Three of usdpr.'s internal compliance modules — PHI scrubber, TCPA rate limiter, HIPAA audit-trail — are being open-sourced under Apache-2.0. Any dental-tech developer can use them. They're the same code we run in production. pip install usdpr-compliance · Q2 2026.
Python library that enforces HIPAA Privacy Rule compliance on outbound message bodies. Flags procedure codes (CDT/CPT), tooth numbers, diagnosis terms, chart references, and insurance claim IDs. Wraps your send function with @scrubbed and rejects any message containing PHI. ~0.4ms overhead per message.
Enforces the TCPA case-law-safe SMS rate limits (1/day, 3/week per patient) at the database-query layer. SQLite + Postgres drivers. Extends to any message table with a recipient-id column. Works with Twilio, Bandwidth, Vonage, Plivo, or any custom SMS gateway. Prevents 99% of known TCPA class-action trigger patterns.
Append-only audit log with 7-year retention, immutable row hashing, and HMAC-signed export for SOC 2 evidence. Captures every access, send, view, and export of PHI. Integrates with Postgres, SQLite, and via middleware with FastAPI/Flask/Django. Opinionated about what HIPAA requires, because it does.
This is the exact API you’ll get. Your function returns an SMS body; the decorator rejects any message that would violate HIPAA. No training, no configuration of what counts as PHI — the library ships with the CDT codes, common tooth-number patterns, and a diagnosis-term gazetteer curated from HHS + state dental-board guidance.
from usdpr.compliance import scrubbed, TCPARateLimit @scrubbed # raises PHIViolation if body contains procedure codes, tooth #s, etc. @TCPARateLimit(max_per_day=1, max_per_week=3) # enforced at DB layer def send_patient_sms(patient_id: str, body: str) -> None: twilio.messages.create(to=patient_id, body=body, from_="+18005551234")