What is HIPAA?
HIPAA — the Health Insurance Portability and Accountability Act — requires healthcare providers, including dentists, to protect individually identifiable patient health information (PHI).
Dental Symphony and HIPAA: What you need to know.
When your dental office creates a Dental Symphony account, we become a HIPAA business associate of your practice. That means we are required to safeguard the PHI we handle on your behalf — implementing the required administrative, physical, and technical safeguards, using or disclosing PHI only as our business associate agreement (with you) and the federal rules permit, reporting breaches and security incidents, and ensuring our subcontractors are bound by the same obligations.
What is HITECH?
HITECH — the federal Health Information Technology for Economic and Clinical Health Act — extends HIPAA’s privacy and security requirements to business associates like Dental Symphony.
How does Dental Symphony protect patient data?
Dental Symphony implements comprehensive security measures, including: (a) practice-level isolation — your practice’s data is isolated from other practices through account-level filtering on all database tables; (b) patient-level filtering — users (authorized persons in your practice) see only data for patients they are authorized to access; (c) role-based access control — data visibility is restricted by user role; (d) encryption — data is encrypted in transit (TLS 1.2+) and at rest (AES-256); and (e) HIPAA-aligned infrastructure — our services are hosted on enterprise cloud infrastructure under executed Business Associate Agreements with our infrastructure provider, with continuous compliance monitoring and regular security assessments.
Do we provide a Notice of Privacy Practices on the patient portal?
Yes, we provide a Notice of Privacy Practices (NPP) on your patient portal that you are invited to use. The NPP is a document that explains how the covered entity (your office) may use and disclose a patient’s PHI — which is any individually identifiable health information. An NPP also outlines the patient’s rights regarding their information and the legal duties of the covered entity (again, your office). Patients must confirm they have had the opportunity to review it before using the portal.