Any software that stores, transmits or processes patient information for a US practice must support HIPAA’s Privacy and Security Rules. There is no official “HIPAA certification” — a vendor can only claim compliance and sign a Business Associate Agreement.
On Denture-ID, “HIPAA claimed” means the vendor makes a public, citable statement; it is not an audit.
From our data: 267 of 445 software products we track make a citable HIPAA claim.
What HIPAA requires of dental software
The Security Rule asks for administrative, physical and technical safeguards: unique user logins, role-based access, audit logs, encryption of data in transit and at rest where reasonable, backups and a documented risk analysis. The Privacy Rule governs who may see and share patient information.
Software cannot make a practice compliant on its own. A cloud vendor secures its infrastructure; the practice still controls passwords, user permissions, workstations and staff training.
What to ask a vendor
Ask for a signed business associate agreement, where data is hosted, whether it is encrypted at rest, how access is logged and how long backups are kept. For server-based software, ask what the vendor does and what your IT provider must do.
The four rules in plain language
HIPAA is a set of rules, not a single one. Most day-to-day questions fall under the first two.
| Rule | What it requires | Dental example |
|---|---|---|
| Privacy Rule | Limits how protected health information is used and disclosed, and gives patients rights over their records | Not leaving a detailed message on a voicemail; releasing records to another dentist for treatment |
| Security Rule | Requires administrative, physical and technical safeguards for electronic health information | Unique logins, screen locks, encrypted backups, a documented risk analysis |
| Breach Notification Rule | Requires notice to patients, regulators and in some cases the media after a breach of unsecured information | A stolen laptop or a ransomware attack on the server |
| Enforcement Rule | Sets the investigation process and the civil penalties, which scale with the level of culpability | A complaint from a patient that leads to an audit |
Does it apply to your practice
HIPAA covers health care providers that transmit health information electronically in connection with standard transactions such as insurance claims or eligibility checks. A practice that bills insurance electronically is covered. Most dental offices are, and the safest assumption is that yours is.
Vendors who handle patient data for you are business associates and must sign a business associate agreement. That includes cloud practice management software, texting and reminder tools, AI scribes and receptionists, an outsourced billing company and your IT provider.
Everyday situations in a dental office
Appointment reminders by text or voicemail are allowed if they carry only the minimum necessary details: practice name, date and time. Keep treatment details out.
Patient photos and before-and-after images used in marketing require written authorization. Responding to an online review in a way that confirms the person is a patient discloses protected information; reply in general terms.
Sign-in sheets should not show other patients’ names and reasons for the visit. Screens should not face the waiting room. Records sent by email should be sent through a secure channel or with the patient’s informed agreement.
Patient rights worth knowing
Patients have the right to a copy of their records, generally within 30 days of a request, and may ask that errors be corrected. They can ask for a list of certain disclosures and can ask you to restrict some uses. A fee may only cover reasonable cost of copying.
Medical record retention periods are set by state law and by some dental boards rather than by HIPAA, which requires you to keep HIPAA compliance documents, such as policies and the risk analysis, for six years.
Breaches: what happens next
If unsecured patient information is lost or exposed, the practice must assess the incident and, unless the risk is shown to be low, notify affected patients without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people are also reported to the Department of Health and Human Services and, in many cases, the media. Smaller breaches are reported to HHS yearly.
Encryption makes a difference: information that is properly encrypted is generally not considered “unsecured”, which can remove the duty to notify after the loss of a device.
A short compliance checklist
Complete a security risk analysis and update it when your systems change. Sign business associate agreements with every vendor that sees patient data. Train staff when they join and at least once a year. Use unique logins and remove access promptly when staff leave. Encrypt laptops and backups. Keep written policies and a log of training and incidents.
Compliance programs and training platforms can run much of this for you, but the responsibility stays with the practice. See our category page on HIPAA compliance programs.
Examples
- 3Shape Unite — Cloud collaboration
- Birdeye — Reputation management
- CareStack — Cloud PMS
- Consult-PRO — Patient education
- Dandy — Digital labs
- DentalHQ — Membership plans
Go deeper
FAQ
Is there an official HIPAA certification for software?
No. The US Department of Health and Human Services does not certify products. “HIPAA compliant” is a vendor statement. Independent evidence comes from audits such as SOC 2 Type II or HITRUST.
Does HIPAA apply to texting patients?
Yes, when messages contain protected health information. Use a platform that signs a BAA and records patient consent, rather than a personal phone.
What does HIPAA stand for?
Health Insurance Portability and Accountability Act, a 1996 US law. Its Privacy, Security and Breach Notification Rules govern how health information is protected.
Is a cash-only dental practice covered by HIPAA?
HIPAA applies to providers that transmit health information electronically in standard transactions such as claims. A practice that never does so may not be a covered entity, but state privacy laws still apply and most practices find the safeguards worth following anyway.
Can I text patients?
Yes, for reminders and logistics with the minimum necessary detail, using a tool that signs a business associate agreement and records patient consent. Do not use personal phones or send clinical detail in an ordinary text.
How long do I have to give patients their records?
Generally within 30 days of a request, with a possible 30-day extension if you tell the patient why. State law may be stricter.
What is the penalty for a HIPAA violation?
Civil penalties are tiered by the level of culpability and can be significant for repeated or willful neglect, and criminal penalties apply to knowing misuse. The amounts are adjusted by regulators, so check current figures on the HHS site.