A marketing vendor handover is complete when the practice can operate the required workflows, not when someone sends a folder of passwords. Verify access, rights, working routes and responsibilities before removing the outgoing vendor. Keep a documented fallback so an unresolved transfer does not interrupt inquiries, email or the website.
Use the acceptance checklist below for a planned agency transition. An active security incident may require a different response led by the practice's security advisers. This is an operational handover framework, not a determination of contractual ownership or permission to export sensitive information.
Agree the scope before touching accounts
List the services the outgoing vendor actually controls: domain administration, DNS, hosting, website deployments, profiles, advertising, reporting or inquiry integrations. Assign a practice owner and receiving role for each.
Review the agreement for transferable assets, licensed components, export rights, termination terms and continuing dependencies. A font licence, proprietary platform and original design file may have different arrangements. Have qualified advice resolve disputed rights rather than treating a password request as a legal solution.
Separate three outcomes: access transferred, assets received and workflow verified. Each needs its own evidence. A cloud folder can contain all the expected files while a website form still sends to the outgoing agency's inbox.
Verify the receiving team can access the right accounts
Use provider-supported role changes and invitations where available. Google explains its Business Profile owner and manager roles and Google Ads account access levels. Confirm the actual account identities before accepting invitations.
Keep credentials, authentication codes and recovery material out of the handover checklist itself. Use the practice's approved secure process. CISA recommends multifactor authentication for business accounts; coordinate the receiving configuration with the authorised administrator.
Do not remove the existing recovery route until the replacement is verified. Record any provider waiting period or dependency from current documentation instead of assuming every transfer takes effect immediately.
Collect usable assets, not unexplained exports
Request a manifest describing each asset, version, permitted use and dependency. For the website, identify source or supported export, content, media, configuration and the documented restoration route. For campaigns, identify the account history, current settings, approved creative and unresolved policy issues.
Ask the receiving team to open the delivered files and confirm they can use them in the agreed environment. A backup that nobody can restore is not adequate evidence of continuity. A screenshot of a campaign is not equivalent to working account access.
Use the digital account ownership register to distinguish practice-owned assets from vendor-managed or licensed services. The handover should preserve those distinctions, not silently change them.
Keep sensitive records outside a generic marketing transfer
Do not export the entire CRM or reception inbox simply because the new agency asks for complete context. The practice's qualified privacy and security reviewers should define what can be transferred, to whom, for which purpose and through which route.
Where HIPAA applies, HHS's business associate guidance is relevant to the relationships involved. Retention, return and disposal questions need review of the actual contracts and applicable obligations, not a universal delete everything instruction.
Record whether opt-outs, contact preferences and open administrative tasks need continuity in an approved receiving system. Confirm they survive any authorised migration rather than assuming a contact-file export includes them.
Copy this vendor handover acceptance checklist
For every item, record received, verified or unresolved, an evidence link and an accountable owner.
- Domain and DNS: correct account, renewal responsibility, recovery route and existing email dependencies identified.
- Hosting and website: access, deployment owner, usable export or source rights, configuration and restoration evidence.
- Forms and phones: current destinations, assigned responders, integrations and fallback routes documented.
- Business profiles: correct profile identity and practice control verified without creating duplicates.
- Advertising: account identity, access, billing, current campaigns and pending policy issues understood.
- Reporting: correct properties, definitions, authorised access and historical continuity reviewed.
- Creative and content: files, permitted usage, licences and version context received.
- Integrations: service accounts, scheduled jobs, notifications and vendor-specific dependencies inventoried.
- Approved data transfers: scope, receiving system, access and responsible privacy reviewer recorded.
- Open work: pending changes, live experiments, unanswered inquiries and required approvals assigned.
- Acceptance tests: website, inquiry delivery and essential reporting paths verified with synthetic material.
- Vendor removal: scoped access and integrations removed only under an agreed, verified sequence.
- Fallback: accountable role and recovery plan for a failed transition step.
Keep unresolved items visible. The receiving team should not sign off merely because all files arrived if a critical workflow still depends on the vendor leaving.
Rehearse the customer-facing routes
Open important pages on mobile and desktop. Check redirects, consultation links and location information. Submit labelled synthetic form requests and follow them into the approved receiving system. Confirm the responsible person and the fallback when delivery fails.
Check phone routes during the stated service hours. Inspect confirmations and administrative notifications for old addresses or promises the new team cannot support. Do not use real patient information to prove a marketing handover works.
If a new website is involved, treat it as a migration with additional checks. Use the clinic website migration checklist for URLs, redirects and search continuity. Changing agencies does not itself require replacing the site.
Revoke access in a controlled sequence
After the replacement access and workflows are verified, have the authorised administrator remove only the outgoing permissions and dependencies that should end. Inspect user roles, manager links, service accounts and integrations rather than assuming one account removal covers everything.
Do not delete active accounts, histories or assets as a shortcut. Rotate secrets through the approved process where appropriate, and verify any systems that depend on them. Keep the change record and recheck the important routes afterwards.
Fyntrix's inquiry and follow-up work can help map responsibility, but the checklist is usable with any receiving team. Accept the working handoff, not merely the delivery of files.