# Dental Website Ownership: Agency Agreement Checklist | DAS > Clean Markdown version of https://dentalauthoritysites.com/blog/dental-website-ownership-agency-agreement. Generated from the public page on 2026-11-01. Self-published source; archived article facts should be checked against current authoritative guidance where applicable. Blog / Dental Website Ownership: What Should Be in Your Agency Agreement ← All posts Websites Editorial date: 2026-09-24 Updated October 31, 2026 # Dental Website Ownership: What Should Be in Your Agency Agreement ## Key takeaway Before signing a website agreement, document which assets, licenses, administrator accounts, and handoff steps your practice will control—especially registrar access and DNS authority. Treat privacy, security, and vendor-review work as a defined, fact-specific scope, then have qualified advisers review the final terms for your particular engagement. A website relationship can feel simple while work is moving. The hard questions arrive when the practice changes vendors, brings help in-house, or needs an urgent update. Can the practice change the domain’s DNS? Does it have the site files and approved copy? Who can reach hosting, forms, and reporting accounts? Those answers should be recorded before a project begins. When evaluating a [new dental website build](https://dentalauthoritysites.com/services/web-design), treat ownership as a scope-and-asset question, not a slogan in a proposal. This is an operational checklist, not contract-specific legal advice; have a qualified professional review the final agreement for your practice and jurisdiction. ## Map the assets before the build begins “Practice owns the website” is useful intent, but it is not a handoff plan. A site can involve a domain registration, DNS settings, hosting, a content management system, custom code, page designs, approved copy, images, backups, analytics, and third-party subscriptions. Some assets are transferable. Others may be licensed, separately paid for, or supplied through an agency’s reusable tools. Ask the agreement to identify each material asset, the practice contact with control, and the agency access needed to do the work. It should also state what happens at launch, during ongoing care, and when the relationship ends. That avoids a scramble for credentials during a redesign or outage. ## Put domain control in the practice’s name The domain is the address patients, search engines, and referring partners use to find the practice. The agreement should name the registrar, registered name holder, practice-controlled email for notices, renewal responsibility, and who may change DNS settings. Do not tie the only administrator account to an agency employee’s inbox. For generic top-level domains handled by ICANN-accredited registrars, ICANN says a registrant has the right to transfer a registration between registrars. Its [registrant transfer FAQ](https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en) explains that an authorization code is required for an inter-registrar transfer and that some transfers can be temporarily locked. Registrar and domain-extension rules vary, so require a documented access and transfer process instead of assuming a same-day move. ## Define the site assets and rights being delivered Separate custom deliverables from tools and materials that are merely used to create or run the site. Name the expected handoff: production site files or repository, design source files if included, final copy, practice-supplied media, configuration notes, and a current backup or export. Clarify whether the practice receives an assignment, a license, or a limited right to use each item, and whether final payment or third-party terms affect delivery. Written language matters. Under U.S. copyright law, a transfer of copyright ownership generally must be in a writing signed by the rights owner or an authorized agent, as set out in [17 U.S.C. § 204](https://uscode.house.gov/view.xhtml?req=%28title%3A17%20section%3A204%20edition%3Aprelim%29). That does not determine which ownership structure fits a particular engagement. Ask a qualified adviser to assess custom work, pre-existing agency components, open-source items, fonts, plugins, and stock or software licenses that can carry separate terms. ## Treat accounts as named handoff assets A polished site is still difficult to operate if the practice cannot reach its operational accounts. List each service, then record the practice administrator or billing contact, the agency’s authorized role, and the offboarding step. This can include hosting, the CMS, code repository, site email, search and measurement tools, business listings, form services, and approved integrations. The goal is a repeatable handoff: who receives access, what export or backup is provided, how credentials and two-factor authentication are transferred securely, and when agency access is removed. If performance reporting is part of the engagement, connect those decisions to the [reporting scope](https://dentalauthoritysites.com/services/reporting) so the practice can understand continuity as well as the numbers. ## Make privacy review a scope item, not a promise Website ownership does not establish HIPAA compliance or resolve privacy obligations. The right review depends on what the site collects, where information goes, and which vendors are involved. HHS explains that tracking on many general, unauthenticated webpages may not access protected health information. It also explains that an appointment flow or portal page can create a different issue when tracking captures identifiable information related to health care; in applicable circumstances, a tracking vendor handling PHI on behalf of a regulated entity is a business associate and a BAA is required. See HHS’s [online tracking technology guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) for the fact-specific distinction. Put a practical review requirement in the scope: inventory forms, trackers, appointment tools, portal links, and vendors before launch and when new tools are added. Define whether the agency documents data flow, implements approved changes, or flags items for the practice and its privacy or legal advisers. A [privacy architecture review](https://dentalauthoritysites.com/privacy-architecture) can clarify those boundaries, but it does not replace the practice’s own compliance decisions or professional review. Before signing, confirm: - The practice is the registered domain holder and controls the primary registrar email. - The agreement names site files, content, designs, licenses, backups, and account access that will be delivered or retained. - Administrator roles, renewal charges, offboarding timing, and secure credential transfer are documented. - The scope distinguishes general website work from privacy, security, and vendor-review responsibilities. - A qualified professional has reviewed the language for this specific engagement. ## Sources - [ICANN, “FAQs for Registrants: Transferring Your Domain Name”](https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en) - [U.S. House of Representatives, “17 U.S.C. § 204: Execution of transfers of copyright ownership”](https://uscode.house.gov/view.xhtml?req=%28title%3A17%20section%3A204%20edition%3Aprelim%29) - [HHS Office for Civil Rights, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates”](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) ### Is AI recommending your practice? A personalized review of your practice’s AI visibility. Report delivery target: 7 days after we receive the required practice information. Free, no strings.