ComplyDay is HIPAA compliance software for dental offices. It covers the HIPAA work your office has to document: privacy policies, the security risk assessment, a business associate list, a breach response plan and staff training. It writes each one from your answers, reminds you when a review is due and keeps the records.
ComplyDay never holds patient records. It covers your HIPAA paperwork, not your charts.
What the HIPAA compliance software includes
| Part | HIPAA rule | What ComplyDay does |
|---|---|---|
| Privacy policies | 45 CFR 164.530(i) | Writes your policies for the notice of privacy practices, patient access to records, disclosures and complaints |
| Security risk assessment | 45 CFR 164.308(a)(1)(ii)(A) | Walks you through your computers, software, backups and paper records, lists the risks and tracks each fix |
| Business associate list | 45 CFR 164.502(e) and 164.504(e) | Keeps every vendor that handles patient information, with the date their agreement was signed |
| Breach response plan | 45 CFR 164.400 to 414 | Who decides, how to assess the risk, and the notice deadlines for patients and HHS |
| HIPAA training | 45 CFR 164.530(b) and 164.308(a)(5) | A HIPAA privacy and security course for every staff member, with a certificate |
| Records | 45 CFR 164.316(b) and 164.530(j) | Keeps every version, dated, so you can show what was in effect and when |
The security risk assessment
The Security Rule asks for "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic patient information in your office. ComplyDay asks about each place patient information lives: the front desk computers, your practice management system, imaging, email, backups and phones. It covers paper charts too, which the Privacy Rule requires you to safeguard. It then lists what could go wrong, how likely it is, and the fix, and you mark each fix done.
You get a reminder when the yearly review is due and whenever you tell ComplyDay about a change, such as new software or a new office.
Business associates
Your practice management software, cloud backup, IT company, billing service and shredding company may all handle patient information. HIPAA requires a business associate agreement with each one. ComplyDay keeps the list and the date each agreement was signed, and flags any vendor without one.
If a breach happens
The breach response plan says who decides whether an incident is a breach and how to assess it. For a breach affecting fewer than 500 people, you notify each patient within 60 days of finding it and report it to HHS within 60 days after the end of that calendar year. A breach affecting 500 or more people must be reported to HHS within 60 days too, and to local media if more than 500 residents of one state are affected.
Forms
Your notice of privacy practices, patient acknowledgment and authorization forms are part of your privacy policies. The free HIPAA forms for dental offices are there if you want them on paper today.
One app for HIPAA and OSHA
The same plan covers your OSHA written plans, staff training, sterilizer logs and the inspection binder. See the plans and prices.