© 2026 Intake Dental. All rights reserved.
Built with care for dental practices.
HIPAA's Security Rule lays out specific technical and administrative safeguards covered entities and their business associates must implement. Here is how Intake.Dental meets each one — and where we exceed.
Field-level encryption with per-record Data Encryption Keys for forward secrecy. Envelope encryption via a central Key API with tenant isolation via Additional Authenticated Data. HMAC integrity verification and 128-bit IV / auth tags per record.
Every account ships with our proprietary polyglottal cipher applied on top of AES. The resulting glyph strings resist frequency analysis and are engineered to remain safe against future quantum attacks.
Every practice that registers on Intake.Dental automatically receives an executed BAA at no additional cost. It covers digital forms, PDF storage, teledentistry, PMS integration, insurance verification, and patient communications. The platform is operated by Dental Education, Inc., and parallel BAAs are maintained with every sub-processor.
If a confirmed security incident affects your practice, you will receive a detailed incident report and immediate remediation plan within 72 hours — not 60 days, not "when we finish our investigation."
State dental boards and malpractice carriers treat the dentist's signature on a patient health history as standard of care — Michigan codifies it in R 338.11120, California enforces it through CDA guidance, and most other states expect it through board rules or carrier contracts. Intake.Dental applies the doctor's e-signature to every completed intake with a cryptographic timestamp and audit trail, so the compliance box is checked before it ever becomes a question.
Yes — every practice that registers on Intake.Dental automatically receives an executed BAA at no additional cost. The BAA covers digital forms, PDF storage, teledentistry, PMS integration, insurance verification, and patient communications. We also maintain parallel BAAs with every sub-processor we use.
All Protected Health Information is double-encrypted by default: first at the field level using AES-256-GCM with per-record Data Encryption Keys (DEKs) for forward secrecy, then wrapped in our proprietary Glyph Cipher — a polyglottal layer resistant to future quantum attacks. Both layers are included on every account. Keys use envelope encryption with tenant-isolated derivation.
We notify affected practices within 72 hours of a confirmed security incident with a detailed report and remediation plan. Because every account ships with dual-layer encryption (AES-256-GCM + Glyph Cipher), your records may qualify for the HIPAA Breach Notification Rule's encryption safe harbor exception under 45 CFR § 164.402 — but we notify regardless. Transparency over loopholes.
We run on AWS infrastructure that is SOC 2 Type II certified. Our database layer (Supabase) is also SOC 2 Type II. Our own application code is designed around HIPAA's Security Rule and audited on an ongoing basis.
Yes — HIPAA consent documents and Notices of Privacy Practices are available in 29+ languages automatically, so every patient can acknowledge in the language they actually read.
Every Intake.Dental account ships with an executed BAA, field-level AES-256-GCM encryption, SOC 2 infrastructure, and 9 HIPAA safeguards — all exceeded, not merely met.
Reach out to our compliance team and we'll walk you through the specifics for your practice.
AES-256-GCM field-level encryption, audit logging, access controls, and infrastructure posture.
