprise kick-off call (90 minutes minimum) — Time estimate: Week 1, Day 1–2 ☐ 🔵 Request and review enterprise implementation timeline from vendor — Time estimate: 2 hours ☐ 🔵 Obtain complete technical documentation and system requirements — Time estimate: Vendor delivers within 48 hours ☐ 🔵 Review and execute Business Associate Agreement (BAA) — Time estimate: Legal review 3–5 days ☐ 🔵 Confirm licensing model (per-user, per-device, per-location, or hybrid) — Time estimate: 1 hour ☐ Request case studies from similar-sized DSO deployments — Time estimate: Vendor delivers within 1 week

Data/Access Prerequisites

Credentials and Access

☐ Domain admin credentials or equivalent for all locations ☐ PMS administrator access across all instances ☐ Current hosting provider credentials (if cloud/hybrid infrastructure) ☐ Email/Microsoft 365 or Google Workspace admin access ☐ Existing VPN credentials and configuration files ☐ ⚠️ Document all third-party IT vendor relationships requiring coordination or termination

Data Preparation

☐ Export current network topology documentation ☐ Compile existing security audit reports (if any) ☐ Document HIPAA Risk Assessment history and findings ☐ Identify any past security incidents requiring disclosure ☐ Catalog all business-critical data locations and backup schedules

Enterprise-Level Requirements

Network Standards Across Locations

☐ 🟣 Define enterprise network architecture standard (hub-and-spoke, mesh, hybrid) ☐ 🟣 Establish minimum bandwidth requirements as policy ☐ Document preferred ISP contracts and standardization opportunities ☐ Define standardized VLAN structure (clinical, guest, IoT, administrative) ☐ Establish DNS and DHCP standards

Hosting Architecture Decision

☐ 🟣 Determine centralized vs. location-level hosting model:

• Centralized: Single data center or cloud tenant, all locations connect remotely
• Hybrid: Central management with local caching/redundancy
• Distributed: Location-level servers with centralized monitoring ☐ Document latency requirements based on clinical workflow needs ☐ Define data residency and sovereignty requirements if multi-state

Identity and Access Management

☐ 🟣 Single Sign-On (SSO) requirements and existing identity provider (Azure AD, Okta, etc.) ☐ Define role-based access control (RBAC) structure ☐ Multi-factor authentication (MFA) policy and rollout plan ☐ Privileged access management requirements ☐ Credential rotation and password policy standards

Centralized Credentialing

☐ Unified device naming convention (e.g., [LocationCode]-[DeviceType]-[Number]) ☐ Standardized local admin account structure ☐ Service account inventory and management plan ☐ Certificate management strategy

Stakeholder Alignment Map

Board/Investors (Inform + Approve Budget)

Stakeholder	Communication Need	Approval Required	Timeline
Board of Directors	Strategic rationale, ROI projection, risk mitigation value	☐ Budget approval	Pre-contract
Private Equity Sponsor	Alignment with portfolio value creation thesis	☐ Capital expenditure sign-off (if above threshold)	Pre-contract

C-Suite (Decision + Sponsorship)

Stakeholder	Role in Implementation	Approval Required	Timeline
CEO	Executive sponsor, escalation point	☐ Final go-decision	Week 1
COO/VP Operations	Operational owner, rollout oversight	☐ Timeline and resource allocation	Week 1
CFO	Budget holder, ROI tracking owner	☐ Contract and payment terms	Week 1
Chief Dental Officer	Clinical workflow impact assessment	☐ Clinical disruption sign-off	Week 1
CIO/IT Director	Technical lead, vendor liaison	☐ Technical architecture	Week 1

Regional Managers (Execute + Cascade)

Stakeholder	Role in Implementation	Communication Need	Timeline
Regional Directors	Wave coordination, local escalation	Detailed rollout calendar	Week 2
Area Managers	Champion identification, readiness validation	Location-specific timelines	Week 2

Location-Level (Participate + Adopt)

Stakeholder	Role in Implementation	Communication Need	Timeline
Office Managers	Local coordination, staff communication	Go-live checklist, training schedule	Week 2–3
Providers (Dentists, Specialists)	End user adoption	Impact summary, workflow changes	Week 3
Clinical Staff	End user adoption	Training schedule, what changes	Week 3
Front Desk/Admin	End user adoption	System access, troubleshooting basics	Week 3

⚠️ Common Failure Point: Insufficient regional manager buy-in creates rollout delays. Schedule dedicated briefings before any location communication.

Baseline Metrics to Capture

⚠️ Standardize Measurement Methodology Before Data Collection

Metric Category	Specific Metric	Measurement Method	Target Source
Security Posture	Number of security incidents (past 12 months)	Incident log review + staff interviews	IT records/vendor reports
Security Posture	Time to detect security incidents	Incident timestamp analysis	IT ticketing system
Security Posture	Time to resolve security incidents	Incident closure analysis	IT ticketing system
Security Posture	Patch compliance rate (% systems current)	Automated scan or manual audit	Endpoint management tool
Operational Impact	IT-related downtime hours per location per month	Downtime log or staff survey	Office manager records
Operational Impact	Number of IT support tickets per location per month	Help desk data	Ticketing system
Operational Impact	Mean time to resolution for IT tickets	Help desk data	Ticketing system
Operational Impact	Staff hours spent on IT troubleshooting	Time tracking or estimate	Manager interviews
Financial	Current IT spend per location (managed services, break-fix, hardware)	AP analysis	Finance
Financial	Estimated cost of downtime per hour	Production report analysis	PMS + finance
Compliance	Last HIPAA Risk Assessment date	Compliance records	Compliance officer
Compliance	Outstanding HIPAA remediation items	Risk assessment review	Compliance officer
Backup/Recovery	Backup success rate (% successful backups)	Backup logs	IT records
Backup/Recovery	Recovery time objective (RTO) – actual vs. required	DR test results	IT documentation
User Experience	Staff satisfaction with IT (1–10 scale)	Standardized survey	Direct survey

☐ Create standardized data collection template distributed to all office managers — Time estimate: 4 hours to create, 1 week for collection

☐ 🟣 Baseline data review and sign-off by C-suite before proceeding — Time estimate: 2-hour review meeting

---

3. Location Readiness Assessment

Scoring Framework

Score each factor 1–5 using the criteria below. Total composite score ranges from 5 (not ready) to 25 (highly ready).

Factor 1: IT Infrastructure Maturity (Weight: High)

Score	Criteria
5	<3 year old hardware, current OS/PMS versions, fiber internet >250 Mbps, enterprise firewall, documented network
4	3–4 year hardware, OS/PMS within 1 version of current, 100+ Mbps internet, business firewall
3	4–5 year hardware, OS/PMS 2 versions behind, 50–100 Mbps internet, consumer-grade firewall
2	5–6 year hardware, outdated OS requiring upgrades, <50 Mbps internet, basic router security
1	>6 year hardware, unsupported OS, unreliable internet, no firewall, undocumented network

Factor 2: Staff Tenure and Adaptability (Weight: Medium-High)

Score	Criteria
5	<15% annual turnover, documented tech training program, history of successful tech adoption, avg tenure >3 years
4	15–25% turnover, some tech training, 1–2 successful tech rollouts, avg tenure 2–3 years
3	25–35% turnover, informal training, mixed tech adoption history, avg tenure 1–2 years
2	35–50% turnover, minimal training, tech adoption challenges, avg tenure <1 year
1	>50% turnover, no training program, failed tech rollouts, constant staffing changes

Factor 3: Patient Volume (Weight: Medium)

Score	Interpretation	Risk/Reward
5	Top 20% volume location	Highest impact, highest stakes—ideal for Wave 2 once proven
4	60–80th percentile volume	Strong impact, manageable risk—good Wave 1 candidate
3	40–60th percentile volume	Moderate impact and risk—flexible wave placement
2	20–40th percentile volume	Lower impact, good for learning—Wave 1 pilot candidate
1	Bottom 20% volume location	Limited impact—appropriate for final waves or specialized attention

Note: For pilot selection, mid-volume locations (scores 2–4) are preferable—enough activity to validate but lower blast radius if issues arise.

Factor 4: Tech Stack Compatibility (Weight: High)

Score	Criteria
5	PMS and imaging fully compatible, existing TechCentral/Henry Schein relationship, standardized stack
4	PMS on supported list, imaging compatible, straightforward integration path
3	PMS supported with some customization needed, imaging may require updates
2	PMS supported but outdated version requiring upgrade, imaging compatibility unknown
1	PMS not on supported list, significant integration work required, legacy systems

Factor 5: Local Champion Availability (Weight: Medium-High)

Score	Criteria
5	Tech-forward provider AND office manager, both willing to champion, prior implementation experience
4	Willing office manager champion with tech comfort, provider supportive
3	Identified champion candidate, moderate tech comfort, requires development
2	No obvious champion, will need to identify or develop during rollout
1	Staff resistant to change, no champion candidates, low engagement

Composite Score Calculation

Factor	Location A	Location B	Location C	...
IT Infrastructure (×1.2)	___ × 1.2 =	___ × 1.2 =	___ × 1.2 =
Staff Adaptability (×1.1)	___ × 1.1 =	___ × 1.1 =	___ × 1.1 =
Patient Volume (×1.0)	___ × 1.0 =	___ × 1.0 =	___ × 1.0 =
Tech Stack (×1.2)	___ × 1.2 =	___ × 1.2 =	___ × 1.2 =
Local Champion (×1.1)	___ × 1.1 =	___ × 1.1 =	___ × 1.1 =
Weighted Total	___/28	___/28	___/28

Rollout Sequence Recommendation

Composite Score	Recommended Wave	Rationale
23–28	Wave 1 (Pilot)	High readiness, ideal proving ground
18–22	Wave 2	Strong foundation, benefit from pilot learnings
13–17	Wave 3	May need pre-work, benefit from refined playbook
8–12	Wave 4 (or remediation)	Significant prep required, consider infrastructure upgrades first
5–7	Defer/Remediate	Not ready—create remediation plan before inclusion

☐ Complete readiness assessment for all locations — Time estimate: 30–45 minutes per location, 2–3 days total for 25 locations

☐ 🟣 Present readiness scores and recommended wave structure to C-suite for approval — Time estimate: 1-hour presentation + discussion

---

4. Rollout Strategy

Wave Structure Recommendation

Wave Architecture Overview

┌─────────────────────────────────────────────────────────────────┐
│  WAVE 0: Infrastructure Prep (Weeks 1–3)                        │
│  All locations: Baseline, assessments, pre-requisite remediation│
└─────────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────────┐
│  WAVE 1: Pilot (Weeks 4–6)                                      │
│  2–3 locations: Full deployment, intensive support, learning    │
└─────────────────────────────────────────────────────────────────┘
                              ↓ Go/No-Go Gate
┌─────────────────────────────────────────────────────────────────┐
│  WAVE 2: Expansion (Weeks 7–10)                                 │
│  5–8 locations: Refined playbook, train-the-trainer activated   │
└─────────────────────────────────────────────────────────────────┘
                              ↓ Go/No-Go Gate
┌─────────────────────────────────────────────────────────────────┐
│  WAVE 3: Scale (Weeks 11–16)                                    │
│  10–15 locations: Parallel deployments, distributed support     │
└─────────────────────────────────────────────────────────────────┘
                              ↓ Go/No-Go Gate
┌─────────────────────────────────────────────────────────────────┐
│  WAVE 4: Completion (Weeks 17–22)                               │
│  Remaining locations: Final deployments, edge cases             │
└─────────────────────────────────────────────────────────────────┘

Wave 1 Pilot Selection Criteria

Select 2–3 locations meeting ALL of the following:

Must-Have Criteria

☐ Composite readiness score ≥20 ☐ Office manager willing to serve as active champion ☐ Lead provider supportive of initiative ☐ IT infrastructure requires no major pre-work (score ≥4) ☐ ⚠️ NOT your highest-volume flagship location (manageable risk) ☐ NOT your lowest-performing location (needs to represent "normal")

Preferred Criteria (2+ recommended)

☐ Geographic proximity to each other (enables single-trip support visits) ☐ Different PMS systems represented (tests integration breadth) ☐ Mix of general and specialty providers (tests workflow variations) ☐ Strong regional manager overseeing these locations ☐ Recent positive experience with change/new technology

Diversity Requirement

☐ At least one urban and one suburban location (if applicable) ☐ At least one single-provider and one multi-provider location

Detailed Wave Timeline

Wave 1: Pilot (3 weeks per location, 2–3 locations concurrent)

Week	Activities	Responsible
Week 4, Days 1–2	🔵 On-site infrastructure assessment and remediation	TechCentral + Local IT
Week 4, Days 3–5	Hardware deployment and network reconfiguration	TechCentral
Week 5, Days 1–2	Software installation and initial configuration	TechCentral
Week 5, Days 3–5	Integration testing (PMS, imaging, backup)	TechCentral + Champions
Week 5–6	Champion training (intensive, on-site)	TechCentral
Week 6	Parallel run with legacy systems	Location team
Week 6, Day 5	Go-live	All
Week 7–9	Intensive monitoring, daily check-ins	Central team

Buffer between Wave 1 and Wave 2: 1 week minimum

• Document all issues encountered and resolutions
• Update configuration templates
• Revise training materials based on feedback
• 🟣 Present Wave 1 learnings to leadership

Wave 2: Expansion (2 weeks per location, 5–8 locations concurrent)

Week	Activities	Responsible
Week 10, Days 1–3	Remote infrastructure prep and hardware staging	Central IT + Regional
Week 10, Days 4–5	Remote software deployment (leveraging standardized config)	Central IT
Week 11, Days 1–2	🔵 Remote integration validation	TechCentral + Champions
Week 11, Day 3	Champion training (remote, using certified Wave 1 champions)	Central team + Wave 1 Champions
Week 11, Day 4	Parallel run (abbreviated—lessons learned applied)	Location team
Week 11, Day 5	Go-live	All
Week 12–13	Monitoring with decreasing intensity	Central team

Buffer between Wave 2 and Wave 3: 1 week minimum

Wave 3: Scale (2 weeks per location, 10–15 locations in parallel sub-waves)

Week	Activities	Responsible
Week 14–15	Sub-wave 3A: 5–7 locations	Regional team lead
Week 16–17	Sub-wave 3B: 5–8 locations	Regional team lead

Wave 4: Completion (Variable timeline based on remediation needs)

Week	Activities	Responsible
Week 18+	Remaining locations, including any requiring pre-work	Central + Regional
Ongoing	Edge case resolution, low-readiness location support	All

Go/No-Go Criteria

Criteria to Advance to Next Wave

Category	Green (Go)	Yellow (Conditional Go)	Red (No-Go)
Technical Stability	<2 critical issues, all resolved within 24 hours	2–4 critical issues, all resolved within 72 hours	>4 critical issues OR any unresolved >72 hours
Integration Success	All integrations functional, <5% transaction errors	Minor integration gaps, workarounds documented	Major integration failure affecting operations
User Adoption	>80% staff trained, >70% reporting comfort	60–80% trained, 50–70% comfort	<60% trained OR <50% comfort
Champion Effectiveness	Champions resolving 70%+ of Tier 1 issues	Champions resolving 50–70% of Tier 1 issues	Champions overwhelmed, escalating majority
Operational Impact	No increase in IT-related downtime	<2 hours additional downtime during transition	>2 hours downtime OR patient care impact

🟣 Go/No-Go Decision Authority: COO with input from CIO and Regional Manager

⚠️ Rollback Plan

If a wave fails Go/No-Go criteria:

1. Immediate Actions (Day 1)

   • Pause all pending deployments in current and future waves
   • Activate vendor escalation to Implementation Lead and Account Executive
   • Communicate status to all affected location champions and regional managers

2. Diagnostic Phase (Days 2–5)

   • Root cause analysis with vendor
   • Document specific failure points and contributing factors
   • Assess whether issues are location-specific or systemic

3. Remediation Options

   Scenario	Recommended Action
   Location-specific issue	Remediate affected location(s), proceed with wave for unaffected
   Configuration/template issue	Revise templates, re-test in controlled environment, restart wave
   Integration issue	🔵 Vendor engagement required, pause until resolution verified
   Training/adoption issue	Extend parallel run, intensify training, re-assess champions
   Systemic issue	🟣 Full stop, executive review required before proceeding

4. Communication Protocol

   • Daily updates to C-suite during pause
   • Weekly updates to board if pause exceeds 2 weeks
   • Transparent communication to locations: "We're getting this right for you"

---

5. Configuration & Integration (Weeks 2–3)

Practice Management System Integration

Dentrix Integration

☐ Step 1: Version Verification — Time estimate: 15 minutes

• Confirm Dentrix version (G7 or later required for full integration)
• Document current Dentrix server configuration (local vs. hosted)
• Verify Dentrix user accounts with appropriate permissions

☐ Step 2: 🔵 TechCentral Connection Setup — Time estimate: 1–2 hours

• Install TechCentral agent on Dentrix server
• Configure database connection parameters
• Enable API access (Dentrix API subscription required)
• Document connection credentials in secure vault

☐ Step 3: Backup Integration — Time estimate: 30 minutes

• Configure automated backup of Dentrix database
• Set backup retention schedule per enterprise policy
• Test backup restoration in isolated environment

☐ Step 4: Integration Validation — Time estimate: 1 hour

• Verify patient data accessibility (read-only)
• Confirm appointment schedule synchronization
• Test reporting integration
• Document any compatibility limitations

Eaglesoft Integration

☐ Step 1: Version Verification — Time estimate: 15 minutes

• Confirm Eaglesoft version (21 or later required)
• Document database server location and credentials
• Verify network accessibility from TechCentral management server

☐ Step 2: 🔵 Database Connection — Time estimate: 1–2 hours

• Configure SQL connection to Eaglesoft database
• Set appropriate read permissions
• Enable secure connection protocols

☐ Step 3: Backup Configuration — Time estimate: 30 minutes

• Configure database backup schedule
• Enable transaction log backups for point-in-time recovery
• Verify backup file locations and retention

☐ Step 4: Integration Validation — Time estimate: 1 hour

• Test connectivity stability
• Verify data synchronization accuracy
• Document integration points and limitations

Open Dental Integration

☐ Step 1: Version Verification — Time estimate: 15 minutes

• Confirm Open Dental version (current stable release recommended)
• Document MySQL server location and credentials
• Verify eConnector status if using cloud features

☐ Step 2: 🔵 API/Database Setup — Time estimate: 1 hour

• Enable Open Dental API access
• Configure TechCentral database connector
• Set up secure credentials storage

☐ Step 3: Backup Integration — Time estimate: 30 minutes

• Configure MySQL backup strategy
• Set backup schedule aligned with enterprise standards
• Test restoration process

☐ Step 4: Integration Validation — Time estimate: 45 minutes

• Verify API connectivity
• Test data access functions
• Document any customization requirements

Imaging System Integration

General Imaging Integration Steps (Dexis, Schick, Carestream, Apteryx, etc.)

☐ Step 1: System Inventory — Time estimate: 30 minutes per location

• Document imaging software name, version, and licensing
• Identify image storage location (local vs. network)
• Map imaging sensor hardware and workstation assignments

☐ Step 2: Storage and Backup — Time estimate: 1 hour

• Configure imaging archive backup (typically large files—plan accordingly)
• Set appropriate retention policies per regulations
• Enable offsite replication for disaster recovery

☐ Step 3: ⚠️ Network Optimization — Time estimate: 1–2 hours

• Verify network bandwidth supports image transfer requirements
• Configure QoS for imaging traffic if necessary
• Test image capture and retrieval times

☐ Step 4: DICOM Compliance (if applicable) — Time estimate: 30 minutes

• Verify DICOM compatibility for imaging archival
• Configure PACS integration if using centralized imaging

Test Environment Setup

Centralized Test Environment (Recommended for DSO)

☐ Create isolated test environment replicating production — Time estimate: 2–3 days

• Deploy TechCentral management console in test instance
• Connect 1–2 representative test workstations
• Install test PMS instances (use de-identified data only)
• Configure imaging with test sensors

Validation Checklist

Test Category	Specific Test	Pass Criteria	Result
Connectivity	Agent to management console	<5 second heartbeat	☐
Monitoring	Workstation health check	All metrics reporting	☐
Backup	Full backup execution	Completes without error	☐
Backup	Restoration test	Data integrity verified	☐
Security	Endpoint protection active	Threats blocked in test	☐
Security	Patch deployment	Test patch installs correctly	☐
PMS Integration	Database connectivity	Stable over 24 hours	☐
Imaging	Backup of image archive	Files recoverable	☐
Alerting	Test alert generation	Alerts received by NOC and local	☐
Reporting	Dashboard population	Accurate data displayed	☐

Data Migration / Historical Ingestion

☐ ⚠️ Historical Security Log Ingestion — Time estimate: Variable, 1–3 days

• Export security logs from previous antivirus/endpoint solution
• Import relevant historical data into TechCentral (vendor-assisted)
• Verify data integrity post-migration

☐ Configuration Migration — Time estimate: 1–2 days

• Export existing firewall rules
• Document current backup schedules and retention
• Migrate applicable configurations to TechCentral management

Security and HIPAA Compliance Verification

Enterprise-Level HIPAA Checklist

Requirement	Verification Method	Documentation
Business Associate Agreement	☐ 🔵 Executed BAA with Henry Schein TechCentral	File in compliance repository
Data Encryption at Rest	☐ Verify AES-256 encryption for stored data	TechCentral security documentation
Data Encryption in Transit	☐ Verify TLS 1.2+ for all data transmission	Network configuration audit
Access Controls	☐ Role-based access implemented in TechCentral console	RBAC policy document
Audit Logging	☐ All access logged with user ID, timestamp, action	Log retention verification
Automatic Logoff	☐ Session timeout configured per policy (typically 15 min)	System configuration
Unique User IDs	☐ No shared accounts, all users uniquely identified	User account audit
Emergency Access	☐ Break-glass procedure documented and tested	Emergency access policy
**