Why HIPAA matters for CBCT
A CBCT DICOM is protected health information. It carries the patient's name, birth date, study date, and a 3D anatomical record of the head and jaws. Under HIPAA, any platform that stores, transmits or displays this data on behalf of a covered entity is a business associate and must implement the Security Rule safeguards.
Handing a patient a CD avoids the issue technically, but fails the practical test — the patient cannot open it, and the clinic ends up emailing the scan anyway, often without adequate safeguards.
How CBCTHub meets the Security Rule
Technical safeguards: encryption at rest, encryption in transit (TLS 1.3), access control, audit controls, and integrity controls. Administrative safeguards: workforce access management, incident response procedures, business associate agreements. Physical safeguards: infrastructure hosted on SOC 2 Type II providers.
The full security whitepaper lives on /security. Request it at security@cbcthub.com if you are completing a vendor security questionnaire.
Beyond HIPAA
For EU and UK practices, CBCTHub aligns with GDPR. We sign a Data Processing Agreement, support data subject rights (access, rectification, erasure, portability) and can pin storage to the EU region on eligible plans. For Brazilian clinics we align with LGPD; for Canadian clinics, PIPEDA.