How we protect patient data

Crest handles protected health information (PHI) for dental practices, so HIPAA applies to everything we do from the first client. These are the controls we run today. Questions from your compliance team are welcome at [email protected].

Agreements first

• We sign a Business Associate Agreement (BAA) with every practice before any patient data is shared with us.
• We hold BAAs with every vendor that stores or processes patient data for us: our cloud provider (AWS, which also covers the AI models we run through Amazon Bedrock) and our clearinghouse.
• A practice cannot be switched on in our system until its BAA is on file.

Where data lives

• Patient data is stored only in our AWS environment, under the AWS Business Associate Addendum, using HIPAA-eligible services.
• Databases, file storage and backups are encrypted at rest with keys managed in AWS KMS. All traffic is encrypted in transit with TLS.
• Our development and test systems use made-up data only. Real patient data never leaves production.

Who can see what

• Every account is created by invitation. Nobody can sign up on their own.
• Two-step sign-in is required for every Crest staff account.
• Billers see only the practices assigned to them. This is enforced in the database itself, so a mistake in application code cannot show one practice’s records to someone working on another.
• Practice staff who use the client portal see only their own practice.
• Sessions end after 15 minutes without activity and after 12 hours in any case. Deactivating an account signs it out everywhere at once.
• Passwords are stored only as salted hashes. Practice software and payer credentials are kept encrypted, one per connection, never shared.

A record of every access

• Every sign-in, failed sign-in, record viewed and change made is written to an audit log with who, when and from where.
• The log is append-only: the database refuses any attempt to edit or delete an entry.
• Infrastructure changes are recorded separately in AWS CloudTrail, and Amazon GuardDuty watches for threats.

AI with a person in charge

• AI models read EOB documents, classify denials and draft appeals. They run in our AWS account through Amazon Bedrock, covered by the AWS BAA. Patient data is not used to train them.
• A billing specialist reviews every appeal before it is sent, and every payment the software cannot match exactly.

People and process

• Everyone at Crest completes HIPAA training before getting access, and again each year.
• We keep a written breach response plan. If an incident affects your patients’ data, we notify you without unreasonable delay, as HIPAA and our BAA require.

Reporting a security issue

If you believe you have found a vulnerability, email [email protected] with the subject “Security”. Please do not access or change data that is not yours.