Key Takeaways
- Cornerstone and Avimark are traditionally server based systems, which means your clinic is responsible for the physical security and backup of the machine storing client and patient data, while ezyVet is cloud native and hosts that responsibility with the vendor.
- None of the three platforms will keep your clinic compliant with DEA controlled substance rules on their own, since federal law requires a separate readily retrievable log for Schedule II through V drugs regardless of what your practice management software tracks.
- DEA registrants must report significant theft or loss of any controlled substance within one business day, and the agency's own data shows roughly 37 percent of inspected veterinary clinics have had discrepancies in their controlled substance inventories.
- Switching practice management systems is a data migration event, not just a software change, so the security posture of your new system matters as much as its feature list.
Every clinic has had the "should we switch" conversation about its practice management software at some point, usually right after a slow login, a billing error, or a frustrating support call. But the question that actually matters for your clients and your license is rarely asked in that conversation: what happens to their data, and to your controlled substance records, when you make that switch.
Cornerstone, ezyVet, and Avimark: what's actually different
Cornerstone, ezyVet, and Avimark are the three most established practice management systems (PIMS) in general veterinary practice, and they differ most in where your data physically lives. Cornerstone, owned by IDEXX, is traditionally a server based system that runs on hardware inside your clinic, though a cloud option is now available. Avimark, owned by Covetrus, offers both on premises and cloud deployment, giving practices a choice depending on internet reliability and how much local control they want to retain. ezyVet is cloud native by design, meaning your data is hosted off site by the vendor rather than on a server sitting in your back office.
That distinction matters more than it sounds. A server based system puts the physical security of that machine, and the discipline of its backup routine, squarely on your clinic's shoulders. A cloud based system shifts that responsibility to the vendor's infrastructure, for better or worse depending on how much you trust their security practices and how reliable your internet connection is on a given day.
Where each platform stands today
| Factor | Cornerstone | ezyVet | Avimark |
|---|---|---|---|
| Deployment | Server based, cloud option available | Cloud native | On premises or cloud |
| Backup responsibility | Shared, with IDEXX specialists verifying backups | Vendor managed | Shared if on premises, vendor managed if cloud |
| IDEXX lab integration | Strongest, native | Strong | Standard |
| Remote access | Limited without cloud upgrade | Full, any device | Limited on premises, full on cloud |
| Best fit | Large or specialty hospitals wanting deep IDEXX integration | Multi site groups and corporate practices | Independent single site practices |
None of this makes one platform inherently more secure than another. A well maintained server based system with disciplined backups and a locked server closet can be perfectly defensible, and a cloud platform with weak password practices on the admin side can be just as exposed. The platform is only half the equation. How your clinic configures and manages it is the other half.
Does switching practice management software put client data at risk?
Yes, temporarily, if the migration isn't planned carefully. A PIMS transition typically takes three to six months and involves moving client contact information, patient medical histories, payment records, and in many cases controlled substance logs from one system to another. During that window, data commonly exists in both the old and new systems simultaneously, which doubles your exposure if either system is misconfigured or if staff aren't trained on where records currently live.
This is the part of a software switch that gets the least attention in vendor sales conversations, because it's not a feature, it's a project. Before committing to a new PIMS, ask the vendor directly what their data conversion process looks like, who has access to your data during the transfer, and what happens to your old system's data once the migration is complete.
What most vet clinics get wrong about DEA compliance and their software
A practice management system tracking inventory is not the same thing as DEA controlled substance compliance, and assuming otherwise is one of the most common blind spots in veterinary IT. Every veterinarian who administers, dispenses, or prescribes a Schedule II through V controlled substance, which covers common drugs like ketamine, needs to be DEA registered, and the DEA Diversion Control Division's Practitioner's Manual lays out the recordkeeping obligations that come with that registration in detail.
Federal law requires that records for Schedule III, IV, and V controlled substances be kept either entirely separate from your other records or clearly marked so they are readily retrievable on request, and Schedule II records have their own distinct requirements. According to the American Animal Hospital Association's controlled substance guidance, these records must be kept for a minimum of two years, longer in some states, and best practice is a dedicated log reviewed at the end of every shift rather than relying on the practice management system's inventory count alone.
The reporting requirement most clinics don't know about
If controlled substances go missing or are stolen, federal regulations require the loss to be reported to the local DEA field office within one business day of discovery. This isn't a suggestion. Given that DEA studies have found discrepancies in controlled substance inventories at roughly 37 percent of inspected veterinary clinics, according to industry compliance research, this is a real and common exposure, not a hypothetical one.
None of the three major PIMS platforms will file that report for you or flag the one business day deadline. That's a manual process your practice needs a written policy for, independent of which software you run.
What to actually evaluate before you switch
- Where does the data live, and who is responsible for backing it up? Get a direct answer, not a marketing page.
- How does the vendor handle the migration, and what happens to data in the old system afterward?
- Does the platform support a separate, readily retrievable controlled substance log, or will you need a supplementary process regardless?
- What does the vendor's security posture actually look like? Ask about encryption, access controls, and whether they've had a third party security audit, not just whether they say they're secure.
- Who at your clinic has admin level access, and is that access reviewed periodically?
A practice management system is one of the most sensitive pieces of infrastructure a veterinary clinic runs. It holds client payment information, pet medical history, and in many practices, the paper trail for federally controlled drugs. Choosing the right one is a security decision as much as an operational one, and it's worth treating it that way before the next contract renewal comes up.
If you're evaluating a PIMS switch or want a second set of eyes on how your current system is configured and secured, that's exactly the kind of assessment we do for veterinary clients across Hampton Roads and Northern NC.