Frequently asked questions

Dental Refer is a dental referral coordination platform built for HIPAA-regulated practices. It connects general dentists with specialists across 153,000+ U.S. dental providers, replacing faxed paper packets with a secure, structured 20-stage workflow from referral draft to closed-loop report-back.

No software can be, and any vendor claiming otherwise is selling you a credential that does not exist: HIPAA has no certification body, and compliance is a property of your practice’s own programme, not of a product. What we can state precisely is what we have built. PHI is encrypted in transit with TLS 1.2+ and at rest by our database and storage providers; on top of that, patient-record identifiers (name, birth date, phone, email) and the free-text clinical content of referrals, letters, reports and messages carry AES-256-GCM field-level encryption. Every PHI read, write, and attachment access is recorded in an append-only, hash-chained audit log. Role-based access control enforces organization isolation server-side, from the session rather than from anything the browser sends. Every practice e-signs our business associate agreement in Settings, on every plan, before it can create a referral — there is nothing to request. See /hipaa for the control-by-control posture and /subprocessors for every vendor that may touch PHI.

Three per-office plans, billed monthly: Starter at $49/month for solo practitioners and small offices (up to 2 users), Team at $99/month for growing practices (up to 10 users), and Office at $199/month for large multi-provider offices and specialty groups (unlimited users). Every plan includes unlimited referrals and the same HIPAA controls. There is no free trial — a plan starts billing when you subscribe, and an Owner can cancel at any time in Settings → Billing. See /pricing.

Yes. Dental Refer includes a fax + email bridge that sends referrals to specialist offices not yet on the platform, and shows you whether each send was accepted or failed. Replies sent back by fax are received by Dental Refer and withheld from download until they pass a malware scan — no reply is ever released unscanned. While we are not yet accepting patient information, faxed replies are not stored on the platform or scanned, so they stay in that withheld state; the scanner, Amazon GuardDuty Malware Protection, already scans every uploaded file. A reply that arrives on our shared fax number reaches you through our team; if we have given your practice its own receiving fax number, its owners and administrators see the faxes sent to that number in the practice’s Fax Inbox. Once that office claims its directory listing and we verify the claim, your referrals to it switch to native in-platform tracking.

X-rays (PA, BW, panoramic), CBCT scans, intraoral photos, PDFs, and DICOM images. Max 20 MB per file. Attachments are withheld from download until they pass a malware scan: Amazon GuardDuty Malware Protection scans every upload, and an uploaded file is released only when GuardDuty finds no threat and our own content checks pass (a search of every file for the standard antivirus test signature, plus a structure check of PDF, PNG, JPEG and GIF files), so no uploaded file is released unscanned. Files are stored in Amazon S3 under our AWS Business Associate Addendum, encrypted at rest, and served via signed URLs with a 15-minute TTL.

Specialists use a structured return-report form with fields for diagnosis, treatment performed, prognosis, follow-up requirements, and free-text clinical notes. The report attaches to the original referral so the referring office has the full case history end-to-end without searching email or fax logs.

Integrations with Open Dental and additional PMS vendors are in active development. Dental Refer also has a webhook-based integration with GoHighLevel (GHL) for offices that use GHL for office automation. Email is sent through Paubox, our BAA-covered email transport for protected health information. SMS notifications are not enabled.

Visit /register to request access. You confirm your email address, then a person reviews the practice — against the NPPES NPI registry when you supply an NPI — and we email you once your office is activated. Sign-in is refused until that review completes, so this is a waitlist rather than an instant sign-up. Multi-location groups can coordinate onboarding through /contact.