Consult intake · patient portal
Health history
This is PHI.
Chief concern, medications, allergies, prior surgery — identifiable health information.
Keep: Life of the booking + 6 years (HIPAA accounting window), then delete or de-identify.
US patient files
HIPAA tools for a file that can leave the country.
RatedDocs stores history, pans, and estimates so a US patient can see a dentist abroad. When a US covered entity is in that chain, we are a business associate. Foreign dentists usually are not covered entities — we still run the same controls.
This is a teaching desk and an ops console. It is not a legal opinion and not a certification badge.
Same lock everywhere
A Cancún consult gets the same encryption and access log as a Texas one.
BAA only when the law asks
US group or US tele-dentist: required. Monterrey clinician: DPA, not a fake BAA.
Minimum necessary
Finance sees dollars. Ops does not open a pan without a ticket.
The patient can leave
Export and delete are desks, not email threads.
Seven tools
Pick a control
What on this product is health information.
Work the live desk
Sign BAAs, flag a bad access, close an export. Same credentials as the rest of admin.