Patient data protected by design
We are your business associate under HIPAA. Here is how Dentrova meets the Security Rule — and what stays your responsibility as the covered entity.
Administrative safeguards
- Signed Business Associate Agreement with every practice before PHI is stored
- Business associate agreements with every subprocessor that handles PHI
- Workforce HIPAA training, least-privilege access and sanctions policy
- Documented risk analysis, incident response and contingency plans
- Operators manage subscriptions only and have no login to any practice
Physical safeguards
- Hosted in Microsoft Azure data centers in the United States
- Azure's physical access controls, environmental protection and media destruction
- No patient data on our laptops or in email
Technical safeguards
- A separate PostgreSQL database and login for every practice
- TLS 1.2+ in transit; AES-256 encryption at rest
- Per-practice key for the most sensitive fields, held under a master key in Azure Key Vault
- Unique user logins, role-based access, mandatory 2-step sign-in for admins
- Automatic sign-out after inactivity; lockout after repeated failed sign-ins
- Append-only audit log of access to and changes of patient records
Breach notification
- Monitoring and alerting on suspicious sign-in activity
- Notification to the practice without unreasonable delay and within 10 days of discovery
- Information and support so the practice can notify patients and HHS
Your practice's data never shares a database
Many systems keep every customer in the same tables. We give each practice its own database with its own login, its own private file containers and its own encryption key, so one practice can never read another's records — and cancelling destroys exactly one database.
- Database
- Dedicated PostgreSQL database and role per practice
- Files
- Private blob containers per practice, served only after a permission check
- Keys
- Per-practice field key, wrapped by a Key Vault master key
- Backups
- Automated, geo-redundant, 35-day point-in-time restore
- Region
- Microsoft Azure, United States
- Telemetry
- No request bodies or SQL text — no PHI in logs
Shared responsibility
HIPAA compliance is shared. These are the parts only your practice can do.
People
Designate privacy and security officers, train staff, give each person their own login and remove access promptly when someone leaves.
Policies
Publish your Notice of Privacy Practices, complete your own risk assessment, and set record retention for your state in Admin > Settings.
Partners
Sign your own BAAs with the services you connect — your clearinghouse (e.g. Stedi), labs and any email or text provider you choose.
Found a vulnerability? Email security@softwaresolutionla.com. Please do not include patient information.