Every lock on every door.

Business Associate Agreement

We sign a BAA before any PHI moves. Signed via HelloSign (Dropbox Sign) at the start of onboarding. The BAA names our entity as the Business Associate and your practice as the Covered Entity, covering the 11 mandatory §164.504(e) provisions.

PHI scrubber

Every outbound SMS and email body passes a PHI scrubber (procedure names, diagnoses, sensitive terms) before leaving our servers. Violations block the send and alert the operator — never silently go out.

Consent tracking

We never message a patient without confirmed SMS or email consent. Consent sources, timestamps, and revocations (STOP keywords) are logged as append-only rows in consent_events.

Access control

Database encrypted at rest (WAL-mode SQLite on encrypted volume in dev; PostgreSQL + pgcrypto in production). HTTPS for everything in transit. API keys hashed (never plaintext in DB).

Three gates before any SMS leaves:

• DNC list check — per-client. A STOP reply permanently blocks.
• Daily cap — 1 message per patient per 24h.
• Weekly cap — 3 messages per patient per 168h.

Caps enforced at the database query layer (not just application code). 10DLC registration mandatory before SMS activates — we manage this with Twilio.

Every outbound email includes:

• Physical mailing address (provided by the practice at onboarding)
• Functional one-click unsubscribe link
• Clear sender identification (practice name + domain)

Patient consent is tracked per-channel — SMS consent does not imply email consent.

We charge a flat SaaS fee (never per-patient). This keeps arrangements inside every state's anti-kickback safe harbor. Specific references:

• Florida §817.505 (Patient Brokering Act)
• Florida Rule 64B5-4.002 (existing-patient reactivation is NOT solicitation)
• Equivalent statutes in CA, TX, NY, IL, OH, GA

Our attorney reviewed this structure. A copy of the engagement letter is available under NDA for procurement review.

Status: Type I completed Q1 2026. Type II audit kicks off Q2 2026, targeted completion Q4 2026.

Current evidence (available under NDA for DSO evaluations):

• Change management policy + approval workflow
• Access control policy (role-based)
• Incident response runbook
• Data retention + disposal policy
• Vendor management (Stripe, Twilio, Resend, Anthropic, HelloSign)
• Audit log (append-only, database-trigger-enforced)

Retention schedule

Portability

Every tenant can export their complete dataset at any time via GET /api/v1/patients|campaigns|sends|replies|bookings|audit or a single JSON dump via /onboarding/export. No export fee. No format lock-in.

Deletion on request

Soft-delete at cancellation (30-day reversal window). Hard-delete available on written request. Full deletion confirmation provided.

Documented runbook. Escalation signals wire to the operator console:

• > 1% sends failing in a 10-min window
• > 5% replies classified as "complaint" or "angry"
• Any PHI scrubber failure on an outbound message
• Any patient reply containing STOP suing, lawyer, FCC, or attorney general

Breach notification timeline: 48 hours to the affected practice, 60 days to HHS per HIPAA Breach Notification Rule.

Email security@usdentalpatientrecovery.com. PGP key available on request. We acknowledge within 24 hours, fix critical issues within 72 hours, and publish a post-mortem on /changelog after resolution.

We do not have a bug bounty yet. We do provide public credit (with permission) and will make a donation to a charity of your choice in recognition of meaningful reports.