Who Owns Your Practice’s Accounts? The Setup Guide I Walk Practices Through

Almost every practice I meet has the same setup problem. The Facebook page was made by a front desk person who left years ago. The Google listing sits under the old web company's email. The passwords live on a sticky note under the keyboard, in a Google Sheet, or in a text thread with whoever asked last.

This is the walk-through I give practices, in the order I'd do it. It's written for owners, office managers and whoever ends up "doing the social media." No marketing or IT background needed.

I've seen passwords in Google Sheets, on sticky notes under keyboards, and sent to me in texts and emails, one at a time, from three different people. Some days I half expect a smoke signal. You don't need a fancy system. You need the right owner on every account, and a safe way to let people in.

The short version:

• The practice owns every account. People and agencies get their own access, never your password.
• Two trusted people from the practice hold the keys to every important account.
• Set things up in order: email first, then Google, then Meta, then everything else.
• Every login gets a second check, ideally a passkey.
• Keep a simple access log so you always know who's in.

Why did I write this?

Because I got tired of the horror stories. A business does great, then decides to sell, or to close and send one last message to everyone who ever followed it. That's when it finds out it can't reach its own audience. The LinkedIn page was built by someone who left years ago. They don't answer the phone, or they left on bad terms and won't give access back. The ad account full of retargeting audiences sits under a profile nobody at the practice controls.

I've tried to help a lot of people get back in and get reinstated. Many times we got lucky: the owner had a driver's license and a few documents showing the business address, and it worked. But very often, that only works if the account was already verified or set up a certain way. Sometimes it's simply too late.

The other version of the same story is duplicates. Someone can't get into the old account, so they make a new one. Now there are two LinkedIn pages with the practice's name, and you're stuck inventing an abbreviation just to tell them apart. It turns into a nightmare, and all of it is avoidable if the accounts are set up right the first time.

Why does this matter for my practice and my marketing?

Your accounts are where new patients find you. Your Google listing, your website, your Facebook and Instagram, your ads. If one gets locked, hacked or suspended, patients can't find you, and your ads stop while you sort it out.

A lot of that trouble has nothing to do with hackers. It's an account tied to someone who left, a card that expired, or one login that six people shared until a platform flagged it. All of that is fixable in an afternoon, before it costs you.

Not sure who owns your accounts right now? Book a free 15-minute Method Review by phone or Zoom. We'll look at who owns what, and you'll leave with the first fixes in order. Book a Method Review

What order should I set things up in?

Email first, because every other account hangs off it. Then the Google accounts, which all run on that email. Then Meta, which runs on the doctor's personal Facebook. Then everything else.

The setup order

1. Practice email and web address: One account per person, two admins, 2-step sign-in on
2. Doctor's personal email: Personal use only. No patient information.
3. Google accounts: Business Profile, Search Console, Analytics, Google Ads, YouTube
4. Personal Facebook and LinkedIn: Real name, real face, 2-step sign-in on
5. Meta business portfolio: Facebook Page, Instagram, ad account, dataset
6. TikTok Business Center: Signed up with a practice group address
7. LinkedIn Company Page: The doctor plus one more Super admin
8. Directories and review sites: Claimed with a practice address

On every account: two practice owners, the agency invited by role, the password manager for the rest, all in the access log.

The doctor's personal email is only on the list because Facebook and LinkedIn need a real person.

Which email should own each account?

The practice's own business email, on your practice's web address. Not a free Gmail, not an employee's personal address, and never your agency's email.

That means an address like [email protected], run through Google Workspace (Google's paid business email) or Microsoft 365. The practice controls it. When someone leaves, you turn off their account and every business account they owned stays with the practice.

What it looks like, set up right

Here's a made-up practice, Example Family Dental, with one owner doctor and one office manager. In real life, each address would use that person's own name:

Email address	What it is	Who uses it	What it's for
[email protected]	The owner doctor's own practice account	The doctor only	Owner on Google, the ad accounts and the web address
[email protected]	The office manager's own practice account	The office manager only	Second owner on all of the same accounts
[email protected]	A group address. Mail goes to both of them. Nobody logs into it.	The doctor and the office manager	Sign-up and recovery email for accounts outside Google, like TikTok and review sites
The doctor's personal Gmail	The doctor's own account, nothing to do with the practice	The doctor only	The doctor's personal Facebook and LinkedIn
Your agency's own email	The agency's account	The agency	Gets invited in as a manager. Never owns anything.

Two things to notice. Every person has their own login. And the shared address is a group, not an account people sign into. Google Workspace's rules say you can't give more than one person access to a single user account, other than through its built-in delegation features (Google Workspace Acceptable Use Policy). A group gets the mail to both of you without breaking that rule. Google calls these groups; Microsoft 365 has its own version.

One catch: Google Business Profile won't accept a group as an owner or manager (Google). Use the two people's own emails there.

Why does the doctor need a personal email too?

Because Facebook and LinkedIn run business pages through real people's profiles. The doctor's personal Facebook and LinkedIn belong to the doctor, so they should sit on an email the doctor will own for life. If they sit on a practice address and that address ever goes away, so does the doctor's way back in.

Can we just use a free Gmail if we're not sending patient information?

You can, but I don't set practices up that way. A free Gmail has no admin, so nobody can lock it down, recover it or take it back when someone leaves. And patient information has a way of showing up anyway: a new-patient form submission, an appointment request, a reply to a review.

If patient information ever touches email, the law gets specific. HIPAA requires a signed Business Associate Agreement (BAA), a contract where the email company agrees to protect that information. Google offers its BAA to Google Workspace customers, accepted by the practice's admin, and says customers without one must not use patient information in Workspace (Google). Free Gmail has no admin and isn't covered (Paubox). Signing a BAA is a start, not the finish line. Your settings and your team's habits still matter, so take the details to your compliance advisor.

Not sure what you have now? My post AI in Your Practice's Google Account: Read This First walks through a two-minute check to see who runs your email.

Set up your email like this

• One practice email account per person, on your practice's web address
• At least two admins on the email system: the owner and one long-term manager
• 2-Step Verification required for everyone
• A group address (like marketing@) for sign-ups and recovery outside Google
• The doctor's personal email kept separate, with its own 2-Step Verification

How should we share passwords?

Mostly, you shouldn't. Almost every platform in this guide lets you add a person by name, with their own login and a role. That's always the first choice. A password manager covers the few tools that don't.

How offices share logins now	The problem	Do this instead
Sticky note under the keyboard	Anyone who walks by can read it	A password manager
A Google Sheet or Word doc	One forwarded link exposes every login at once	A password manager
Texted or emailed when someone asks	It lives in phones and inboxes for years	Add the person by role, or share it in the manager
One login the whole office uses	You can't tell who did what, and you change everything when one person leaves	Everyone gets their own login

What a password manager does

It's an app that stores logins in an encrypted vault. The office manager shares a folder with the people who need it. Many let people sign in without ever seeing the password, and when someone leaves, you remove them in one place. Business plans from well-known names include 1Password, Bitwarden and Keeper. These are examples, not endorsements. Pick one with shared folders and an admin who can remove people.

Let it create the passwords for you: long, random and different for every account. U.S. guidance from NIST now favors long passwords over complicated rules, says not to force changes on a schedule, and says to change a password when there's a sign it was exposed (NIST SP 800-63B).

Thumbprint or a key? Passkeys explained

A passkey replaces your password. You sign in by unlocking a device you own: your phone's fingerprint, face scan or screen lock PIN. Google says your fingerprint or face data stays on your device and is never shared with Google. A passkey can also live on a security key, a small device you plug in or tap, unlocked with its own PIN or fingerprint sensor. Google says passkeys can't be written down or accidentally given to someone else, which makes them much harder to phish (Google).

The federal cybersecurity agency, CISA, calls phishing-resistant sign-in, built on the FIDO technology behind passkeys and security keys, the "gold standard" for 2-step login. It says text-message codes should be a last resort (CISA).

Sign-in check	How it works	My take
Text message code	A code sent to your phone	Better than nothing. Use only when there's no other choice.
Authenticator app	A code or a tap in an app on your phone	Good
Passkey on your phone (thumbprint or face)	Your phone confirms it's you	My default for most staff
Security key	A small device you plug in or tap	A strong backup for the owner's most important accounts

I get asked this a lot: thumbprint or key? Both are strong. The thumbprint is the easy everyday choice. A security key is a great second option for the owner's email admin, web address and Meta, because it doesn't depend on your phone. Whatever you pick, set up a backup way in, so a lost phone doesn't lock the practice out.

Either one beats a password on a sticky note. Just don't let the only way into your practice's accounts be one phone in one person's pocket.

Who should own the web address and the website?

The practice. Your web address (yourpractice.com) is bought through a company called a registrar, like GoDaddy. It decides where your website and your email point. Lose it and you can lose both.

• The registrar account is in the practice's name, on the owner's practice email
• A second person from the practice can get in
• Auto-renew is on, with a current card
• 2-Step Verification is on
• Your website company has its own login to the site. The practice keeps the main one.

Whose card goes on the ad accounts?

The practice's own business credit card, in the practice's name. Not the agency's card and not a staff member's personal card. The practice owns the ad account, so it pays for it directly.

Then add a backup card. In Google Ads, if your main card fails, Google tries the backup so your ads keep running. If both fail, your ads can stop until a payment goes through. Google allows one backup, and it has to be a credit or debit card (Google). Check your Meta and TikTok billing settings for the same kind of option.

Skip prepaid and gift cards. Google says it doesn't accept prepaid cards for its standard pay-after billing (Google).

People used to put Visa gift cards on their ad accounts. Don't do that anymore. If the card on file expires and there's nothing behind it, you're stuck, so use a real card and a backup.

How should the Google accounts be set up?

All of them run on the practice email from the first step. Same pattern every time: the owner's practice email owns it, a second person from the practice backs it up, and the agency gets the lowest role that lets it do the job.

Google Business Profile (your listing on Google Search and Maps)

• Primary owner: the owner's practice email
• Second owner: the office manager's practice email
• Agency: Manager

Owners can add and remove people and even delete the profile. Managers can do the day-to-day work, but can't add or remove people or remove the profile. New owners and managers wait 7 days before they can manage some features (Google). So set up your backup owner now, not the week you need it.

To add your agency: in your profile, open Business Profile settings, then People and access, then Add. Enter the agency's email and choose Manager.

Google Search Console (how your website shows up in Google Search)

• Owner: the owner's practice email, plus a second practice owner
• Agency: Full user

Owners have full control. Full users can see all the data and take some actions (Google). Google says a site needs at least one verified owner, or nobody can get in. If the only verified owner leaves, verify again right away, and remove the old owner's verification so they can't come back.

Google Analytics (who visits your website and what they do)

• Administrator: the owner's practice email, plus a second practice person
• Agency: Editor, or Marketer if it manages ads, audiences and key events

Roles are listed in Google's access guide.

Google Ads

• The practice creates the account, with the practice card on it
• Agency: sends a link request from its own manager account, and you accept it

When an agency links to your existing account, your account and its history stay intact, and the agency doesn't get ownership unless you turn it on (Google). You can unlink the agency any time (Google).

YouTube

• Primary owner: the owner's practice email, on a Brand Account (Google's setup for channels with more than one manager)
• Second owner: another practice person. Google recommends at least one owner besides the primary.
• Agency or video editor: Manager

Someone has to be an owner for 7 days before they can become the primary owner (Google).

Then connect them to each other

Once each account has the right owner, link them so they share what they know:

Link	What it gets you	How
Google Analytics + Google Ads	Your ads can see what people do on your site after they click, like a form or a call	Google's steps
Search Console + Google Analytics	Your Google Search results and your website traffic in one place	Google's steps
YouTube + Google Ads	Run your videos as ads and see how they're watched	Google's steps

To link two accounts, the person doing it usually needs high-level access on both sides. That's one more reason the owner's practice email should hold both.

How should Facebook and Instagram be set up?

Through a Meta business portfolio (it used to be called Business Manager), built on the doctor's personal Facebook. This is the one that confuses everybody, so let's clear it up first.

"Do I have to give you my Facebook login?"

No. Never. You get into Meta's business tools with your own Facebook profile, or with a managed Meta account, a setup built for larger organizations (Meta). For most practices, that means a real person's Facebook profile. So each person signs in as themselves, and the portfolio decides what each person can touch. Your personal Facebook is you: your messages, your photos, your friends. Nobody else should ever sign in as you.

To let someone in, you add their profile or their company. You never hand over yours.

So yes, for most practices, you're going to have to use your personal Facebook. That's how Meta works. Before I connect anything, I make sure that profile is safe and doesn't have a bunch of red flags on it.

Get the doctor's personal profile ready

• Real name and a real photo of the doctor's own face. The logo goes on the Page, not the profile.
• 2-Step Verification on, ideally a passkey or an authenticator app
• On the doctor's personal email, not a practice address
• No restrictions, warnings or past hacks. If there are, tell your marketing person before you connect anything.
• One profile per person. Never make a fake or "business" profile to run the page.

Build it in this order

1. Doctor signs in at business.facebook.com and creates the business portfolio, using the practice's name and practice email
2. Add the practice's Facebook Page
3. Switch Instagram to a professional account and connect it to the portfolio
4. Create the ad account inside your portfolio, with the practice card
5. Create the dataset (Meta's tracking for your website) inside your portfolio
6. Add the office manager, using their own personal Facebook, with full control

Step 4 matters more than it looks. Meta says a business asset can only belong to one business portfolio (Meta). If the ad account is created inside your agency's portfolio, it lives there, not with you.

Meta's own security checklist adds a few more (Meta):

• Two people with full control. Meta recommends two active people, so one locked account doesn't lock out the practice.
• Passkeys or 2-step login for everyone. Meta suggests removing anyone who hasn't set them up until they do.
• Practice email addresses, not Gmail. Meta flags people whose email isn't tied to your business. When you join the portfolio, enter your practice email as your business email.
• Back up your authenticator app and save your recovery codes, so a new phone doesn't lock you out.

How do I give my agency access on Meta?

Use partner access. Your agency has its own business portfolio with an ID number. You share your assets with that ID:

1. In your business portfolio, open Settings, then Users, then Partners, then Add
2. Choose Give a partner access to your assets
3. Enter the agency's business portfolio ID
4. Pick what they can use: the Page, Instagram, the ad account, the dataset
5. Save

Why partner access is the right call (Meta):

• Even with full control of an asset, a partner can't share it with another business. Only the business that owns it can.
• You choose full control or partial access, down to specific tasks like creating content or managing ads.
• The agency manages its own staff on its side, and you can remove the partner any time.

Can our marketing person make a profile with a made-up name?

No. I've seen it: a profile called "Office Admin" or "Smile Team," a logo or an AI-generated face as the photo, made so nobody has to use their real account. Facebook's terms say to use the name you use in everyday life, give accurate information about yourself, create only one account (your own), and not share your password or give anyone else access to your account (Facebook Terms of Service). A made-up person breaks every one of those, whoever made it and wherever the photo came from.

If the doctor doesn't want to be the one running things, that's fine. The office manager can be the main admin, on their own real profile. Posts on the Page show the practice's name, not the admin's.

I've also seen what happens with photos. Someone puts the practice logo on a personal profile, and all of a sudden it gets flagged. A real person's face on a real profile has worked. And don't use the same person's face on more than one profile. That can jack you up. That's my experience, not a published Meta rule, but it lines up with Meta's terms above.

Do	Don't
Real people, real names, their own profiles	Made-up names like "Office Admin" or "Smile Team"
Each person's own face as their profile photo	The logo or an AI-generated face on a personal profile
One face per person, one profile per person	The same photo on more than one profile
The logo on the business Page, Instagram and ads	A second "business" profile to run the Page

What about TikTok, LinkedIn and the directories?

TikTok

TikTok works a lot like Meta, through TikTok Business Center.

• Sign up for the TikTok account with the group address ([email protected]) and switch it to a Business Account
• Create a Business Center owned by the practice, with two practice admins
• Add the practice's TikTok account to that Business Center
• Create the ad account inside your Business Center, with the practice card

To add your agency: in Business Center, open Partners, click Add partner, enter the agency's Business Center ID, then choose the accounts it can use and its permissions. You can change or remove a partner's access any time (TikTok). Staff get added under Members with their own email.

LinkedIn

LinkedIn is for referral relationships, hiring and the doctor's own reputation. Like Facebook, it runs on personal profiles.

• Doctor's personal profile: real name, real photo, current role at the practice
• Company Page: created from the doctor's profile, which makes the doctor its Super admin
• Second Super admin: another long-term practice person
• Agency or staff who only post: Content admin

To add someone: from your Page's super admin view, click Settings, then Manage admins, then Add admin, and pick their role. LinkedIn only lets you add someone who is a 1st, 2nd or 3rd-degree connection, follows your Page, and hasn't been flagged for violations (LinkedIn). So ask your agency person to follow the Page first. Same rule as Meta: you add their profile. Nobody shares a LinkedIn login.

LinkedIn's roles, in short: a Super admin can do everything, including adding admins and deactivating the Page. A Content admin creates posts and events. An Analyst only sees the numbers (LinkedIn).

Directories and review sites

Yelp, Healthgrades, Apple Business Connect, Bing Places and the rest. Same rules, with one wrinkle: some give you a real way to invite people, and some give you one login.

• Claim each listing with a practice address, never someone's personal email. The group address works well here.
• If the site lets you invite people, use it. On Yelp for Business: Account Settings, then Share access to this business, then Invite a User (Network Solutions).
• If it only gives you one login, put it in the password manager and share it from there. Never text it.
• Write each one in your access log (below), so nobody forgets the practice has it.

Some sites, like Healthgrades, list each doctor separately from the practice, so each doctor may need to claim their own profile too.

A lot of directories only give you one login. That's exactly what the password manager is for.

Every other tool

Scheduling, website chat, call tracking, email marketing, review software. The same rule covers all of them. The practice owns the account, each person gets their own login, and the agency gets invited in. If a tool ever touches patient information, ask the company for a signed BAA before you use it.

How do I give my agency access, everywhere?

By inviting the agency in, account by account, at the lowest level it needs. Here's every platform in one place. Print it, or send it to whoever is asking you for logins.

Platform	What the agency gets	What you need from the agency	Where you do it
Practice email	Nothing. It doesn't need your inbox.	Nothing	Nothing to set up
Web address (registrar)	Usually nothing	Nothing	Nothing to set up
Website	Its own login	Its email	Your website's user settings
Google Business Profile	Manager	Its email	Business Profile settings, People and access
Google Search Console	Full user	Its email	Settings, Users and permissions
Google Analytics	Editor or Marketer	Its email	Admin, Access management
Google Ads	A link from its manager account	Your 10-digit Ads account number goes to the agency. You accept its request.	Admin, Access and security, Managers
YouTube	Manager	Its email	Channel permissions, or your Brand Account settings
Facebook and Instagram	Partner access	Its business portfolio ID	Settings, Users, Partners
TikTok	Partner access	Its Business Center ID	Business Center, Partners
LinkedIn Page	Content admin	The agency person's own LinkedIn profile, following your Page	Super admin view, Settings, Manage admins
Directories	An invite, if the site offers one	Its email	Each site's user settings
Password manager	Only the folder it needs	Its email	Your password manager's sharing settings

One rule covers the whole table. The agency never owns anything, and never needs your password. If an agency asks you to text it a password, that's a sign to slow down.

This is what I run through with practices. When we're done, the practice owns everything, and the agency, me included, gets invited in. No agency gets handed the keys.

Want help sending these invites the right way? Book a free 15-minute Method Review and we'll go through your list together. Book a Method Review

How do we keep it from getting messy again?

With one access log and two habits. The log is a simple spreadsheet, one row per account. No passwords in it, ever. Here's one row from Example Family Dental:

Account	Owner	Backup owner	Outside access	Sign-in check	Last checked
Google Business Profile	[email protected]	[email protected]	Agency, Manager	Passkey	October 2026

Every three months: open each account, compare who's in against the log, remove anyone who shouldn't be there, and make sure 2-step sign-in is still on.

The day someone leaves, the same day:

• If they were an owner, confirm the backup owner has full control first
• Remove them from every account in the log
• Remove them from the password manager and change any password they could see
• Turn off their practice email last. Suspend it, don't delete it, so nothing tied to it disappears.

The day an agency or vendor relationship ends: remove partner access on Meta and TikTok, unlink its Google Ads manager account, and remove it from Business Profile, Search Console, Analytics, YouTube, LinkedIn and the directories.

The whole thing on one page: print it

• Practice email for every person, on your own web address, with two admins
• A group address for sign-ups outside Google
• Doctor's personal email for personal Facebook and LinkedIn only, with real names and real faces on every personal profile
• Web address and website owned by the practice
• Practice card plus a backup card on every ad account. No prepaid or gift cards.
• Google accounts owned by the owner's practice email, with a second owner
• Doctor's personal Facebook cleaned up and locked down, then the business portfolio built on it
• Ad accounts created inside the practice's own portfolio and Business Center
• Agencies invited by role or partner access. Never a password.
• Passkeys or an authenticator app on every account, with a backup way in
• A password manager for the few logins that can't be shared by role
• Access log checked every three months, and every time someone leaves

What do these words mean?

• Google Workspace: Google's paid business email and apps, on your own web address
• Free Gmail: a personal Google account ending in @gmail.com, with no admin
• Google Business Profile: your practice's listing on Google Search and Maps
• Registrar: the company you bought your web address from
• Group address: one email address that delivers to more than one person. Nobody signs into it.
• Business portfolio: Meta's home base for your Page, Instagram, ad account and dataset
• Partner access: a way to share your accounts with another company without making it an owner
• Passkey: a sign-in that uses your phone's fingerprint, face or screen lock instead of a password
• Security key: a small device you plug in or tap to sign in
• HIPAA: the federal law that protects patient information
• BAA (Business Associate Agreement): a contract where an outside company agrees to protect your patient information

Want me to walk your practice through it?

If you read this and realized you don't know who owns half your accounts, you're in good company. It's one of the first things I go through with a practice, because the rest of your marketing sits on top of it.

On a 15-minute call, we'll look at who owns your main accounts. I'll point out the gaps and the first fixes to make, whether or not we work together. Have a question about your own setup? Bring it.

Book a Method Review A free 15-minute call with Blake by phone or Zoom. You get a written Method Plan with the first fixes in order. It's yours to keep whether we work together or not. Book a Method Review

FAQ

Do I have to give my agency my Facebook password?

No. On Meta, you share your Page, Instagram and ad account with the agency's own business portfolio using partner access. The agency never signs in as you, and Facebook's terms say not to share your password.

Can our practice use a free Gmail for marketing accounts?

You can, but a free Gmail has no admin, so nobody can recover it or take it back when someone leaves. Google doesn't offer a BAA for it, so it should never touch patient information. A practice email on Google Workspace or Microsoft 365 is the better owner.

Should I use a passkey or a security key?

Both are strong. A passkey on your phone, unlocked with your thumbprint or face, is the easy everyday choice. A security key is a good backup for the owner's most important accounts, because it doesn't depend on your phone.

Can we put a prepaid or gift card on our ad accounts?

Skip it. Google says it doesn't accept prepaid cards for its standard pay-after billing. Use the practice's business credit card, and add a backup card where the platform allows one.

Who should own our Google Business Profile?

The practice, through the owner's practice email as primary owner, with a second practice owner as backup. An agency or outside helper should be a Manager.

I'm a marketer, not a lawyer or a HIPAA consultant. This is general education, not legal advice. For HIPAA questions about your practice, talk to your attorney or compliance advisor. Platform menus change often; everything here was checked against platform help pages and industry sources on October 22, 2026.