HIPAA at Dental Refer

Our role: business associate

Dental practices are generally covered entities under HIPAA. When we create, receive, store or send patient information for a practice, we act as that practice's business associate. If a dental support organization or another business associate of a practice uses Dental Refer for that practice, we act as its subcontractor.

We use patient information to provide our service to the practice and for the other purposes our Business Associate Agreement allows or the law requires, and for nothing else. We do not sell patient information, and we do not use it for marketing or advertising. We may de-identify patient information as HIPAA allows. We use de-identified information only to operate and improve Dental Refer, and we do not try to re-identify anyone.

How we protect patient information

• Two-step sign-in. Every user must set up two-step sign-in, and signing in takes a password and a one-time code. Where we offer it, a user can ask us to remember a device for a limited time (30 days by default, and never more than 90 days), so that the device asks only for the password. Some sensitive actions still ask for a fresh code.
• Unique user identifier per workforce member. Each user has their own account. Practice users can reach only their own practice's records and the referrals exchanged with it, and their role limits what they can do.
• Automatic sign-out. Users are signed out automatically: a session ends at most 30 minutes after the last keyboard, pointer or touch input, and 12 hours after sign-in regardless. Background updates do not keep a session open.
• Encryption. Patient information is encrypted in transit (TLS 1.2 or higher) between your browser and Dental Refer and between Dental Refer and our vendors, and it is encrypted at rest by our database and storage providers. In addition, patient-record identifiers (name, birth date, phone, email) and the free-text clinical content of referrals, referral letters, specialist reports and messages are written with AES-256-GCM field-level encryption, alongside their original columns, except that a referral letter's text is now stored in the database only in encrypted form. The decrypting read path (Phase C), which reads a field from its encrypted copy wherever one exists, is live for all of them: patient records, referrals, referral letters, specialist reports and messages; where a row has no encrypted copy, the read comes from the original column. Faxes, including referral faxes that a practice chooses to send, travel over the telephone network, which does not encrypt them.
• Audit log. An append-only, hash-chained audit log records access to and changes of patient information, including each attachment download. We check the chain daily.
• Minimum necessary. We design screens and API responses to show only the patient details a task needs. Our audit records refer to patients by internal record numbers and hashed identifiers, not by name, birth date or clinical details. Our application logs and error messages are designed to leave patient information out.
• Text messages and AI. Dental Refer does not currently send text messages (SMS). AI features are disabled by default via a platform master switch and send no patient information to an outside AI model while they are off.
• Hosting. The application runs on Vercel, whose SOC 2 Type 2 report covers its own hosting platform, not Dental Refer.
• Incident response. We keep a documented incident response runbook, with severity levels and response targets.

Business associate agreements (BAAs)

With every practice

Every practice e-signs our Business Associate Agreement in the app, on every plan, before it can create a referral. An owner or administrator signs it under Settings, then Compliance, and no referral can be created until that signature is on file. A practice that receives referrals in Dental Refer cannot open them there until it has signed. When a user chooses to send a referral summary by fax or email, the office that receives it gets it directly, outside Dental Refer, as the sending practice's disclosure.

The app records who signed, their title, the date, the version and a cryptographic fingerprint of the exact text. The agreement is signed for Dental Refer by our authorized representative. When we publish a new version, we give each practice at least 30 days' notice before it must sign again, unless a change in law requires a shorter period.

You can read the current agreement at dentalrefer.com/baa before you sign up.

With our vendors

We have executed Business Associate Agreements (BAAs) with these subprocessors: Vercel (application hosting), Neon (database), Paubox (email that may contain patient information), SRFax (fax), Stedi (insurance eligibility clearinghouse), Google Workspace (business email for our @dentalrefer.com addresses), and Amazon Web Services (file storage and malware scanning, plus backup email and AI services that are off by default, under one Business Associate Addendum).

Dental Refer is not yet accepting patient information, so the files the platform stores today contain no real patient information. Uploaded files, the documents the platform generates and a daily archive of our audit log are now stored in Amazon S3 under our AWS Business Associate Addendum. Files, documents and audit-log archives stored before the move to Amazon S3 remain in Cloudflare R2 storage until we delete them, and Cloudflare does not have a BAA with us.

Cloudflare also runs our DNS, without proxying our website traffic, and the bot check on our sign-in, registration, password reset and public referral forms; those services are not under a BAA either. The bot check sees a visitor's IP address and browser details, but not what the visitor types into the form.

The full list of our vendors, with what each one does and where, is at dentalrefer.com/subprocessors.

Our Privacy and Security Officer

Merat Ostovar is our HIPAA Privacy Officer and HIPAA Security Officer and is responsible for privacy and security at Dental Refer, including our Business Associate Agreements and our response to incidents. You can reach our Privacy and Security Officer through the contacts at the end of this page.

Incidents and breach notification

Our incident response runbook sets severity levels and response targets. If we discover a breach of unsecured patient information, we notify the affected practice without unreasonable delay and no later than 10 business days after discovery, or sooner if the law requires. We identify the affected patients to the extent possible, and we give the practice the other details it needs to notify them as those details become available.

The practice, as the covered entity, notifies its patients and, where required, the U.S. Department of Health and Human Services, state authorities and the media. We help by providing the information the practice needs. Where a state law requires us to give a notice ourselves, we give it.

We also report to the practice any other security incident, other than unsuccessful attempts such as pings, port scans and failed log-ins, and any use or disclosure of its patients' information that our agreement does not allow, as the agreement sets out.

Patient rights

Your dental practice holds your records and handles your rights under HIPAA: to see and get a copy of your records, to ask for corrections, to get an accounting of certain disclosures, to ask for limits on how your information is used or shared, and to ask to be contacted by a particular means or at a particular place. Your practice's Notice of Privacy Practices explains these rights. Please contact your practice directly.

If you contact us instead, we will forward your request to your practice within 5 business days, and your practice is responsible for responding to you. We do not decide these requests ourselves unless your practice has asked us in writing to act for it and we have agreed.

Contact

Phone: (503) 662-8088

• Privacy questions, questions about our Business Associate Agreement, and patient requests: privacy@dentalrefer.com
• Security concerns and vulnerability reports: security@dentalrefer.com

Do not email patient information (names, dates of birth, clinical details or images) to any Dental Refer address. Send patient information only through Dental Refer itself, after signing in.