What “built for HIPAA” means — and what it does not

Dental offices that are covered entities need a business associate agreement before a vendor holds patient information for them. DentalSlip includes a BAA for that relationship. Signing it is a record of the agreement. It is not a claim that the practice is HIPAA compliant.

There is no official HIPAA certification from HHS. A product can be built for the HIPAA Security Rule — access control, audit logs, encryption in transit and at rest, and a process for incidents — and still need policies, training, and a risk analysis before real patient data is collected.

DentalSlip keeps patient details out of email, out of web addresses, and out of the payment processor. Staff sign in with a password and an authenticator app. Referring offices do not get an account, and a receipt link is short-lived and cannot list other referrals.

The practice still decides who on staff should see referrals, how long to keep records, and how printed copies are handled at the front desk. Those are customer responsibilities. The software can support them. It cannot guarantee them.

Before production use, the BAA text, retention rules, and launch wording should be reviewed by qualified counsel. This article is an explanation of the product stance, not legal advice.