Built for HIPAA

The Business Associate is UCPlaces LLC, 303 Maple Ave W, Suite F, Vienna, VA 22180 (info@dentalslip.com). A Business Associate Agreement is in the product and is accepted by an owner or administrator. Data is encrypted in transit and at rest, and staff sign in with a password plus an authenticator app. DentalSlip is not HIPAA certified. HHS does not certify products, and implementing these controls does not by itself make a deployment compliant.

What the product does

• Argon2id passwords, expiring single-use reset links, and generic responses that do not reveal whether an email is registered.
• Sessions in HttpOnly cookies, a 60-minute inactivity timeout, a 12-hour absolute timeout, and CSRF checks on office actions.
• Each office’s records are separated in the database, including row-level policies, and tested so one office cannot read another.
• Referral pages, PDFs, and emails omit patient details from addresses, logs, and notification text.
• An audit log records sign-in, publishing, referral opens, downloads, amendments, and status changes without storing the clinical body.
• Breach notice to the office is within 30 calendar days of discovery, as the BAA states. Not every security event is a reportable breach.

How long records are kept

DentalSlip is not the office’s official chart. An owner or administrator chooses when submitted referrals are deleted: 1 year, 3 years (the default), 7 years, or never, measured from the submission date. That cleanup covers the submission, attachments, notes, and status history. Choosing never still allows deletion after cancellation or termination of the BAA. About 30 days before an age-based date, the dashboard and an email to owners and administrators say how many referrals are due and link to an export. The email does not include patient information. Automatic cleanup pauses during an open export period.

When a subscription ends or the BAA is terminated, forms stop taking new submissions. The office has 90 days of read-only access to export a ZIP of PDFs, uploads, amendments, and a spreadsheet. On day 90 the remaining referral content is deleted. Signing back up during the 90 days cancels a cancellation window. Unpaid or disputed fees do not turn off review or export. A platform admin can see the scheduled date and extend it.

Each deletion leaves a record with the office, the categories deleted, and the date, and no referral content. Backups of that content expire within 7 days. A deletion certificate lists those facts and the backup-expiry date. BAA versions and acceptance records, deletion records, disclosure-accounting records, and security and activity logs are kept for 6 years and then removed. That 6-year period is this product’s retention policy. It does not claim that HIPAA requires every activity log to be kept for 6 years.

Before real patient data

The BAA is in the product, breach notice is 30 calendar days, and the retention schedule above is in place. Production still needs subprocessors under their own agreements, a risk analysis, and hosting that will sign a BAA. This page is not a certification and not a legal opinion. Read the BAA and the privacy notice.

Security contact: use the contact form and choose Security. Do not attach patient records.