Built for HIPAA

A signed Business Associate Agreement is included with the subscription. Data is encrypted in transit and at rest, and staff sign in with a password plus an authenticator app. DentalSlip is not HIPAA certified. HHS does not certify products, and implementing these controls does not by itself make a deployment compliant.

What the product does

• Argon2id passwords, expiring single-use reset links, and generic responses that do not reveal whether an email is registered.
• Sessions in HttpOnly cookies, inactivity and absolute timeouts, and CSRF checks on office actions.
• Each office’s records are separated in the database, including row-level policies, and tested so one office cannot read another.
• Referral pages, PDFs, and emails omit patient details from addresses, logs, and notification text.
• An audit log records sign-in, publishing, referral opens, downloads, and status changes without storing the clinical body.

Before real patient data

Production needs a reviewed BAA, subprocessors under their own agreements, a risk analysis, and hosting that will sign a BAA. The copy in this app is the product text for review. It is not a legal opinion. Read the BAA and the privacy notice.

Security contact: use the contact form and choose Security. Do not attach patient records.