DentalX Back to home

BAA Schedule B: California

BAA-US-SCH-B · Draft of October 6, 2026 · revision 1 · version 1.0

Part of Business Associate Agreement and Health Data Processing Addendum

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 26e5bf1a0b0a937181535145c16d5e1e7c70e900078e819446d7a573f4315bce

Schedule B — California

Applies to: Clinics whose principal place of practice is in California.

Opening condition. California is a gated state (country matrix § 2.3). This Schedule is published, and new California Clinics are accepted, only when the capabilities in B.1(d) and B.2 are live, because VstreamX, as a business offering software to maintain medical information, must provide them itself (Civil Code § 56.06). [[BLOCKING TO CONFIRM: release of the before-and-after change history and of the sensitive-services controls]]

B.1 Confidentiality of Medical Information Act. VstreamX acknowledges that, as a business that offers software designed to maintain medical information, it is subject to the California Confidentiality of Medical Information Act (Civil Code § 56 et seq., "CMIA"), including § 56.06. Accordingly, VstreamX:

  • (a) does not disclose medical information except as § 56.10 permits, and as the Clinic directs;
  • (b) does not sell medical information, or use it for any purpose not necessary to provide the Services;
  • (c) maintains, preserves and protects the confidentiality of medical information as § 56.101(a) requires; and
  • (d) protects and preserves the integrity of electronic medical information. DentalX automatically records and preserves any change or deletion of electronically stored medical information, recording the identity of the person who made it, the date and time, and the change (§ 56.101(b)). [[TO CONFIRM: that the audit trail records before-and-after values for changes to clinical data; if not, a release date]]

B.2 Sensitive services (AB 352). Medical information relating to sensitive services includes gender-affirming care, abortion and abortion-related services, and contraception. For it, DentalX provides California Clinics with the capabilities of Civil Code § 56.101(c):

  • (a) to limit user access privileges to that information to those who need it;
  • (b) to prevent its disclosure, access, transfer, transmission or processing to persons or entities outside California;
  • (c) to segregate it from the rest of the patient's record; and
  • (d) to allow the automatic disabling of access to it by individuals and entities in another state.

[[TO CONFIRM: release date of the sensitive-services flag, segregation and out-of-state blocking; until released, California must be described as not yet supported for those records]]

B.3 Generative AI in patient communications. Where Health and Safety Code § 1339.75 (AB 3030) applies to the Clinic, DentalX's AI-drafted patient communications carry the required disclaimer, unless a licensed provider has read and reviewed them before they are sent. [[TO CONFIRM: whether AB 3030 reaches dental offices]]

B.4 Breach. VstreamX's report under section 3.4 allows the Clinic to notify affected individuals within the periods California law sets. It also allows the Clinic to notify the Attorney General where more than 500 California residents are affected.