Subprocessors
These are the third parties that Software Solution LA uses to host and operate Dentrova. Every subprocessor that may create, receive, maintain or transmit PHI has signed a business associate agreement with us. We give Customers at least 30 days' notice by email before adding a subprocessor that will handle PHI.
| Subprocessor | What it does for the Service | PHI? | Location | Safeguard |
|---|---|---|---|---|
| Microsoft Azure — App Service, Azure Database for PostgreSQL, Blob Storage, Key Vault, Azure Monitor | Hosting, each practice's database and files, encryption keys, logs and monitoring | Yes | United States | Microsoft HIPAA BAA (Microsoft Product Terms) |
| Microsoft Azure Communication Services | Sending email and text messages (appointment reminders, sign-in codes) | Limited (appointment reminders) | United States | Microsoft HIPAA BAA |
| Microsoft Azure AI Document Intelligence | Reading scanned paper charts when a practice imports them | Yes, when used | United States | Microsoft HIPAA BAA |
| Stedi, Inc. | Insurance clearinghouse: eligibility, claims and remittance | Yes | United States | Stedi HIPAA BAA |
| Stripe, Inc. | Subscription billing and card payments for our fees | No — practice billing details only | United States | PCI DSS Level 1; no PHI is sent |
Services each practice contracts directly
These services are chosen and contracted by the practice itself, which signs its own agreement (including a BAA where PHI is involved) with the provider. They are not our subprocessors:
- Payers, laboratories, imaging centers and referral partners the practice exchanges information with.
- The practice's own email (SMTP) provider, if it chooses to send patient email through it instead of ours.