HIPAA Notice
Effective Date: September 30, 2026
This Notice describes how OrthoRecords, as a HIPAA Business Associate, uses, discloses, and protects Protected Health Information (PHI) it handles on behalf of the dental practices that use our platform. It is not a Notice of Privacy Practices from your dental provider: your provider's own notice governs how your dentist uses and discloses your health information, and your provider is the party to contact about your records. Please review it carefully.
Our Role Under HIPAA
OrthoRecords, operated by Pattani Dental PC, functions as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act. We process and store PHI on behalf of dental practices ("Covered Entities") that use our platform, pursuant to a written Business Associate Agreement (BAA).
How PHI May Be Used and Disclosed
Treatment Support
We facilitate storage and retrieval of PHI to support clinical care, documentation, and care coordination among authorized dental providers within your practice.
Healthcare Operations
PHI may be accessed for quality assessment, staff training, auditing, and other legitimate practice management functions, strictly as directed by the Covered Entity.
Required by Law
We may use or disclose PHI when required to do so by federal, state, or local law, including disclosures to law enforcement or government agencies as mandated.
Subcontractors
We share PHI with subcontractors that perform services on our behalf: cloud hosting, storage, and email delivery (Amazon Web Services), AI model providers for the optional AI-assisted features, and insurance clearinghouse services when a practice enables them. Each subcontractor that handles PHI is bound by a written business associate agreement requiring protections at least as strict as those we provide.
AI-Assisted Features
The platform's optional AI features send clinical data to our AI model providers to produce decision support for the treating clinician. Structured prompts never include the patient's name, date of birth, contact details, or record identifiers, referencing age and sex instead. Clinical images and documents are sent only for image- or document-based features, or when a user explicitly includes them, and are handled as PHI. Every AI run is recorded with the user, feature, patient record, and time, and inputs and outputs are never used to train models.
Other Disclosures
We will not use or disclose PHI for any purpose not described in this Notice or our BAA without written authorization from the patient's dental provider or the patient themselves.
Security Safeguards
We maintain comprehensive safeguards to protect the confidentiality, integrity, and availability of all PHI we handle, including: - Encryption of PHI at rest (AES-256) and in transit (TLS 1.2+) - Practice-level data isolation enforced in the data layer, with role-based access controls limiting PHI access to authorized personnel - Two-factor authentication (authenticator app) available to every user and enforceable by each practice for all of its users - Automatic session timeout - Audit logging of changes to patient records and of clinical, financial, and staff-management actions, and of every AI run, recorded with the user, role, action, and time - Encrypted daily and monthly backups, including copies retained in a second AWS region - Regular security risk assessments and vulnerability management - Workforce training and confidentiality obligations - Incident response and business continuity plans
Breach Notification
In the event of a breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay and in no case later than thirty (30) days after discovery, as provided in our Business Associate Agreement — ahead of the 60-day outer limit of the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). Notifications include the information the Covered Entity needs to meet its own notification obligations.
Minimum Necessary Standard
We apply the HIPAA minimum necessary standard and limit access to PHI to the minimum required to perform our services. Access controls ensure that workforce members access only the PHI necessary for their specific role.
Patient Rights
Patients wishing to exercise HIPAA rights — including the right to access, amend, restrict use of, or obtain an accounting of disclosures of their PHI — must contact their dental provider (the Covered Entity) directly. Your dental practice is the responsible party for fulfilling these patient rights requests.
Data Retention and Disposal
PHI is retained for as long as the practice's account is active. After a subscription ends, the practice's records remain available for export for 90 days, during which the practice may direct us to return or destroy its PHI; after that window the data may be permanently deleted. Deleted data may persist in encrypted backups for up to 35 days, and in monthly archival backups for up to 12 months, and remains protected under the BAA until those backups expire. Audit logs and executed Business Associate Agreements are retained for at least six years as HIPAA requires.
Business Associate Agreements
Every dental practice using OrthoRecords must execute a Business Associate Agreement with Pattani Dental PC before storing PHI in the platform. The practice owner reviews and executes the agreement electronically at onboarding, and the executed copy — with the signatory, date, and exact text — is retained and available from Settings at any time. Questions about the agreement: hipaa@orthorecords.com.
Filing a Complaint
If you believe your privacy rights under HIPAA have been violated, you may file a complaint with:
U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 www.hhs.gov/ocr/privacy/hipaa/complaints
You may also contact our Privacy Officer directly. We will not retaliate against any individual who files a good-faith complaint.
Contact Our Privacy Officer
HIPAA Privacy Officer Pattani Dental PC hipaa@orthorecords.com OrthoRecords.com