StackFloss connects to your practice management system to find care that's already approved, already due, or already covered. That means we handle patient records, and HIPAA applies to how we do it. This page explains our safeguards in plain terms. The binding commitments are in our Business Associate Agreement (BAA) and Customer Terms of Service.
Our role under HIPAA
Your practice is a covered entity. StackFloss is your business associate. We sign a BAA with every practice before we access a single record, and we use patient information only to serve your practice, as the BAA allows.
There's no government certification for HIPAA, and we don't claim one. Instead, we maintain written policies, assess our risks, and can show our work: practices can request documentation of our safeguards under the BAA.
We also follow the health information privacy laws of the states where your offices are, including Texas, where we train our team within 90 days of hire and at least every two years.
Safeguards
Administrative
- Written security and privacy policies, and periodic risk assessments.
- A designated Privacy and Security Officer.
- HIPAA training for every workforce member before they can access patient data.
- Access only for people who need it, only for as long as they need it. Contractors who could access patient data sign a BAA and confidentiality agreement first.
Technical
- Encryption of patient data in transit and at rest.
- Audit logs of access to patient data.
- Minimum necessary: each task uses only the data it needs.
- Read-only access to your PMS by default. Writing back to your PMS happens only if you turn it on, and only under rules you set.
Physical
- Patient data lives in secure, access-controlled cloud data centers in the United States, not in our offices.
- Only members of our team located in the United States can access patient data.
- No patient data on personal devices.
- When your service ends, you have 30 days to request an export of your data. Within 60 days, we return or destroy your patient data, and confirm it in writing on request.
AI and patient data
Inside our environment. AI features, such as PracticeChat answers and message drafts, run on models accessed through Amazon Bedrock within our HIPAA-eligible AWS environment, covered by our BAA with AWS.
Patient data never trains AI. We don't use patient data to train AI models. We may use de-identified data, with names and every other identifying detail removed under HIPAA's de-identification standard, to train models we use only inside StackFloss. De-identified data is never sold or shared for anyone else's use, and Amazon Bedrock doesn't use our inputs or outputs to train its models.
People stay in charge. Every flagged item shows why it was flagged. Your team reviews recommendations and drafts before acting, and clinical decisions stay with clinicians.
The website is separate from the product
Our public website uses analytics and advertising tools that visitors can turn off at any time, honors Global Privacy Control, and never asks for patient information. None of those tools run inside the StackFloss product, and none of them receive patient data. See our Privacy Policy and Cookie Policy.
Subcontractors that handle patient data
These companies create, receive, maintain, or transmit patient data on our behalf. Each has signed a business associate agreement with us. Before a new one begins handling patient data, we'll add it here and email each practice's notice contact.
| Company | What it does for us | Location |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, and AI model access (Amazon Bedrock) | United States |
| Google LLC | Google Workspace: email, documents, and meeting notes we use to support your practice | United States |
Your practice management system vendor (for example, Open Dental Software) is your vendor, not our subcontractor. We connect to it with your authorization.
If something goes wrong
If we discover a breach of unsecured patient data, we'll notify your practice without unreasonable delay and within 5 business days, or sooner if state law requires, with the details you need to notify patients and regulators. We'll also report other improper uses or disclosures and successful security incidents, investigate, limit the harm, and fix the cause. The BAA sets out these obligations in full.
Report a security issue
If you believe you've found a security vulnerability in StackFloss, or that patient data has been exposed, email security@stackfloss.com. Please include enough detail for us to reproduce the issue, don't access or change data that isn't yours, and give us reasonable time to fix it before disclosing it. We won't pursue legal action against good-faith research that follows these guidelines.
Questions
Want to review our BAA or documentation of our safeguards? Email hello@stackfloss.com. Please don't include patient information in any message to us.
Last updated: November 9, 2026.