HIPAA Policy

Last updated: July 27, 2026

1. Our Role Under HIPAA

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act, DentShieldAI LLC operates as a Business Associate to dental practices (Covered Entities). As a Business Associate, we are directly obligated to comply with the HIPAA Security Rule and the applicable provisions of the HIPAA Privacy Rule when handling Protected Health Information (PHI) on behalf of our customers.

PHI in the context of DentShieldAI may include patient names, dates of service, or treatment codes that appear in financial transaction records analyzed by our platform.

2. Business Associate Agreement (BAA)

A signed BAA between DentShieldAI and your practice is required before connecting or uploading any practice data. The BAA defines each party's responsibilities regarding PHI, including how it is used, safeguarded, and disclosed.

To request a BAA or ask questions about the agreement, contact us at hello@dentshieldai.com. We will send you the agreement within one business day. You must not connect your practice management software or upload transaction data until the BAA is fully executed.

3. What Data We Access

DentShieldAI accesses financial and ledger transaction data from your practice management software for the sole purpose of detecting anomalous patterns. This may include:

• Transaction dates, amounts, and descriptions
• Payment types and adjustment codes
• Provider and staff identifiers associated with transactions
• Patient account identifiers (not names or clinical data)

DentShieldAI does not access clinical records, treatment notes, x-rays, or patient health histories. Our analysis is limited to financial transaction data.

4. Technical Safeguards

DentShieldAI implements the following technical safeguards in compliance with the HIPAA Security Rule:

5. Administrative Safeguards

In addition to our technical controls, DentShieldAI maintains the following administrative safeguards:

• Security Officer: A designated individual is responsible for overseeing HIPAA compliance and security policies.
• Workforce Training: All team members with access to PHI receive HIPAA training.
• Incident Response: We maintain a written incident response plan. In the event of a breach involving PHI, we will notify affected practices within 60 days as required by HIPAA.
• Risk Analysis: We conduct periodic risk assessments to identify and address vulnerabilities in our systems.

6. Breach Notification

In the event of a security breach involving unsecured PHI, DentShieldAI will:

• Notify affected Covered Entities (dental practices) within 60 calendar days of discovering the breach
• Provide details of what PHI was involved, who may have accessed it, and what steps are being taken
• Cooperate fully with the Covered Entity's own breach notification obligations to patients and HHS

To report a suspected security incident, contact us immediately at hello@dentshieldai.com.

7. Subcontractors and Subprocessors

DentShieldAI uses the following subprocessors that may have access to data in the course of providing the Service:

• Vercel — Cloud infrastructure and hosting
• Sikka Software — Practice management software data connection
• Clerk — User authentication

Each subprocessor is evaluated for HIPAA compliance and, where required, enters into appropriate data processing agreements. We do not use subprocessors that sell or share your data for their own purposes.

8. Patient Rights

DentShieldAI does not maintain a direct relationship with patients. All patient rights under HIPAA (access, amendment, accounting of disclosures, etc.) are managed by the dental practice as the Covered Entity. If you are a patient with questions about how your data is used, please contact your dental practice directly.

9. Contact Our Privacy & Security Team

For HIPAA-related questions, BAA requests, or to report a security concern: