HIPAA Compliance Built In
UpDental is designed from the ground up as a HIPAA-compliant Business Associate. Every feature, every data flow, and every infrastructure decision is made with patient privacy and regulatory compliance as a first-class requirement — not an afterthought.
Under HIPAA, dental practices are Covered Entities responsible for protecting the PHI they create and receive. UpDental acts as a Business Associate — we process PHI on your behalf, under the terms of a signed BAA, and are independently accountable to HHS for our security and privacy practices. Our compliance program maps to all three regulatory safeguard categories below.
Six Compliance Pillars
Our HIPAA compliance program covers every safeguard category required under the Security Rule and Privacy Rule.
Business Associate Agreements
A signed BAA is executed with every dental practice before any PHI is accessed or stored.
- BAA is available on request and is executed before your practice enters any patient data
- Covers all permitted uses and disclosures of PHI under 45 CFR Part 164
- Subcontractors who handle PHI are required to sign their own BAAs
- BAA aligns with OCR model language and is reviewed by HIPAA counsel annually
- Executed electronically — no paper, no delays before go-live
Technical Safeguards
AES-256-GCM encryption at rest, TLS 1.3 in transit, MFA, and complete audit logs on every PHI access.
- AES-256-GCM encryption at rest for all PHI and sensitive data
- TLS 1.3 enforced for all data in transit — no insecure protocols accepted
- Multi-factor authentication (MFA) supported and enforced by default
- Automatic session timeout after configurable inactivity period
- Tamper-evident audit logs: every PHI access logged with user, timestamp, and action
- Unique user IDs — shared credentials are not permitted
- Audit log retention for 6 years per 45 CFR § 164.312(b)
Administrative Safeguards
Designated Privacy Officer, annual workforce training, documented policies, and a full risk management program.
- Designated HIPAA Privacy Officer and Security Officer on staff
- All workforce members complete HIPAA training at hire and annually thereafter
- Documented access authorization and management procedures
- Background checks required for all personnel with PHI access
- Annual HIPAA risk analysis and risk management plan per 45 CFR § 164.308
- Incident response and breach notification procedures fully documented and rehearsed
- Security awareness training updated as threats evolve
Physical Safeguards
SOC 2 Type II certified data centers with biometric access controls, surveillance, and redundant power.
- Hosted in SOC 2 Type II certified data center infrastructure
- Physical access restricted to authorized personnel via biometric and badge controls
- 24/7 security surveillance at all facilities
- Redundant power, cooling, and network connectivity for high availability
- Workstation security policies governing all staff who access PHI
- Device and media controls: secure disposal of all hardware before decommissioning
- No PHI is processed or stored on unmanaged personal devices
Breach Notification
Automated breach detection, 60-day notification SLA, and a documented incident response team on call 24/7.
- Automated anomaly detection flags potential breaches in real time
- Security incidents triaged within 4 hours by on-call response team
- Breach notification to Covered Entity within 60 days of discovery, per 45 CFR § 164.410
- Notification includes: nature of breach, PHI involved, steps taken, and remediation plan
- Post-incident root cause analysis and corrective action plan delivered within 30 days
- Annual tabletop breach response exercises to keep team readiness current
- Full incident log maintained for regulatory review
Minimum Necessary Standard
Role-based access ensures clinicians see clinical data, billing staff see financial data — and nothing more.
- Role-based access control (RBAC) with predefined roles: dentist, hygienist, front desk, biller, admin
- Custom roles configurable to match your practice's internal access policies
- Clinical PHI (charts, X-rays, notes) restricted to clinical roles by default
- Financial and insurance data restricted to billing and admin roles by default
- Multi-location DSO groups: location staff see only their location's patients by default
- PHI access requests outside role scope require explicit practice-level override and are logged
- Access review reports available quarterly for compliance documentation
Ready to Start? Request Your BAA Today.
Our Business Associate Agreement is available electronically and can be executed before you enter your first patient record. No legal delays — your compliance is covered from day one.
Questions? Contact our compliance team at compliance@updental.com
Frequently Asked Questions
Common HIPAA questions from dental practices evaluating UpDental.
Does UpDental sign a BAA with every dental practice?
Yes, without exception. Before any Protected Health Information is entered into UpDental, we execute a Business Associate Agreement with the dental practice (the Covered Entity). The BAA is available electronically and can typically be signed on day one of your trial or onboarding.
Is our dental practice required to be HIPAA-compliant to use UpDental?
Yes. Dental practices that collect, transmit, or store patient health information electronically are Covered Entities under HIPAA and must comply with all applicable HIPAA rules. UpDental is designed to support your compliance program, but it does not replace the need for your own HIPAA policies, staff training, and Notice of Privacy Practices.
What happens to our patient data if we cancel our UpDental subscription?
Your data is yours. Upon termination, you can request a complete export of all patient and practice data in a standard format (CSV, HL7 FHIR, or X12) within 30 days. Data remains accessible for 90 days post-termination while you transition. After that period, it is securely deleted from our production systems in accordance with our data retention policy.
Has UpDental undergone a HIPAA risk assessment?
Yes. We conduct annual HIPAA risk analyses as required by 45 CFR § 164.308(a)(1). We also undergo annual SOC 2 Type II audits by an independent third-party auditor, which covers security, availability, and confidentiality controls that directly support our HIPAA compliance posture. Risk assessment reports are available to enterprise customers upon execution of a mutual NDA.
What should we do if we believe there has been a security incident involving patient data?
Contact our security team immediately at security@updental.com or call your dedicated account manager. Our incident response team is on call 24/7. We will acknowledge your report within 4 hours, begin investigation immediately, and keep you updated throughout the process. If the incident constitutes a HIPAA Breach of Unsecured PHI, we will provide formal notification within 60 days of discovery, including all information required under the Breach Notification Rule.