What iReferral is, what it stores, and who handles it

Who we are

iReferral is published by Continuum Health Systems LLC. Contact: send a request.

What pays for it

It is free. There is no money from any party, and iReferral never picks the dentist. Nobody pays to be listed or to be sent a referral.

What it does

It records the status of a dental evaluation request: sent, received, scheduled, seen, report back, closed. It does not carry the report, send messages or notify anyone. There are no accounts and no cookies. A private link is the key to a referral.

What is stored, field by field

There is no free text field. Every value below is a choice from a list, a date picked from a calendar, or a code the server makes. No names, birth dates, contact details or notes are asked for. This table is checked by a test against the keys the service really writes.

Hospital

The hospital picked from the public CMS list: its slug, CMS number, name, city, state and the main phone number CMS lists. Nothing typed. The phone is shown to the dentist link only.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Request id

A random 16 character id. It is part of both links.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Link keys

Only a SHA-256 hash of each link key is stored, never the key. Nobody can rebuild a link from storage.
Who can read it: Neither page shows it. Kept: Until the referral is deleted.

Who started it

One of: patient, family or caregiver, care team, dentist office. Not verified.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

What is needed

One of three fixed choices.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

How the report gets back

One of four fixed choices. The report itself never passes through iReferral.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Reference code

The random eight character code for the written order, kept encrypted under the requester link key, and the stored name of the code pointer item that opens the request (a keyed hash, not the code).
Who can read it: Requester link only. Kept: Until the referral is deleted, or until the requester makes a new code.

Server reference

A random 16 character reference the server assigns for a connecting system. Nobody chooses it.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Dates entered

Optional, picked from a calendar: needed by, first asked for, the dentist visit date, the date treatment finished.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Time of each stop

The server time each stop was marked, the time the referral was made and last changed, and a change counter.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

First time each side opened what the other sent

A server time. No other viewing is recorded.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Dentist finding

One of three fixed choices. Not a clearance. (result is the older name of the same field.)
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Decline

The time the dentist office declined and one of seven fixed reasons.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

No longer needed or canceled

The time and one of four fixed reasons, or the time of a cancel.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Reschedule count

How many times the dentist changed the visit date.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Reopen count

How many times the requester reopened a declined request.
Who can read it: Neither page shows it. Kept: Until the referral is deleted.

Care team desk

The time a care team desk took the referral on, and the id of that desk. Pages show the time and whether a desk holds it, not the desk id.
Who can read it: Time: requester link and dentist link. Desk id: neither page. Kept: Until the referral is deleted.

Questions and answers

Up to eight pairs. Each question is one of nine fixed choices and each answer one of four, stored as a code, with who asked and when. No words typed by a person are stored.
Who can read it: Requester link and dentist link. Kept: Until the referral is deleted.

Code pointer (a separate stored item)

Named by a keyed hash of the hospital and the code. Holds the request id, the dentist link key encrypted under the code and a server secret, and a time. It opens only with the hospital and the code.
Who can read it: Neither page shows it. Kept: Until the referral is deleted, or the code is replaced.

Desk (a separate stored item)

The time it was made, a hash of the desk link key, and its list of referrals with the time each was added. Each referral key on the list is encrypted under the desk link.
Who can read it: Desk link: the list of its referrals and their status links. Kept: Deleted after 400 days with no change.

Deletion heartbeat (a separate stored item)

The time the daily deletion job last ran and how many items it looked at, deleted, cleaned, how many old-form or out-of-date code pointers it removed, how many requests remain, how many owner alerts it resent, whether alerts remain stuck, and the retry progress and continuation cursor. No record content.
Who can read it: Neither page shows it. Kept: Replaced at each run.

Request from the request page (a separate stored item, not part of a referral)

Only when someone sends a claim, listing, correction, help or contact request. The kind of request, the hospital or practice named and the public listing it matched, the sender role, work email, optional phone number and optional note, and the time. The form refuses anything that looks like a patient detail. No IP address is stored.
Who can read it: Us and Vercel as the host. No page shows it. Kept: 180 days, or sooner when the sender asks us to delete it.

Owed owner alert (a separate stored item)

A marker that exists only while the alert telling us about a request has not gone out. It holds the request reference and a time and is removed when the alert is delivered. While one exists the health check reports a failure.
Who can read it: Neither page shows it. Kept: Until the alert is delivered.

Anyone with access to the storage account, which means us and Vercel as the host, can read the stored values above. Link keys are stored only as hashes, and reference codes and desk entries are stored encrypted under a value the store does not hold.

Limits on guessing a reference code

A reference code is eight letters and numbers (about 1.1 trillion combinations) and opens only the hospital it was made for. After 40 wrong tries in an hour from one connection the page asks the dentist to wait or to ask the requester for the link. That count is kept per server instance, and the hosting can run more than one, so it slows guessing and does not put a hard cap on it. The requester can make a new reference code at any time from the status page, and the old code stops working.

Retention

A daily job deletes a referral 180 days after its last activity. The person who started it can delete it at any time, and that removes the record and its printed code at once. A desk is deleted after 400 days with no change.

Subprocessors

• Vercel. Hosts the site and the API, and holds referrals in a private Vercel Blob store. Vercel keeps standard server logs, which include IP addresses, for a short period.

Other companies that see a visitor's IP address

• Google Fonts. The page fonts load from Google. Google can see the visitor's IP address. Nothing typed on this site is sent to it.
• unpkg. The page icons load from unpkg. It can see the visitor's IP address. Nothing typed on this site is sent to it.

Our own application log lines carry a short hash of the referral and the action taken, never a link key, a reference code or a question.

What we do not offer

We do not offer a BAA (business associate agreement). Do not use iReferral for anything that must stay inside the chart. We make no claim that it meets any hospital policy, and whether your policy asks for a review is your call.

Questions

Send a request on the request page. See also the privacy page and the terms.