This guide explains why the switch puts a home care agency’s daily systems at risk, walks through the MSP transition checklist an agency can run on its own, and describes how IT Total Care runs the transition from the incoming side for agencies across the San Francisco Bay Area.
1. Why Does a Home Care Agency Need a Plan for How to Switch IT Providers?
Switching IT providers mid-operation puts at risk the systems an agency uses every shift: the Microsoft 365 or Google Workspace admin account, the domain registrar, and the EMR admin roles in Axxess, WellSky, or KanTime. Those are not back-office details. They are the login every caregiver depends on, the address every email arrives at, and the record every visit lands in.
The risk is not that the new provider will be worse. It is that control of those systems was never clearly the agency’s in the first place, and the handoff is the moment that becomes visible.
What is actually at stake in the handoff?
Five things, and each one is a place where a transition either holds or breaks.
- The single-key problem: If the outgoing provider holds the only global admin account, the agency cannot cleanly remove that provider’s access or hand control to a new one. Every other step in the transition depends on solving this one first.
- Third-party exposure is where breaches now come from: In the Verizon 2026 Data Breach Investigations Report, breaches involving a third party reached 48 percent of all breaches across every industry studied, up 60 percent year over year, and only 23 percent of third-party organizations had fully fixed missing or weak multi-factor authentication on their cloud accounts. That figure is not specific to home-based care, but the mechanism applies to any agency whose provider holds admin access.
- Access that outlasts the contract: An outgoing provider’s access that is never removed is exactly that kind of third-party exposure, and it persists long after the invoices stop. Nobody at the agency is watching an account nobody remembers exists.
- Cutover timing decides who gets locked out: A transition that breaks logins on a Friday afternoon becomes a caregiver locked out before a 7 AM Saturday visit, with no one to call until Monday.
- The agreement sets the clock: The current agreement’s exit terms, meaning the notice period and any termination fees, set the timeline before any technical work starts. An agency that discovers a 90-day notice clause after signing with the new provider pays for two providers for three months.
2. How to Switch IT Providers on Your Own: The MSP Transition Checklist
An agency can run the switch itself by working through nine steps in order: review the agreement, sign the replacement first, build the inventory, confirm ownership of every admin account and tenant, handle the Apple push certificate and licenses, take the documentation handoff and confirm backups, rotate credentials and offboard the outgoing provider, close the compliance loop for home health and hospice, and field-test the cutover the next morning. The order matters more than the speed.
Step 1: Review the current agreement
Pull the current agreement before anything else and write down four things: the notice period, any termination fee, the auto-renewal date, and any clause covering transition assistance. Those four items set the entire timeline. If the agreement renews automatically in six weeks and requires 60 days’ notice, the agency is already inside the renewal window, and the plan has to account for that. A transition assistance clause, where one exists, is what obliges the outgoing provider to cooperate on the documentation handoff later in this checklist rather than simply going quiet.
Step 2: Sign the replacement provider first, then time the notice
Choose and sign the replacement provider before giving notice to the current one. Giving notice first leaves the agency with no provider at the moment it most needs one, and it removes any reason for the outgoing firm to cooperate. Which provider to choose is a separate question, and our comparison of a healthcare MSP vs general MSP is where to settle it.
Then time the notice so there is at least one month of overlap between the two providers. That overlap is when inventory, ownership checks, and the documentation handoff happen while someone is still answering the phone. Paying two providers for a month is cheaper than a weekend of caregivers who cannot log in.
Step 3: Build or verify the inventory
Build or verify a full inventory of laptops, phones, tablets, and shared scheduler logins before anything changes hands. The inventory is what the new provider enrolls against, what the old provider’s tools are removed from, and what the credential rotation in Step 7 is checked against. Shared scheduler logins belong on the list because they are the accounts most likely to be missed: a login three people use has no single owner, so nobody flags it. Our guide to building a device inventory for home-based care agencies covers the fields worth capturing.
Step 4: Confirm the agency owns every admin account and tenant
Confirm, in writing, that the agency and not the provider owns each of the following. “Owns” means the account is registered to an agency email address, an agency staff member is a named responsible party, and the agency can sign in without the provider’s help. These are the IT provider admin credentials that most often turn out to belong to the wrong party.
- Microsoft 365 or Google Workspace global admin: The agency holds the global admin account, and there is an agency-held emergency admin login stored separately, with multi-factor authentication, for the day the primary is unavailable.
- Domain registrar and DNS: The agency owns the registrar account for its domain and controls DNS. Whoever controls DNS controls where the agency’s email goes.
- EMR admin roles: The agency holds the admin roles in Axxess, WellSky, or KanTime, not a provider login that will be disabled at exit.
- MDM tenant: Someone at the agency knows who owns the mobile device management tenant in Microsoft Intune, JumpCloud, or Apple Business Manager, and if the answer is the provider, that ownership moves before exit.
Step 5: Handle the Apple push certificate and the license moves before exit
Check the Apple MDM push certificate, which is what lets the MDM platform talk to every iPhone and iPad the agency manages. It expires annually and can only be renewed under the same Apple Account that created it. If the outgoing provider created it under its own Apple Account, that account cannot be swapped for another. The agency either takes over control of that Apple Account before exit or creates a new certificate and re-enrolls every Apple device, which means every caregiver with a work-enrolled iPhone touching their phone again.
Licenses follow the same logic. If Microsoft 365 licenses were bought through the old provider as a reseller, move them to the new provider or buy direct before the relationship ends. Licenses tied to a reseller relationship that ends do not transfer themselves, and a lapse means mailboxes and files going read-only in the middle of a scheduling week.
Step 6: Take the documentation handoff and confirm backups under the new provider
Request a documentation handoff from the outgoing provider covering network and Wi-Fi configurations, firewall settings, the license list, vendor contacts, and backup schedules. This is the step a transition assistance clause exists to enforce, and it is also the step outgoing providers most often deliver incompletely, so review it against the inventory from Step 3 rather than accepting it at face value.
Before the old provider’s tools are removed, confirm backups are running under the new provider and that a test restore has succeeded. The old provider’s backup agent stops when its tools do, and an agency that has not confirmed the new backups is running without any for however long the gap lasts. Our post on data backup essentials for home-based care covers what a working backup actually has to prove.
Step 7: Rotate every credential and offboard the outgoing provider
Rotate every credential the old provider knew, including admin passwords and shared logins, and transfer ownership of the password manager vault to an agency-held account. The inventory from Step 3 is the checklist. A shared scheduler login the provider set up three years ago is still a credential the provider knows. Our guide to password management for home-based care covers how a vault handover should work.
Then remove the outgoing provider’s access as a vendor offboarding, run the same way the agency would offboard a departing employee. Have the new IT provider delete the old provider’s admin accounts, end its delegated admin relationship in Microsoft 365 (known as GDAP, the mechanism that lets a partner administer a client’s tenant), and uninstall its remote monitoring and remote access tools from every device. The sequence mirrors our employee offboarding process for home-based care agencies, and it should be treated with the same seriousness.
Step 8: Close the compliance loop for home health and hospice
Home health and home hospice agencies, which are HIPAA covered entities, have two additional items. First, confirm the outgoing provider returns or destroys the protected health information it held under the business associate agreement, or extends the agreement’s protections in writing where return is not feasible. That duty sits in the agreement itself, as our post on what a HIPAA business associate agreement has to contain sets out.
Second, document who owns each security task on the new provider’s first day: patching, backup verification, access reviews, incident response. The gap between two providers is where those tasks go unowned. Our guide on how to build a HIPAA shared responsibility matrix with your IT provider is the tool for that. EVV credential handoff has its own specifics and is covered later in this series.
Step 9: Field-test the cutover the next morning
Field-test the cutover the morning after, not the week after. Have a caregiver log in to the scheduling or EMR app on a field device before the first morning visits, from wherever she actually starts her day, on the phone she actually uses. If the login works, the transition is done. If it does not, the agency finds out at 6:15 AM with the new provider on the phone, rather than at 7 AM from a caregiver standing outside a client’s door. Schedule the cutover itself for a weekday morning, never a Friday afternoon, so the test happens with support available.
Limitations: The hardest part of switching IT providers internally is that the agency cannot see what it does not own. The admin account it assumed was its own, the Apple Account behind the push certificate, the reseller relationship behind the licenses, none of it shows up until something breaks. The outgoing provider has little incentive to point any of it out, and the entire sequence has to run while visits continue every day. Agencies rarely get the steps wrong. They get blindsided by the step they did not know existed.
3. How Does IT Total Care Help Home Care Agencies Switch IT Providers?
When an agency switches to IT Total Care, we run the transition from the incoming side: inventory, admin account ownership, license moves, and access removal. The agency’s staff keep scheduling visits. We handle the sequence.
Our IT provider transition process includes:
- A full MSP transition checklist: We work through a written checklist that covers every step in Section 2, from the agreement review to the morning-after field test, so nothing depends on memory.
- Direct coordination with the outgoing provider: We handle the documentation handoff, the Apple MDM push certificate, and removal of the old provider’s GDAP relationship directly with the outgoing firm, so the agency is not the go-between.
- Custody and transfer of admin credentials: We take custody of the IT provider admin credentials, then move each one into agency-owned accounts, so no single provider, including us, holds the only key.
- Cutover scheduled around visits: We schedule the cutover against the agency’s shift calendar, away from early-morning and weekend visit peaks.
- BAA in place first, for home health and hospice: Our business associate agreement is signed before we touch any system that holds patient information.
- Security task ownership documented on day one, for home health and hospice: We help document which security tasks we own and which stay with the agency from the first day, following our guide on building a HIPAA shared responsibility matrix.
- Month-to-month agreements: Our agreements are month-to-month, so an agency that later leaves IT Total Care follows these same steps with no term to wait out. Whether that is the right term for your agency is a separate question.
“IT and cybersecurity transitions can be complex. Often we find out that the agency isn’t set as the owner of its own accounts. Ensuring the agency has primary ownership of their accounts and the transfer process is smooth is absolutely critical and something we take ownership of for our clients.”
Brendan Duebner, President, IT Total Care
Ready to Switch IT Providers Without a Friday-Afternoon Surprise?
IT Total Care works with home care, home health, and home hospice agencies throughout the San Francisco Bay Area on switching IT providers without disrupting caregiver shifts, from the agreement review through the morning-after field test. Learn more about our approach to healthcare IT.
Contact Us to talk through where your agency’s transition stands.
