Compliance
HIPAA compliance for patient reactivation — what your attorney will ask.
10 min read · 2026-04-19
Before a dental practice signs a contract with a reactivation vendor, the practice's attorney (or practice administrator acting as HIPAA Privacy Officer) will run a checklist. This post is that checklist — written in a form you can paste into an email to your counsel, with the specific text they'll want to see.
We'll walk through each item and show exactly what usdpr. provides, including where the control is enforced in code (not just policy).
1. Business Associate Agreement (BAA)
HIPAA §164.504(e) requires a BAA between the Covered Entity (your practice) and any Business Associate (vendor) that creates, receives, maintains, or transmits PHI on behalf of the practice. A reactivation vendor touching patient name + contact info + last-visit date is a Business Associate. No BAA, no PHI.
usdpr. BAA provides:
- All 11 mandatory §164.504(e) provisions
- Signed via HelloSign (Dropbox Sign) at onboarding — before any PHI moves
- Sub-processor transparency (Twilio, Resend, Anthropic, AWS all BAA-covered)
- Breach-notification SLA: 48h from confirmed breach to affected Covered Entity
2. PHI in the message body
PHI in outbound messages is the biggest unforced error in dental marketing. A message body that says "Hi Marcus, time for your crown prep" turns a compliant reminder into a PHI disclosure to whoever's holding the phone. The fix is a blocklist + code-level enforcement.
usdpr. PHI scrubber:
- Runs on every rendered message body before it leaves our servers
- Blocks procedure names, diagnoses, tooth numbers, specific treatment codes
- Violations abort the send and alert the operator — never silently go out
- Voice-profile templates validate at load time so nothing violating ever enters production
Ask any vendor: "What happens if one of your templates accidentally includes a procedure name? Show me the code that prevents it from being sent." If they don't have an answer, the compliance is aspirational.
3. Consent tracking — SMS vs. email
TCPA (phone/SMS) and CAN-SPAM (email) each require prior consent, tracked with timestamps and source. Consent isn't fungible — SMS consent doesn't imply email consent and vice versa. Revocations (STOP replies, unsubscribe clicks) are permanent for that channel, per-practice.
usdpr. consent handling:
- Per-channel consent flags:
sms_consent + email_consent with independent sources and timestamps
- Append-only
consent_events table logs every grant + revocation
- STOP reply: DNC entry written synchronously +
consent_events revocation row
- Upgrade-only: a new CSV upload can add consent but cannot silently remove it
4. Audit log — every send, every reply, every booking
HIPAA §164.312(b) requires audit controls "to record and examine activity in information systems containing PHI." In practice, this means every mutation of patient data is logged, and the log is tamper-evident.
usdpr. audit log:
audit_log table is append-only — database trigger blocks UPDATE and DELETE- Every send, reply, booking, and settings change writes a row
- 7-year retention (HIPAA minimum is 6; we add a margin)
- Exportable any time via
GET /api/v1/audit, tenant-scoped
5. Rate limits — TCPA + CAN-SPAM
47 CFR 64.1200 (TCPA) allows B2C SMS with prior express written consent but provides no specific cadence rule. Industry convention — and litigation-risk minimum — is 1 SMS per 24h and 3 per week per recipient. usdpr. enforces both at the database query layer, not in application logic (so a bug in the dispatcher can't accidentally over-send).
usdpr. rate limits:
- 1 SMS per patient per 24-hour window
- 3 SMS per patient per 168-hour (weekly) window
- Enforced via atomic counter reads in the send pipeline, not advisory
- Email: same 1/day + 3/week courtesy caps (stricter than CAN-SPAM requires)
6. Anti-kickback / patient brokering
State statutes like Florida's §817.505 make per-patient payments to a marketing vendor a felony. If a reactivation vendor charges per rebook, per booking, or "only pay when we deliver," they're walking you into a liability. Flat SaaS fees are the compliant structure.
Read more: Why flat-fee SaaS beats per-patient pricing.
7. Breach notification clock
HIPAA Breach Notification Rule (§164.400–414) requires:
- Notification to affected individuals within 60 days of breach discovery
- Notification to HHS within 60 days for breaches affecting ≥500 individuals (within calendar year for <500)
- Notification to prominent media outlets for breaches affecting >500 residents of a state
usdpr. incident response:
- SEV-1 detection → page the on-call within minutes
- Notification to the practice within 48 hours of confirmed breach (well inside the HIPAA window)
- Full post-mortem published to the tenant within 5 business days
- Attorney of record on retainer for breach-response coordination
8. Data retention + disposal
HIPAA minimum is 6 years for records of disclosures. Most dental practices keep 7+ to align with state medical-records retention. Vendors should match practice retention — not force a shorter window.
usdpr. retention:
- 7 years active + encrypted archive for patient records, sends, replies, bookings
- Append-only audit log: permanent retention during active engagement + 7 years post-termination
- Hard-delete available on written request (logged to audit trail)
- Complete tenant export anytime via
/onboarding/export, no fee
9. Encryption at rest + in transit
- At rest: WAL-mode SQLite on encrypted volume in dev; PostgreSQL + pgcrypto in production; AWS S3 + KMS for backups
- In transit: TLS 1.2+ for all public endpoints; HSTS on marketing domain; HTTPS-only webhook endpoints
- Secrets:
SecretStr at the Settings layer, never logged, never serialized
10. SOC 2 Type II (evidence your attorney asks for second)
HIPAA compliance and SOC 2 are not the same thing, but procurement teams often request SOC 2 as evidence of operational maturity around HIPAA. Status at usdpr.: Type I complete Q1 2026, Type II audit in progress, target attestation Q4 2026. Full evidence pack in /security.
Disclaimer. This post is educational, not legal advice. HIPAA interpretation depends on your specific arrangement, state law, and fact pattern. Every practice should have the vendor's BAA reviewed by its own attorney. usdpr. provides the underlying controls; your attorney provides the legal opinion.
Keep reading: The $50k/90-day math · 5 patient segments · Flat-fee vs per-patient