Any software that stores, transmits or processes patient information for a US practice must support HIPAA’s Privacy and Security Rules. There is no official “HIPAA certification” — a vendor can only claim compliance and sign a Business Associate Agreement.
On Denture-ID, “HIPAA claimed” means the vendor makes a public, citable statement; it is not an audit.
From our data: 233 of 445 software products we track make a citable HIPAA claim.
What HIPAA requires of dental software
The Security Rule asks for administrative, physical and technical safeguards: unique user logins, role-based access, audit logs, encryption of data in transit and at rest where reasonable, backups and a documented risk analysis. The Privacy Rule governs who may see and share patient information.
Software cannot make a practice compliant on its own. A cloud vendor secures its infrastructure; the practice still controls passwords, user permissions, workstations and staff training.
What to ask a vendor
Ask for a signed business associate agreement, where data is hosted, whether it is encrypted at rest, how access is logged and how long backups are kept. For server-based software, ask what the vendor does and what your IT provider must do.
Examples
- 3Shape Unite — Cloud collaboration
- Birdeye — Reputation management
- CareStack — Cloud PMS
- DentalHQ — Membership plans
- DentalMonitoring — Remote monitoring
- Dentulu — Teledentistry
Go deeper
FAQ
Is there an official HIPAA certification for software?
No. The US Department of Health and Human Services does not certify products. “HIPAA compliant” is a vendor statement. Independent evidence comes from audits such as SOC 2 Type II or HITRUST.
Does HIPAA apply to texting patients?
Yes, when messages contain protected health information. Use a platform that signs a BAA and records patient consent, rather than a personal phone.