By Michael Woo-Ming, MD, MPH
Quick question, and answer it honestly.
If your web person disappeared tomorrow — moved, changed careers, stopped returning email — could you log in to your own website? Could you renew your own domain name? Do you know which email address the renewal notice goes to?
For a lot of practices the honest answer is no, and the reason is completely understandable. Somebody helpful set all of it up years ago, it worked, and there was never a reason to go looking. That's how it goes in most practices I've seen.
The problem is that these accounts are the practice. Your name in search results, your phone number, your patient communications, the way a new patient finds you at all — every bit of it runs through a handful of logins that somebody controls. If that somebody isn't you, you have a dependency you didn't choose.
The accounts that actually matter
Not everything needs your name on it. This short list does.
Your domain name. The single most important one, and the one most often registered under someone else's account "for convenience." Whoever holds the registrar login can move your site, redirect your traffic, or simply let the registration lapse. It should be registered to the practice, with billing on a card the practice controls and renewal notices going to an address someone reads.
Your website and hosting. Separate from the domain, and frequently held by a different person than you'd guess. You want administrator access, not a contributor login someone can revoke.
Your Google Business Profile and the major directory listings. These decide what a patient sees before they ever reach your site — hours, address, phone, photos, reviews. If a former vendor still holds the verified profile, you're either asking permission to correct your own information or filing a request with Google to get it back. Both are slower than simply holding it yourself.
Your practice phone number. Know who the carrier account belongs to and who could authorize a port. A number patients have had for fifteen years is not a small asset.
Your email and any patient-communication platform. Whoever holds the admin seat can read, forward, or lock out. That should be a very short list of people.
Your EHR and billing platform administrator rights. Not day-to-day user access — the administrator role that creates and removes users. This is the one people forget until they need it urgently.
Your social handles, listing claims, and review-site logins. Same principle — anything with your name on it in public should have you behind it.
The part everybody skips: offboarding
Most practices have at least one active login belonging to somebody who left.
Here's the mechanism. Someone leaves on good terms. The accounts they touched are scattered across a dozen systems, there's no list, so nothing gets shut off. Two years on they still have access to the scheduling system, plus a shared password nobody has changed in years that also happens to open three other things.
This is the fix, and it takes about an afternoon.
Build the list. One document with every system the practice uses, who the account holder is, what email address controls it, and who has admin. Yes, all of it. The tedium is the whole point — the list is the deliverable.
Put the recovery email on something institutional. Not your personal Gmail, and definitely not a staff member's. An address the practice owns and someone monitors.
Turn on multi-factor authentication everywhere it's offered, with the recovery method tied to a phone or an app the practice controls. If the second factor goes to a phone number that walked out the door, you haven't secured anything.
Use a password manager with a shared vault, so access is granted and revoked by role rather than by texting a password around.
Then write an offboarding checklist and use it every single time, including for the people you love and trust and expect to hear from at Christmas. If it only comes out sometimes, it stops being routine, and people notice when it appears. Boring and automatic is the whole idea.
Vendors, agencies, and the "we'll handle it" trap
When you hire a marketing agency, a web designer, or a listing-management service, the fastest path for them is to build everything inside their own accounts. It's genuinely easier for them, and most of them aren't thinking about your exit at all.
But it means that when the relationship ends — and most of them end — you may not be able to take your own assets with you. I've watched practices rebuild a website from scratch because nobody wanted to have an awkward conversation about who had the login.
So say it up front, before signing: the practice owns the domain, the hosting, the listings, and the analytics; you get administrator access as our vendor, not ownership. Put it in the agreement. A good vendor won't blink at this. And if one won't agree to it, that's worth knowing before you sign rather than after.
If you're already mid-relationship, you don't need a confrontation. Ask for a written inventory of every account they hold on your behalf, then transfer them one at a time. Most of the time it's an afternoon of email and a couple of verification codes.
Do it before you need it
I've had this conversation with a lot of practice owners, and it goes the same way every time. Everybody agrees it matters. Nobody has a week for it. There's never a good week for it — this loses to patients, to payroll, to the roof leaking, right up until the morning it's the only thing anyone is talking about, and by then it's a departure or a lockout and the phone is ringing.
So don't schedule it. Do one piece of it today, in the next ten minutes: find out who your domain is registered to. Just that. Whatever you learn will tell you how much of the rest of this applies to you, and it's the account that matters most anyway.
The full list can happen this month. The domain can happen before lunch.
You are running a business whether or not that's how you describe yourself — the CEO of You, Incorporated. The CEO holds the keys.
Dr. Michael Woo-Ming is a Mayo Clinic-trained physician, practice owner, and founder of BootstrapMD. He's the author of The Positioned Physician: Earn More, Work Smart, Love Medicine Again. Learn more at michaelwooming.com.
This is general educational information, not legal, medical, or compliance advice.
