Before hiring a marketing agency, make sure your practice can access and recover its critical digital accounts without that agency. Start with the domain, website and hosting, business profiles, ad accounts and measurement systems. Then delegate the work through appropriate roles. Management access and ownership are different things.
This does not mean the owner must personally operate every tool or refuse vendor-managed services. It means the contract and configuration should make control, portability and recovery clear. Use the register below to identify what your practice owns, what it licences, what a vendor supplies and what remains unresolved before signing.
Begin with the domain and recovery route
The domain connects more than the public website. Its configuration may affect email, subdomains, booking routes and verification of other services. Identify the registrar, registrant arrangement, renewal payer, DNS service and authorised recovery route.
Do not equate a payment receipt with verified control. Have the responsible administrator demonstrate that the practice can access the appropriate account and understand the renewal status. Keep credentials and recovery materials in the practice's approved secure process, not in an ordinary shared marketing spreadsheet.
Record where website hosting and email hosting differ. A vendor may host the website while another service handles email. A rushed DNS change during an agency transition can affect systems the marketing team did not intend to touch.
Document a backup responsible role. The practice should not depend on a single employee's personal mailbox for recovery after that person leaves.
Separate website control from the files you are entitled to receive
Identify who can administer the site, deploy changes and restore an approved backup. Record where the source, media, content and configuration live. Ask what is included in the agreement and what rights the practice receives at handover.
Some elements may be licensed rather than transferred outright: fonts, stock media, software extensions, proprietary components or a vendor's platform. The useful question is whether the practice can continue using the site under documented terms, not whether every file is automatically owned.
Ask for the export and exit process before the relationship starts. A folder of screenshots is not a usable website export. Equally, a proprietary managed service should not be described as an open-source handover if that is not what the contract provides.
Have qualified advice resolve disputed contractual rights. The ownership register records the arrangement and evidence; it cannot rewrite the agreement.
Retain appropriate business-profile control
The practice needs to know who holds the owner and manager roles for its real business profiles. Google documents those distinctions in Manage your Business Profile owners and managers. Choose the role that supports the actual work rather than sharing a login.
Record the profile's identity and the practice-controlled recovery account. Confirm who can maintain critical information and handle access changes. Do not create a duplicate profile merely because the agency's account is inconvenient to transfer.
Where a clinician has an eligible individual profile, keep that relationship separate from the practice's profile. Agency access does not decide which business or professional should own a listing.
Use official access or recovery processes if the current control arrangement is unclear. Avoid destructive changes while nobody knows which account is authoritative.
Know the ad account, billing and manager relationship
Record the actual ad account identifier, billing responsibility, administrative access and any agency-manager linkage. A monthly PDF report does not show that the practice can inspect the account itself.
Google explains account roles in About access levels in your Google Ads account. Have the manager explain the selected roles and any management-account relationship in your configuration. Keep access rights separate from the ability to charge or alter billing.
Ask what remains available after the agency leaves: campaign history, creative assets, approved configuration records and reporting. Clarify what depends on the agency's own tools or contracts rather than assuming everything transfers automatically.
Do not require the agency to export private data or another client's materials to prove ownership. The practice needs its own authorised account information, rights and working access.
Establish reporting access without widening sensitive-data access
Identify the systems used for search visibility, website analytics and first-party operational reporting. Record which property and account correspond to the actual practice website, not only the agency's combined dashboard.
Give each role access appropriate to its work. Marketing visibility does not automatically require patient-level records or all CRM permissions. A practice's qualified privacy and security reviewers should approve the data scope and any external sharing.
Record where data is stored, who can export it and what the vendor retains at exit. Keep operational records distinct from aggregated campaign reports. If a report depends on sensitive information, resolve that handling rather than forwarding the entire receiving inbox to the agency.
For US cloud services where HIPAA applies, HHS's business associate guidance is relevant to qualified review. It is not a universal claim that every agency or marketing tool has the same status.
Copy this digital asset ownership register
Use one entry per important account or asset. Store account identifiers and evidence links, not passwords, authentication codes, secret keys or patient data.
- Asset and purpose: domain, DNS, hosting, website, profile, advertising or reporting.
- Account identity: provider and verified account or property identifier.
- Control arrangement: practice-owned, vendor-managed, licensed or unresolved, with contract evidence.
- Practice access: responsible administrator and backup role, verified by an appropriate login test.
- Vendor access: named role or manager relationship and the work it supports.
- Recovery: approved recovery route and who maintains it, without exposing the secret material.
- Billing and renewal: payer, renewal date or review point, and continuity owner.
- Portability: documented export format, rights, dependencies and any exit limitation.
- Sensitive-data boundary: approved access scope and relevant reviewer.
- Last verification: date, result and unresolved action.
The register should reveal gaps rather than make every row look complete. Vendor-managed is not automatically a problem; unresolved control over a critical service is the problem to clarify.
Run a practical control test
Ask the practice's administrator to access the critical accounts through the approved process. Verify identities, roles and recovery arrangements without changing live configuration simply to demonstrate control.
For a website, identify a documented restoration process and the authorised person who could perform it. For advertising, confirm the correct account and visibility into its configuration. For a profile, verify the practice's intended role.
Do not test recovery by deliberately locking out a live account. A supervised review of configuration and a supported rehearsal is safer than creating a real outage. Keep an exception list for anything that cannot yet be verified.
An illustrative gap might be a domain that renews on an agency employee's card while recovery goes to that employee's personal inbox. The correction requires an agreed administrative change and continuity check, not an angry demand for every password.
Put continuity expectations in the working agreement
Before signing, agree on access roles, renewal responsibility, export scope, licensed dependencies and a handover acceptance process. Define how the practice receives notice of material changes and what happens when the engagement ends.
Avoid making access revocation the first action in a transition. Verify the replacement team's ability to operate the required workflows and review integrations before removing the old relationship. Use the marketing vendor handover checklist for that sequence.
For new software procurement, use 13 questions for a clinic software vendor. Fyntrix's inquiry and follow-up work can support accountable systems, but control should remain clear regardless of which agency you hire.
Keep control of the asset while delegating only the work that needs doing.