Open Dental Cloud or an Office Server? A NYC Decision

Open Dental can be cloud-based. The vendor hosts its own service, Open Dental Cloud, which it describes as a hosted solution it manages that looks and feels like the local version; it is available to US customers only, is in limited release, accepts a limited number of practices, and carries some limits on third-party integrations. There is also a self-directed route: a virtual server a practice's IT company builds and maintains, reached through the Middle Tier. The third option is the one most New York City offices already have: a server in the closet. This page is about which of the three fits, not which one is cheaper. No fees are listed here; the vendor publishes its own and quotes each practice.

Last updated: October 2026

What does the vendor's cloud actually take off your hands?

Backups, for one. The vendor states that its cloud makes automatic full backups of the database and the image folder every night at 11 pm local time, kept on site and off site for three days, with weekly copies kept six months, monthly copies one year and yearly copies three years. Updates, for another: cloud practices are updated automatically or by appointment with the vendor, and the local Update window is not available to them. Session limits, allowed sign-in addresses and storage are managed from a Cloud Management window inside the program, and only workstations with a static IP can be put on the allowed list.

What it does not take off your hands: the workstations, the network, the imaging sensors, the printers, and the internet circuit everything now depends on. The printer setup window, for example, is not available to cloud users at all, and neither is the server migration the practice would otherwise face every five or six years.

Why does the retention rule matter to this choice?

New York requires patient records to be kept at least six years, and a minor's record until one year after the patient turns 21. Set that against the vendor's published retention: yearly cloud backups are kept three years. The live database keeps the record itself; the gap opens if the practice ever leaves the cloud or wants its own copy. The answer is the same for cloud and for a closet server: the practice holds a backup it controls, on media it owns, and it is restored once a quarter to prove it opens. A patient must be given the chance to inspect their record within ten days of a written request, which is a deadline a restore has to beat, wherever the data lives.

What does a server in the office still get right?

Control of the data, and no dependence on the building's internet for the morning schedule. A Manhattan office on a single shared riser circuit, with no cellular fallback, loses the whole program the moment that circuit drops if the database is in the cloud. With a local server the schedule, charts and imaging keep running and only the eServices pause.

The costs a local server carries are the ones this service exists for: a disk that will fail one day, Windows patches that need a reboot after hours, antivirus exclusions for the data folder, a static address for the database port, and a backup that is tested. New York's SHIELD Act asks any business holding a resident's private information to keep reasonable administrative, technical and physical safeguards, down to erasing electronic media so the information cannot be read or reconstructed when it is disposed of. The old server that gets replaced is wiped, not sold on with a factory reset.

Does the federal program cover the state one?

Partly. The SHIELD Act deems a business that is subject to, and in compliance with, the federal health-privacy and health-IT regulations to have met its safeguards duty. The word that matters is compliance. Being a dental office is not enough; the federal program has to be kept up, and the cloud contract does not do that for the workstations, the staff accounts or the disposal of old equipment.

If something does go wrong, New York requires notice to affected residents within thirty days of discovery, and the attorney general, the department of state and the state police are notified as well. A cloud provider's incident process and the practice's own have to fit inside that clock together.

What is the self-directed cloud?

A virtual server, for example on Amazon's EC2, which the vendor describes as something "the practice's IT company" sets up and maintains, with a static address, a VPN, certificates and secure storage, with workstations reaching it through the Middle Tier. It gives a multi-location group the cloud's reach with the practice's own control, and it pairs with the second-office setup on the remote access page. It also means someone is running a server in a data center instead of a closet. It is scoped as a project after a free assessment.

Questions practices ask

Is Open Dental Cloud the same program?

The vendor says it looks and feels like the local version, with some limits on third-party interoperability. Imaging bridges and lab integrations are the things to check first.

What internet does a cloud practice need?

Two paths. One circuit with no fallback is the single most common reason a cloud move is regretted in a dense building where the riser is shared.