Minimum necessary
We use PHI to analyze the denial, find supporting images or codes, and build a resubmission package. We do not sell patient data or use it for marketing.
HIPAA
Patient information stays in the practice’s control.
HIPAA is the U.S. rule set for how health information may be used, shared, stored, and protected. ClaimMend treats denial letters, claim numbers, patient identifiers, and radiographs as protected health information (PHI). We sign a Business Associate Agreement before an office goes live.
What HIPAA actually covers
Sharing patient data is part of it — who may see a name, a claim, an x-ray, and for what purpose. It is also how that information is locked down, who is allowed in, what happens if something leaks, and the written contract between the dental office and any vendor that can touch it.
The dental office is a covered entity. ClaimMend is a business associate when we set up, support, or can access the workstation that reads denials. There is no official government “HIPAA certified” badge. Compliance is a program: safeguards, a risk analysis, policies, training, and a signed BAA — not a logo on a homepage.
How ClaimMend is built
Safeguards that match the workflow.
These are the safeguards we provide as your business associate.
Dedicated workstation
ClaimMend is not installed on front-desk or provider PCs. It runs on a machine we set up and manage so access and updates stay in one place.
Encryption and least privilege
Email, Dentrix, and Vyne credentials are encrypted on that workstation. Dentrix setup uses a dedicated read-only user, not a clinician login.
Installed, not downloaded
Network Specs installs ClaimMend after a demo, on a known workstation, under a signed BAA.
You still submit the claim
ClaimMend does not auto-send to Vyne or a payer. Staff review the package. That keeps a person in the disclosure path.
Do not send PHI to this website
The public contact form is for scheduling only. Do not attach denial letters or patient names here. After we are engaged, we use an agreed channel.
What “becoming HIPAA compliant” means for software
Name the role
If the product can create, receive, maintain, or transmit PHI, the vendor is a business associate and needs a BAA with each office.
Protect electronic PHI
A dedicated workstation, unique access, and encrypted credentials, instead of a shared front-desk PC.
Limit use and sharing
Only what the job requires: the denial, the matching image, the code or narrative fix, the export the office submits.
Plan for incidents
If PHI is exposed, HIPAA expects assessment and notice on a short clock. That obligation is written into the BAA.
Ask for the BAA with the demo.
We will walk the safeguards against your Dentrix, Dexis, Vyne, and inbox setup before anything is installed.