October 23rd, 2026
Dental AI and HIPAA: What Practices Must Understand
Industry Research — AI in Dentistry, Research
Ask a dental AI vendor about HIPAA and the answer usually starts with the business associate agreement.
"For any purpose including in any AI models or systems it develops or utilizes." That phrase is from Weave’s published business associate agreement, and it covers what Weave may do with patient data after it de-identifies it. To see how common that kind of clause is, we read what 24 dental AI vendors publish about HIPAA and patient data, as it stood on October 20, 2026. Of the 24, 13 give themselves rights over de-identified customer or patient data in a contract: to create it, use it, share it or own it.
That matters because of one line in the HIPAA rules. Health information de-identified to HIPAA’s standard "is considered not to be individually identifiable health information", and the Privacy Rule’s requirements stop applying to it. Once data is properly de-identified, it is no longer protected health information, and HIPAA stops protecting it. The identifiable records it came from are still covered. What happens to the de-identified copy depends on the contract and any other law that applies.
A de-identification clause isn’t wrongdoing. De-identification is lawful, and a lot of healthcare AI is built on it. The point is narrower: the right sits in documents a practice signs, so it’s worth knowing which contracts hold it.
What we found
- 13 of 24 give themselves rights over de-identified customer or patient data in a contract (a BAA, customer terms or a data processing addendum). 9 more describe de-identification only in a privacy notice, website terms or a marketing page. Bola AI’s BAA restricts it. Pearl’s only mention is de-identifying data when disposing of it, which we didn’t count.
- 23 of 24 mention a BAA. 16 say plainly that they sign, offer or publish one. The other 7 refer to a BAA without offering or publishing one.
- For 14 of 24, we found no public statement of any kind about training AI on customer or patient data. 9 make an explicit statement about their own use, and those statements differ widely. Dental Intelligence’s covers only its outside AI vendors.
- 11 of 24 claim a SOC 2 Type 2 report or HITRUST certification of their own. Two more point to their cloud host’s audit instead.
- Retention numbers don’t compare. 10 vendors give one, and they measure different things.
Why the de-identification clause matters to a dental group
A business associate may use your patients’ information only as its agreement allows or the law requires (45 CFR 164.502(a)(3)). For de-identification done for a practice, HHS says a vendor can do it "only to the extent such activity is authorized by their business associate agreement". So when a vendor can de-identify your data and keep using it, that permission usually comes from a contract your practice accepted.
It can be written the other way, too. Bola AI’s BAA lists de-identifying PHI among the things it won’t do "unless expressly authorized in the Underlying Agreements". Diagnocat’s data processing addendum lets a customer and Diagnocat agree in writing to opt out of secondary use. The clause is a term like any other, and it varies from vendor to vendor.
For a dental group, it shows up in three places.
- At signing. Read it, and negotiate it where you can. Ask whether de-identified data can be used for training, sold or shared.
- At acquisition. Every practice you buy arrives with vendor contracts already signed. Those belong in IT due diligence, next to the hardware inventory.
- At exit. A buyer asking how your vendors handle patient data won’t be satisfied by "we have BAAs." A vendor-by-vendor list of de-identification, training and retention terms, like the tables below, is a better answer.
The de-identification clause, vendor by vendor
A clause in a BAA or customer agreement is part of what you sign. A privacy notice, website terms or marketing page usually isn’t, unless your agreement pulls it in. The table names the document each vendor’s wording sits in.
| Vendor | Rights over de-identified data | What the wording says |
|---|---|---|
| Adit phones / engagement |
In a contract | "may disclose non-personally identifiable information" BAA |
| Archy PMS with AI scribe |
In a contract | "authorized to use Protected Health Information to de-identify the Protected Health Information" Later use not described. customer terms |
| CareStack PMS with AI phones / imaging |
In a contract | "may disclose de-identified health information for any purpose permitted by law" BAA |
| Curve Dental PMS with ambient AI notes |
In a contract | "Curve may use such de-identified information for any lawful purpose" customer terms |
| Dental Intelligence analytics / engagement |
In a contract | "owns all right, title and interest in and to de-identified and aggregated Customer Data" customer terms |
| Denti.AI scribe / charting / imaging |
In a contract | "disclose such data solely in aggregate or other de-identified form in connection with its business" customer terms |
| Diagnocat imaging AI |
In a contract | "Diagnocat may use Patient Data for promotional, educational and/ or research and development purposes" After the data is anonymized. An opt-out is possible by written agreement. data processing addendum |
| Overjet imaging AI / RCM |
In a contract | "may use or disclose such de-identified data to train Overjet’s AI/ML algorithms or for other internal uses" BAA |
| Planet DDS PMS with AI imaging / agents |
In a contract | "Planet DDS owns all right, title, and interest in and to Aggregated Data and Usage Data." Aggregated Data is aggregated, de-identified data derived in part from customer data. customer terms |
| VideaHealth imaging AI / scribe / RCM |
In a contract | "create de-identified and aggregated data therefrom" Clickwrap terms for its app and services. customer terms |
| Vyne Trellis insurance / RCM |
In a contract | "rights to use De-Identified Data, Derived Data, Usage Data, and AI Outputs for commercialization, AI training, and related purposes are not subject to such limitation" customer terms |
| Weave phones / engagement |
In a contract | "utilize such de-identified information for any purpose including in any AI models or systems it develops or utilizes" BAA |
| Yapi engagement |
In a contract | "Yapi has the right to collect, use and analyze any deidentified information derived from Your Data" customer terms |
| Arini AI receptionist |
Notice or website only | "This anonymized data may be retained indefinitely for research and analytics." privacy notice |
| Dentina.AI AI receptionist |
Notice or website only | "To create aggregated, deidentified, or anonymized information, where permitted by law and contract." privacy notice |
| Henry Schein One PMS with AI diagnostics |
Notice or website only | "We may use and disclose any such de-identified information in the same manner as personal information under this privacy policy." Says its BAA with the provider may permit de-identification. BAA not published. privacy notice |
| Mango Voice phones |
Notice or website only | "disclose de-identified information, so that it cannot be reasonably used to identify any individual, with third parties for marketing, advertising, research, or any other purpose permitted by law" Notice says PHI is governed by the BAA. privacy notice |
| NexHealth engagement / AI receptionist |
Notice or website only | "use and disclose such aggregated and de-identified data on a non-attributed basis" These terms say they cover the website, not NexHealth's services. website terms |
| Peerlogic AI receptionist |
Notice or website only | "Patient data is de-identified before any training occurs." Describes a practice, not a reserved right. marketing page |
| Viva AI receptionist |
Notice or website only | "To create de-identified, anonymized, or aggregated information" privacy notice |
| Zentist insurance / RCM |
Notice or website only | "from which individual user identities have been removed" Privacy policy section on aggregate data about services or users, which it may use and share. privacy notice |
| Zuub insurance verification |
Notice or website only | "We may use and disclose any such de-identified information in the same manner as personal information under this privacy policy." privacy notice |
| Bola AI voice charting / notes |
Restricted in its BAA | "Unless expressly authorized in the Underlying Agreements, Business Associate shall not:" The list that follows includes using PHI "to de-identify the information". BAA |
| Pearl imaging AI / RCM |
Not found | Its privacy policy mentions de-identifying personal information only when disposing of it, which we didn't count. |
The widest wording is in contracts. CareStack’s BAA says it "may disclose de-identified health information for any purpose permitted by law". Curve Dental’s US terms say "Curve may use such de-identified information for any lawful purpose". Dental Intelligence’s terms say it "owns all right, title and interest in and to de-identified and aggregated Customer Data". Weave’s BAA names AI.
Those 13 aren’t all the same permission. Some cover creating de-identified data, some using, sharing or owning it, and only a few mention AI. The count shows how often a contract gives the vendor a claim on de-identified data. It isn’t a count of vendors that train on it.
What each vendor says about training AI on patient data
Training is the question most people ask first. For 14 of the 24, we found no statement either way in the sources we reviewed. Some of those 14 reserve rights to use customer data to improve their products, which isn’t a training statement.
Planet DDS: two clauses in the same addendum
Planet DDS’s AI Features Addendum contains both of these clauses:
| On training | On ownership |
|---|---|
| "Planet DDS will not use or retain Customer Data or Output to train, retrain, or fine-tune the AI Features or other AI or machine-learning models." | Planet DDS owns the AI Features, "including all models, algorithms, and improvements derived from Aggregated Data." |
Aggregated Data, under its SaaS agreement, is aggregated, de-identified data derived in part from customer data, and the addendum extends that to data derived from AI output. The ownership clause doesn’t by itself show that any training happens. We show both because a buyer reading only the first would miss the second.
Vendors that say they may train on de-identified data
Three say it outright. Overjet’s BAA says it "may use or disclose such de-identified data to train Overjet’s AI/ML algorithms". Vyne Dental’s terms limit its use of PHI to what its BAA allows, then say its rights to use de-identified data "for commercialization, AI training, and related purposes are not subject to such limitation". Weave’s AI receptionist terms let it use de-identified call data to "train our natural language processing and voice recognition systems".
The other explicit statements
- Mango Voice says it does not use call data, transcripts or voice audio "to train, fine-tune, or improve our own AI models."
- Pearl offers "the ability to opt out of model training". We didn’t find what the default is.
- Peerlogic says it de-identifies patient data before creating synthetic training data, and that "We never train on live customer data, period."
- Viva: for a finetuned model a practice creates, its terms let it use the data the practice uploads or connects "to finetune or train Finetuned AI Models", and the practice can ask for that model to be deleted.
- Zentist says it does not use data accessed through its Remit AI Connector "to train generative AI models". That covers the Connector only.
Dental Intelligence’s AI terms say its outside AI vendors may not use customer data for training without the customer’s separate consent. We didn’t find a statement about its own use, so it isn’t counted among the 9. No training statement was found for Adit, Archy, Arini, Bola AI, CareStack, Curve Dental, Denti.AI, Dentina.AI, Diagnocat, Henry Schein One, NexHealth, VideaHealth, Yapi or Zuub.
The rest of the scorecard: BAA, SOC 2, training and retention
| Vendor | BAA | SOC 2 / HITRUST | Training on customer data | Retention |
|---|---|---|---|---|
| Adit | Yes BAA |
Not found | Not found | General terms, no period privacy notice |
| Archy | Yes customer terms |
SOC 2 Type 2 trust page |
Not found | General terms, no period customer terms |
| Arini | Yes blog post |
Conflicting claims blog post |
Not found | Account data up to 24 months after closure privacy notice |
| Bola AI | Yes marketing page |
Not found | Not found | 60 days after termination, then may delete customer terms |
| CareStack | Yes BAA |
SOC 2 Type 2 marketing page |
Not found | General terms, no period customer terms |
| Curve Dental | Yes customer terms |
Cloud host's audit trust page |
Not found | General terms, no period customer terms |
| Dental Intelligence | Yes customer terms |
SOC 2 Type 2 trust page |
Covers its outside AI vendors only customer terms |
General terms, no period privacy notice |
| Denti.AI | Yes marketing page |
Not found | Not found | General terms, no period customer terms |
| Dentina.AI | Refers to one privacy notice |
Not found | Not found | General terms, no period privacy notice |
| Diagnocat | Refers to one privacy notice |
Type not stated marketing page |
Not found | At least 7 years in the account data processing addendum |
| Henry Schein One | Refers to one privacy notice |
SOC 2 Type 2 trust page |
Not found | General terms, no period privacy notice |
| Mango Voice | Refers to one privacy notice |
Not found | Says it does not train on call data privacy notice |
2-year maximum privacy notice |
| NexHealth | Yes trust page |
Type 1 trust page |
Not found | General terms, no period privacy notice |
| Overjet | Yes BAA |
HITRUST trust page |
May train on de-identified patient data BAA |
Right to delete 30 days after termination privacy notice |
| Pearl | Refers to one marketing page |
SOC 2 Type 2 website terms |
Offers an opt-out of model training marketing page |
General terms, no period marketing page |
| Peerlogic | Yes blog post |
Not found | Says it never trains on live customer data (uses synthetic data) marketing page |
Not found |
| Planet DDS | Refers to one customer terms |
SOC 2 Type 2 customer terms |
No training on customer data or AI output (see the ownership clause above) customer terms |
30-day access to an export after termination customer terms |
| VideaHealth | Not found live Archived BAA (Feb 2026) |
Not found | Not found | General terms, no period privacy notice |
| Viva | Yes marketing page |
SOC 2 Type 2 marketing page |
May train a practice's finetuned model on data it uploads customer terms |
General terms, no period privacy notice |
| Vyne Trellis | Yes legal page |
HITRUST i1 (2024, current status not confirmed) blog post |
Reserves de-identified data for AI training customer terms |
Attachments older than 13 months may be deleted customer terms |
| Weave | Yes BAA |
Cloud host's audit trust page |
May use de-identified AI call data to improve its AI customer terms |
30-day retrieval window after termination customer terms |
| Yapi | Yes customer terms |
Not found | Not found | Return or destroy within 30 days, if feasible customer terms |
| Zentist | Yes onboarding form |
SOC 2 Type 2 llms.txt file |
No generative AI training on Remit AI Connector data privacy notice |
Right to delete 30 days after termination privacy notice |
| Zuub | Refers to one privacy notice |
SOC 2 Type 2 trust page |
Not found | General terms, no period privacy notice |
Scope notes. NexHealth’s BAA and SOC 2 Type 1 lines come from the trust page for Synchronizer, its API product. Its main trust center lists a SOC 2 report available on request, with no type stated. Weave’s training statement is in its AI receptionist terms, and Zentist’s covers its Remit AI Connector. Arini’s 24 months applies to account data, not patient records, and Vyne’s 13 months to attachments. VideaHealth’s BAA cell covers the live sources we reviewed (see the archived BAA below).
A BAA is table stakes. Check which kind you’re getting.
23 of the 24 mention a BAA. 16 say plainly that they sign, offer or publish one, and several publish their BAA text, including Adit, CareStack, Overjet and Weave. The other 7 refer to a BAA without offering or publishing one. We didn’t find a BAA statement in the live VideaHealth sources we reviewed on October 20, 2026. An archived copy shows a full VideaHealth BAA as recently as February 2026, at a page that now returns an error, so we can’t say whether that version still applies. It authorized VideaHealth to de-identify PHI. VideaHealth’s current app terms separately let it create de-identified and aggregated data from customer materials. A mention doesn’t tell you which products the BAA covers or what it says about de-identified data, and those parts differ.
When the BAA isn’t public, ask for it early and read it next to the customer terms. Our guide to business associate agreements covers what it has to contain.
SOC 2: whose audit, and which type
11 of the 24 claim a SOC 2 Type 2 report or a HITRUST certification of their own. Overjet and Vyne Dental cite HITRUST, and Vyne’s is a one-year i1 certification announced in February 2024. Its trust center still shows the i1 badge, but we couldn’t confirm it’s current. Weave and Curve Dental point to their cloud host’s audit. NexHealth’s Synchronizer page says "SOC 2 Type I Certified", Diagnocat says SOC 2 without a type, and Arini’s blog pages make different claims: one says it holds SOC 2 Type II, and another says it is working toward it. For 8, we found no SOC 2 or HITRUST claim.
A Type 2 report tests whether controls worked over a period of time. A Type 1 looks at their design on one date. As I’ve written before about vendor diligence, a SOC 2 report is a useful signal, not an answer, and it won’t tell you what a vendor may do with de-identified data.
Retention: the numbers measure different things
10 vendors give a number, and they aren’t the same kind:
- A window to get your data back: 30 days after termination at Weave, 30 days of access to an export at Planet DDS, and 60 days at Bola AI, after which it may delete.
- A right to delete, not a promise: Overjet and Zentist each reserve the right to delete a customer’s data 30 days after termination.
- A deadline to return or destroy: within 30 days, if feasible, in Yapi’s BAA addendum, which also lets it keep some copies under conditions.
- A maximum: Mango Voice keeps call data, including AI transcripts, for 2 years at most.
- A minimum: Diagnocat stores patient data in the account for at least seven years after treatment ends.
- Narrower scopes: Vyne Dental may delete attachments older than 13 months, and Arini keeps account data up to 24 months after closure.
13 describe retention in general terms with no period. For Peerlogic we found no retention statement. Ask which kind of timing you’re getting, and whether de-identified copies follow the same rule. Arini’s privacy policy says its anonymized data "may be retained indefinitely for research and analytics."
Can staff use ChatGPT with patient information?
Not on a personal or ChatGPT Business account. OpenAI signs BAAs only for specific products, including its API (for eligible organizations, with a setting OpenAI calls Modified Retention), ChatGPT for Healthcare, ChatGPT Enterprise set up with what OpenAI calls a Regulated Workspace, and ChatGPT for Clinicians, a workspace for individual clinicians. Edu customers are pointed to sales. Even under a BAA, OpenAI lists features where patient information shouldn’t be entered. Its help center also says "We do not offer a BAA for ChatGPT Business." The personal plans (Free, Plus and Pro) aren’t on its list of HIPAA-eligible products.
Training is a separate question. On personal plans, OpenAI says "we may use your content to train our models" unless the user opts out, and a conversation a user leaves feedback on may still be used. Business plans aren’t used for training by default, but ChatGPT Business still has no BAA. A no-training setting doesn’t make a tool safe for patient data.
Patient information goes only into tools covered by a BAA your practice has signed. For a group, that means one approved-tools list for every location, so a newly acquired office follows it from day one. The same goes for email that carries patient information.
Questions to ask a dental AI vendor before you sign
In September I wrote that dentistry doesn’t have a standard way to rate vendors on how they handle data. This review isn’t that rating. It’s a first look at what 24 vendors say in public, in their own words, and it points to five questions that separate vendors faster than "will you sign a BAA?"
A note on where I sit. I’m the CEO of Medix Dental IT. We sell managed IT and security services, not AI software, and no vendor in this review was contacted or paid to be included. The same questions are fair to ask any company that touches your patient data, including us.
- Show me the de-identification clause. Which document is it in, and can you use, share, sell or train on the data afterward?
- Is your training statement in the agreement for the product we’re buying? A privacy notice or web page usually isn’t part of what you sign unless the agreement pulls it in.
- Which products does your BAA cover? Some statements apply to one product, like an API or a single AI feature.
- Whose SOC 2 report is it, which type, and does it cover the AI product?
- What kind of retention number is this? A window to get data back, a return-or-destroy deadline and a minimum hold are three different answers.
For a group, ask once, centrally, and keep the answers with each contract, so every location you add is measured against the same list. Our guide to dental AI software covers what these tools do. For the wider set of vendor questions, including where copies of your data live, see where your dental vendors copy patient data.
How we reviewed 24 vendors
A company was included if its own website marketed an AI feature built for dental practices or DSOs, named dental as a primary market, showed it sells in the US, and fit one of five categories: imaging, phones and receptionists, notes and charting, insurance and revenue cycle, or analytics and patient engagement. General-purpose AI platforms were left out. We wrote that rule before adding names.
The list started with the 8 tools in our dental AI software guide, 5 vendors from an earlier review, and 7 dental-built vendors from Google results. On October 20, 2026, we added 5 platforms that many DSOs run (CareStack, Planet DDS, Henry Schein One, Curve Dental and Zentist) under the same rule. One vendor was dropped because its domain was parked. The list is curated, so the counts describe these 24 vendors, not dental AI as a whole.
For each vendor we read the homepage, security, trust, privacy, HIPAA, BAA, legal and terms pages, linked policy PDFs and trust centers, then searched for every field we couldn’t find. No logins and no requests to vendors. Every quote is checked by script against the saved page it links to, and a second, independent review re-checked the quotes and our coding.
The limits, in plain terms. This reports what each vendor publicly claims, not what it does. A signed contract can differ from the public version, and many BAAs are negotiated. "Not found" means not found in the sources we reviewed. Pages change, so this is a snapshot of October 20, 2026, and we don’t plan to update it on a schedule. If you represent one of these vendors and something here is wrong or out of date, contact us with the source and we’ll review it.
Dental AI and HIPAA FAQs
Is using AI a violation of HIPAA?
No. HIPAA doesn’t ban AI. It governs who may use patient information and for what. A dental AI tool that handles patient information for your practice is generally a business associate, so it needs a BAA, and it may use the information only as that agreement allows. The risk is staff using a tool with no BAA, like a personal chatbot account, or contract terms that allow more than the practice expected.
Is there any AI that is HIPAA compliant?
HHS doesn’t certify any product as HIPAA compliant, so that label on a website isn’t a government approval. What exists are AI tools a vendor will cover under a business associate agreement. The BAA is one requirement, not the whole job, and your practice still needs its own safeguards. Its covered products and de-identification clause matter more than the label. In our review of public pages as of October 20, 2026, 23 of 24 dental AI vendors mention a BAA, and 13 give themselves contract rights over de-identified data.
Posted in AI in Dentistry, Research
