Intelligent Intake. Effortless Care.
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting patient health information. As a dental software vendor that processes Protected Health Information (PHI), IntakeIQ operates as a Business Associate and is directly subject to HIPAA requirements.
Covered Entity (CE): The dental practice — they collect and maintain patient records and submit claims to insurers. Every dental practice is a Covered Entity under HIPAA.
Business Associate (BA): IntakeIQ — we create, receive, maintain, or transmit PHI on behalf of the Covered Entity. As a BA, we are directly liable for HIPAA compliance under the HITECH Act and must meet the same Security Rule standards as the practice itself.
HIPAA requires a written BAA between every Covered Entity and Business Associate before any PHI is shared. IntakeIQ executes a BAA with every customer before onboarding begins.
Our BAA covers: permitted uses and disclosures, safeguard requirements, breach notification obligations, subcontractor requirements, PHI return/destruction upon termination, and audit cooperation.
The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI). Below is IntakeIQ's implementation status for each safeguard category.
The HIPAA Privacy Rule governs how PHI is used and disclosed. As a Business Associate, IntakeIQ may only use PHI as permitted by the BAA and for the specific purposes outlined below.
IntakeIQ only accesses the minimum amount of PHI necessary to perform intake automation services. Our system architecture enforces this principle:
Patients retain all HIPAA rights over their PHI. IntakeIQ supports practices in fulfilling these rights:
In the event of a breach of unsecured PHI, HIPAA requires notification to affected individuals, HHS, and (for breaches of 500+ records) the media. IntakeIQ maintains a rigorous incident response plan.
If a breach of unsecured PHI is discovered, IntakeIQ must notify the affected Covered Entity (dental practice) without unreasonable delay and no later than 60 days after discovery. The practice then notifies affected patients within the same 60-day window.
For breaches affecting 500+ individuals in a single state/jurisdiction, the practice must also notify prominent local media. For breaches affecting fewer than 500, an annual log is submitted to HHS.
Automated monitoring detects anomalous access, data exfiltration, or system compromise. Security team receives immediate alert. Incident is logged and classified (severity 1-4).
Affected systems are isolated. Access credentials are rotated. Forensic data is preserved. Preliminary scope assessment: what data, how many records, what systems.
Root cause analysis. Full scope determination. Engagement of external forensic firm if needed. Legal counsel reviews breach determination (was PHI actually compromised?).
If breach is confirmed: notify all affected Covered Entities (dental practices) with full details. Provide template patient notification letters. Coordinate with practices on timing and messaging.
Fix the vulnerability. Update security controls. Document lessons learned. Update incident response plan. Brief all customers on security improvements made.
Security is foundational to IntakeIQ's architecture — not a feature added after the fact. Every layer of our stack is designed to protect PHI.
| Layer | Standard | Details |
|---|---|---|
| Data in Transit | TLS 1.3 | All browser, API, and PMS sync connections. HSTS enforced. Certificate pinning for mobile. |
| Data at Rest (Database) | AES-256 | Full database encryption via AWS RDS. Encryption keys managed by AWS KMS with annual rotation. |
| Data at Rest (Files) | AES-256 | Insurance card images, uploaded documents encrypted in S3 with server-side encryption. |
| Field-Level Encryption | AES-256-GCM | SSN, date of birth, and insurance member IDs encrypted at the application layer before database write. |
| Backups | AES-256 | Automated daily backups encrypted and stored in a separate AWS region. |
| API Keys / Secrets | AWS Secrets Manager | No secrets in code. All API keys, PMS credentials, and tokens stored in encrypted vault. |
| Role | PHI Access Level | Example Users |
|---|---|---|
| Practice Admin | Full — all patients at their location(s) | Office manager, practice owner |
| Provider | Assigned patients only — chair-side summary | Dentist, hygienist |
| Front Desk | Demographics + insurance — no medical flags | Receptionist, scheduling coordinator |
| IntakeIQ Support | Metadata only — no PHI content without consent | Customer success, support engineers |
| IntakeIQ Engineering | Anonymized / tokenized data only in production | Developers, QA engineers |
| Security Admin | Audit logs + access management (not PHI content) | CISO, security engineers |
SOC 2 Type II certification demonstrates that IntakeIQ's security controls are not just designed well (Type I) but have been operating effectively over time (Type II). This is the gold standard for SaaS security assurance.
Engage SOC 2 advisory firm. Gap analysis against Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality). Remediate gaps in policies, procedures, and technical controls.
Point-in-time assessment of control design. Auditor confirms controls are suitably designed. Report issued to customers and prospects under NDA. Addresses: "Are the right controls in place?"
6-month continuous monitoring period for Type II. Auditor reviews evidence of control operation: access logs, change management records, incident response tests, vulnerability scan results.
Type II report confirms controls have been operating effectively over the observation period. Report available to all customers and prospects. Annual renewal thereafter.
A SOC 2 Type II report means an independent auditor has verified that IntakeIQ protects your data according to industry-leading standards — not just on paper, but in practice, over time. For DSOs and enterprises that require vendor security certifications, our SOC 2 report satisfies the most common security questionnaire requirements and dramatically reduces vendor risk assessment timelines.
Pediatric dental practices must comply with both HIPAA and COPPA (Children's Online Privacy Protection Act) when collecting information from patients under 13. IntakeIQ has built-in safeguards for pediatric intake.
COPPA applies when a platform collects personal information directly from children under 13. In dental intake, the child is typically the patient but the parent/guardian completes the forms. IntakeIQ enforces this workflow:
IntakeIQ's pediatric workflow is specifically designed for the parent-child relationship in dental intake:
Several states impose data protection requirements beyond federal HIPAA standards. IntakeIQ complies with the most restrictive state laws to ensure coverage for all US customers.
The California Consumer Privacy Act (as amended by CPRA) grants California residents broad data rights. While HIPAA-regulated PHI has a partial exemption, IntakeIQ takes a conservative approach:
Texas has both a general data privacy act (TDPSA, effective 2024) and a health-specific law (HB 300) that imposes stricter requirements than federal HIPAA:
New York's SHIELD Act expanded the definition of private information and imposed data security requirements on any company holding NY residents' data:
IntakeIQ's standard Business Associate Agreement covers the following areas. Full BAA is provided during the sales process and must be executed before any PHI is transmitted.
The 10 most common questions we hear from dental practices about data security and compliance.
Yes. IntakeIQ was built from the ground up as a HIPAA-compliant platform. We execute a Business Associate Agreement (BAA) with every customer, encrypt all PHI at rest (AES-256) and in transit (TLS 1.3), maintain comprehensive audit logs, and enforce role-based access controls. Our SOC 2 Type II certification is in progress (target: Q1 2027).
Yes — always. We provide our standard BAA during the sales process, and it must be fully executed before any PHI is transmitted to our platform. We also ensure our subcontractors (AWS, Twilio, clearinghouses) have BAAs in place.
All data is stored on HIPAA-eligible AWS infrastructure in US-based data centers (US-East-1 and US-West-2). No data is stored outside the United States. We do not use shared hosting or multi-tenant databases without encryption isolation.
Your staff sees patient data according to their role. Practice Admins see everything for their location(s). Providers see assigned patients. Front desk staff see demographics and insurance but not medical risk flags. IntakeIQ support staff can only access metadata (not PHI content) unless your admin grants explicit temporary access for troubleshooting.
Upon cancellation, you have a 90-day window to export all your data (we provide a full encrypted export). After 90 days, all PHI is cryptographically destroyed — encryption keys are permanently deleted, rendering the data unrecoverable. You receive a certification of destruction for your records.
Insurance card images are encrypted immediately upon upload (TLS 1.3 in transit, AES-256 at rest in S3). OCR processing happens in memory — the image is read, data is extracted, and the processing memory is cleared. The original image is retained only as long as your practice's retention policy requires (configurable). Images are never shared or used for any purpose beyond your practice's intake workflow.
No. IntakeIQ's AI models are never trained on customer PHI. Our models are trained on de-identified, synthetic, and publicly available medical data. When our AI processes your patients' medical histories, it operates in inference mode only — data flows through the model but does not update it. No PHI is retained in the model.
IntakeIQ maintains a formal incident response plan (see Section 4). If a breach of unsecured PHI is discovered, we will notify your practice within 30 days with full details: what happened, what data was involved, what we're doing about it, and what you should tell your patients. We also provide template patient notification letters and coordinate with your legal team.
Yes. IntakeIQ complies with CCPA/CPRA (California), HB 300 (Texas), SHIELD Act (New York), and other state-specific requirements. We apply the most restrictive standard across all states so that every customer — regardless of location — benefits from the highest level of data protection.
Yes. Enterprise and DSO customers can request our SOC 2 report (when available), review our security documentation, and submit security questionnaires. We respond to standard formats including SIG Lite, CAIQ, and custom questionnaires. For enterprise accounts, we also support on-site or virtual security assessments by your team or a third-party auditor.