Security & HIPAA
Protected health information, protected.
OneDMI handles medication lists, diagnoses and lab results. We treat that responsibility as the core of the product.
Safeguards
Designed around the HIPAA Security Rule.
Administrative, physical and technical safeguards, documented and reviewed.
- Business Associate Agreement. Signed with every practice before any data is connected.
- Encryption. TLS 1.2 or higher in transit; AES-256 at rest, including stored API credentials.
- Access control. Role-based permissions, multi-factor sign-in and automatic session timeouts.
- Minimum necessary. OneDMI requests only the record types it needs for dental risk review.
- Audit logging. Every view, sync, alert and acknowledgement is logged with user and time.
- U.S. hosting. Data is stored and processed in U.S. data centers.
- No model training on your data. Patient information isn't used to train AI models.
Your controls
Your practice decides who sees what.
| Role | Can see | Can do |
|---|---|---|
| Dentist | Full profile and all alerts for their patients | Acknowledge alerts, add chart notes |
| Hygienist / Assistant | Medications, allergies and active alerts | Confirm pre-op checklist items |
| Front office | Sync status and premedication reminders | Request records, manage patient matches |
| Group admin | De-identified reporting across locations | Manage users, connections and settings |
Need our security documentation?
We'll send our BAA, security overview and data-flow diagram for your compliance review.