Kandji or Rippling IT for a Multi-Site Dental Group

Patient records and imaging accessed from an exam-room iPad or front-desk workstation fall under HIPAA's security rule, which requires reasonable safeguards like encryption and access control on devices that touch protected health information, though the specifics of what counts as reasonable depend on your risk assessment and should be confirmed with your compliance advisor or attorney rather than assumed from a blog post. Whatever platform you pick needs to enforce encryption and passcode requirements on every device that can reach patient data, full stop, before anything else on this checklist matters.

Don't assume the practice you bought eighteen months ago and the one you bought last quarter have anything in common device-wise. Pull an actual list from each location: exam-room iPads, front-desk PCs, and any shared workstation in a back office, and note the operating system for each. A DSO that skips this step and jumps straight to a platform often discovers mid-rollout that half the acquired practices are running hardware nobody documented.

If exam-room devices across your practices are mostly iPads, which is common since they're simple for hygienists and assistants to use chairside, Kandji's native controls, enforced encryption, remote wipe, app restrictions limiting a chairside iPad to patient education and imaging apps, fit that part of the fleet well. Front-desk PCs running practice management software are frequently Windows, though, which Kandji won't reach, so confirm you're not assuming Apple-only coverage solves the whole practice.

A multi-site DSO hires and loses front-desk and clinical support staff at a higher rate than a single practice does, simply because there are more locations generating turnover. Rippling IT's tie between HR records and device provisioning means a new hire at any location gets a configured device the day they start, and a termination cuts off access automatically, which matters more at scale than it does for a single-location practice managing two or three hires a year.

Trying to standardize every acquired practice's devices in one push usually fails, because it disrupts patient scheduling at every location simultaneously. Instead, set a rolling schedule: bring one newly acquired practice onto your chosen platform as part of its integration process, rather than retrofitting all existing practices at once, and use that as your template for the next acquisition. This turns device standardization into a repeatable part of onboarding a new practice instead of a one-time emergency project.

The most common mistake is picking a platform based on whichever acquired practice's IT setup was cleanest, rather than the group's actual mix across all locations. The second is assuming a front-desk PC and an exam-room iPad need the same policy, when the PC holds more sensitive billing and scheduling data day to day while the iPad is more exposed physically in a patient-facing room. Treat them as related but separate problems rather than one blanket configuration.

Avoid these common mistakes when choosing a platform:

• Picking a platform based on whichever acquired practice's IT setup was cleanest, instead of the group's actual mix across all locations.
• Assuming a front-desk PC and an exam-room iPad need the same policy, when they hold different data and face different physical exposure.
• Standardizing every acquired practice in one push, which disrupts patient scheduling at every location at the same time.
• Assuming practices bought at different times share anything device-wise, instead of pulling an actual list from each location.
• Leaving a newly acquired practice's devices unmanaged until a future cleanup project that may never happen.

A group weighing a central IT hire against a platform subscription should price the hire honestly first. National wage data puts the median salary for a general operations manager at $105,770 a year¹, a role often stretched to cover practice-level IT coordination at a growing DSO, and filling that kind of position takes real time too, with SHRM's 2025 benchmarking putting the median time-to-fill for a nonexecutive role at 44 days². For a group under a handful of locations, a platform that automates encryption enforcement and offboarding across every practice usually closes the gap faster and for less than a new hire would, though a larger group may eventually need both.

Revisit that math after every few acquisitions rather than deciding it once. A DSO growing from four practices to ten changes the calculation meaningfully, since the platform's per-device cost stays roughly linear while the coordination burden on a single stretched ops person tends to grow faster than the location count does.