A vendor’s website says “HIPAA compliant” in a green badge. You have no way to check it, and neither does anyone else, because HHS certifies nobody. This page says what Calibic actually is under HIPAA, what it holds, and what it promises in writing.
Does HIPAA apply to my dental records?
Yes. A dental practice that sends claims, eligibility checks or referrals electronically is a covered entity. Its patient records are protected health information, PHI, whether they sit in Open Dental, in a filing cabinet or in a vendor’s cloud. Any company that creates, receives, stores or transmits that PHI on your behalf is a business associate and must sign a Business Associate Agreement with you before it touches the data.
What is Calibic under HIPAA?
Your business associate. The agent on your server reads your practice database and sends records to the Calibic cloud, where they are stored and used to build the lists, dashboards and audit trail. A vendor holding PHI is a business associate even if no person at the vendor ever looks at a record. We say this plainly because some vendors avoid the phrase.
We do not say “HIPAA certified” or “HIPAA compliant software”. There is no certification. Compliance belongs to the covered entity and its business associates together, through safeguards, agreements and conduct. What we can say is: built for HIPAA, a Business Associate Agreement sent with every sign up and accepted during setup.
What PHI does Calibic hold?
More than “just numbers”, and you should know exactly what.
- Patient identity: name, date of birth, gender, phone, email, address.
- Appointments, including history and status changes.
- Treatment plans and completed procedures, with codes, dates and amounts.
- The ledger: payments, adjustments, claims and balances, with the before and after values of changes for the audit trail.
- Insurance details, including the last four digits of a subscriber id.
- Conditions, allergies and medications, which feed the patient card.
What is not read: the text of clinical notes, card numbers and bank account numbers. Calibic never processes a patient payment.
Every query in the cloud is scoped to your account and location, so one practice’s data is never returned to another. This is logical separation in one shared database, not a dedicated database per practice.
What does the BAA commit Calibic to?
The agreement is sent with every sign up and accepted at setup. In plain terms it says:
- PHI is used only to provide the service to you, never sold, never used for advertising.
- Safeguards are in place to protect it; the Security page describes them without marketing words.
- If PHI is exposed, you are notified within the period stated in the agreement.
- Subcontractors that handle PHI are bound by their own agreements.
- When you leave, your data is deleted on request, and backups roll off on their own schedule.
How do the AI features touch PHI?
Ask answers questions from your synced data. When the answer is a list of specific patients, for example unbooked treatment, patient names and amounts are included in what is sent to the model. Reminder drafts send a first name, the office name, an amount, a carrier and a deadline. Both run on Azure OpenAI, and Microsoft states that prompts and completions are not used to train its models. AI can be turned off in Settings under AI Agent, and Ask, briefs, lists and drafts honour that switch.
Audio briefs contain office-level figures and the office name, not patient names. Review replies are drafts you read and post yourself, and they must never confirm that someone is a patient.
What should I ask any vendor, including us?
- Are you my business associate, and will you sign my BAA or send yours before I connect anything?
- Exactly which fields do you store? Ask for the list, not a category.
- Can your software write to my practice system? Calibic cannot; see why read-only is safer.
- Which subcontractors see PHI, and do they have BAAs?
- What happens to my data when I leave?
Next step: read the Security page for the controls behind these commitments, or see what the audit trail in Protect does with the change events we hold.