The programme's mission had outrun its tooling. What began as a small screening effort now reached patients across 30 school and community sites, but the technology had never been upgraded to match. Hygienists ran video consults on consumer-grade apps never intended for clinical use, and intraoral images were captured on personal devices and uploaded to shared drives with none of the access controls patient data requires.

The paperwork was just as exposed as the technology. No vendor in the chain, video, storage or otherwise, had signed a business associate agreement, the contractual foundation HIPAA expects whenever a third party handles patient data. There was no documented risk assessment, no structured workforce training and no organised evidence of safeguards, because the programme had grown out of clinical enthusiasm rather than an IT department.

Then the stakes changed. Grant funders began requiring evidence of HIPAA compliance as a condition of the money that kept screening days running. The programme faced audits it could not pass, which put its funding, and with it the dental screening of the communities it serves, at genuine risk.

The constraint that shaped everything was continuity: screening days at 30 school and community sites could not stop while the programme modernised. So we sequenced the work as a series of swaps, each replacing one risky practice with a compliant equivalent, and each timed around the screening calendar so hygienists never lost a working day to the transition.

Consults moved to a BAA-covered healthcare video platform, and image capture was rebuilt end to end: encrypted at capture, flowing into access-controlled cloud storage, with personal devices replaced by managed devices at every site. Single sign-on with role-based permissions now governs access, so each staff member reaches exactly what their role requires and nothing more.

Compliance is more than tooling, so we treated the paperwork as a deliverable in its own right. A HIPAA Security Rule risk assessment established where the gaps were and tracked them to closure, workforce training gave hygienists and coordinators clear handling rules, and a centralised evidence log now captures safeguards, agreements and training records in one place, keeping the programme permanently audit-ready rather than scrambling before each review.