We keep a receipt for every time patient information leaves your practice.
One box sits in your server closet, and it is the only thing on the network allowed to ask your practice-management system for chart data. When an AI scribe, a recall vendor or an imaging archive wants a copy, it asks the box; the box hands over the fields that vendor’s contract covers, for the purpose it declared, and writes a row to a hash-chained ledger before anything crosses the wire. That row carries the vendor, the purpose, the field paths, the record count and the bytes.
It carries no patient values. It cannot: there is no field in a record that a name fits in.
The demo is password-gated while this is still a reference build. Ask info@catalyticgpu.com and the sign-in comes back with the reply, inside a day or two.
Built in New York, and you can sign into it.
One rack, one team, and a phone number on the plate.
Version 0.1 runs mediation, the ledger, the verifier and the attestation against a synthetic practice with 2,500 patients. The export behind it is a real one, and the verifier in it is the same program a stranger can run.
- Built by
- Catalytic AI
- Where
- New York
- Phone
- (917) 667-1002
- Demo runs on
- our own hardware, in New York
- Price
- $299–$849 / month
There is no sales team between you and the console. One email gets the password, and a person reads it.
The largest upload in a dental practice is not an AI vendor.
Ask a practice owner what leaves the building and she names the AI tools. She is right about maybe a third of it.
The rest is the plumbing she bought for other reasons. For a 2,500-patient general practice, the yearly egress estimate looks like this — and the top row is a backup deal, sold to her as backup.
| Channel | What actually crosses | Volume, per year |
|---|---|---|
| Imaging archive | Every radiograph and intraoral scan, study by study, to DS Core, 3Shape Unite or Medit Link | 0.5–1 TB once; ~70 GB a year after that |
| Recall and texting vendor | Patient name, date of service, the reason for the appointment, sent to a third party that holds the list | One message per patient per recall cycle |
| Clearinghouse and eligibility | Identity, coverage, and the CDT codes your front desk is proposing — a machine-generated query stream that almost nobody examines | One query per patient at check-in |
| AI scribe | Compressed ambulatory audio of the whole appointment, not just the dental part | ~7 GB a year at 2,500 visits of 22 minutes |
| Analytics vendor | A nightly read of the full practice ledger | 365 reads a year, whole chart |
| Agentic vendors | The whole chart on request, because an agent that cannot see the chart cannot answer | As often as it asks |
Estimated from 400 new-patient full-mouth series at 18 images, 2,100 recall bitewing sets at 4 images, 2,000 periapicals, 250 CBCTs and 350 intraoral scans, for one 2,500-patient practice in one year. The arithmetic is ours and you can redo it with your own counts.
Strip the name and the chart is still a fingerprint.
A full dentition chart — 32 teeth, each in one of eight states — carries 35 to 55 bits of identifying information once you count surfaces and materials. Thirty-three bits is enough to single out one person among 8.6 billion. Forensic odontology has used teeth for mass-disaster identification for exactly this reason, and a vendor holding your archive can re-associate a radiograph to a patient from the pixels alone, with every DICOM tag deleted.
That is why a field-level record beats a de-identification dashboard. The dashboard tells you what its own vendor kept. The record tells you what left, which fields, and under which agreement.
Four things happen, in this order.
Mediate
Every request resolves against a grant for one vendor and one purpose. Fields outside the minimum-necessary list are dropped, dates shift, names become surrogate tokens that resolve back only on the box. If the agreement has expired or the vendor has added a subprocessor, the request is refused and the refusal is written with its reason code and the alternative offered.
Record
The decision row reaches disk before the socket opens. Each row is signed, each row hashes the one before it, and one Merkle root a day is timestamped by an outside authority. A mediated payload cannot exist on the wire without a row that explains it, because the box refuses to send what it cannot first write down.
Prove
When the quarter closes the ledger renders into one page. Every destination the box mediated. Every destination it watched and did not mediate, with the bytes counted. The seven channel classes it cannot see at all. A coverage percentage with its denominator printed on the face, computable from the export by anyone holding it.
Verify
The verifier is a standalone program that takes the export and needs no network, no login and no key of ours. It recomputes 14 row hashes, checks the signatures, checks the timestamp token and re-does the coverage arithmetic. Change one character in one row and it fails at that row with the sequence number.
The record format is published as a versioned document, so your auditor can evaluate the artefact without evaluating us, and a buyer can carry the evidence to a new owner at closing.
One page of the document you hand to a buyer’s lawyer.
This is the reference build’s own output, not a mock-up. The practice is synthetic; the numbers are the run’s, copied without editing.
H1. This document reports what one appliance, on one network, mediated and observed in one period. It is not a statement about all patient data held by this practice, and it is not a certification by any third party.
H2. Ledger head 5ec1a891011f0398… Records in period: 14. Chain verified at issue: yes. Anchored: 1 daily root, at 2026-12-31T23:59:59Z.
| Date | Destination | Purpose | Classes | Records | Bytes | Agreement |
|---|---|---|---|---|---|---|
| 2026-11-02 | claims.example.net:443 | payment | DOB, NAME | 30 | 4,702 | BAA-2027-004 |
| 2026-11-09 | reminders.example.com:443 | recall | NAME | 1 | 86 | BAA-2027-016 |
Two of four rows shown. Legal basis on all four: tpo_payment or tpo_operations.
| Address | Operator | Bytes | Sessions |
|---|---|---|---|
| archive.imaging.example:443 | cloud imaging archive | 240,000 | 2 |
| 203.0.113.44:443 | unidentified | 42,000 | 1 |
Half of the four rows shown. Observation is content-blind: the box records the destination, the session and the bytes, and it does not assert that any of these received patient data.
Seven channel classes, enumerated and named, with no volume figure beside any of them because none is measurable from the appliance: DNS over HTTPS and DNS over TLS, phones on a carrier network, certificate-pinned clients, removable media, exported files, unmanaged machines, and any period listed in section 5. Shortened here; the issued document runs each one out in full.
Mediated: 14,211 bytes across 91 records and 2 destinations. Observed but unmediated: 387,000 bytes across 4 destinations. The percentage is the first figure divided by the sum of both, and every input to it is printed above.
2.5 hours unmediated, 09:40–12:10 on 17 November. Volume: unknown. The appliance was not counting, and this document does not estimate it.
Three and a half percent is the honest figure for a build that mediates two of the six destinations it can see, and it is printed rather than hidden because the alternative is worse: a dashboard that reports coverage of what it controls and calls that coverage of what left.
The number rises per practice as connectors are added, and the denominator rises with it, which is the only version of this figure that means anything at all. When you move the imaging archive into mediation, your coverage drops and then climbs. We would rather show you that curve than a headline percentage.
Six things the box does not do, before you find them yourself.
- It does not see everything. The box governs a measured share of the practice’s egress, not all of it. Seven channel classes sit outside its reach — DNS over HTTPS, phones on cellular, certificate-pinned clients, removable media, exported files, unmanaged machines, and any window the box was down. The attestation names each one.
- It will miss identifiers. The classifier is measured against a corpus and the recall figure goes on the attestation with its denominator. Where the two detection layers disagree, a person decides, and the deciding person is named in the record.
- It is not a system of record. The box is not an EHR and it is not your practice-management system. The charting app, the imaging viewer and the e-prescriber stay off it, so an outage stops the AI tools and nothing else. An enforcement event is a governance event.
- It does not stop a person. A clinician can email a note from a phone on cellular. No appliance on a LAN prevents that, and one that says it does is describing a different product.
- It is not cloud. The practice holds the key. We hold hashes and counts, the appliance never phones home, and there is no tenancy of yours in somebody else’s account.
- It cannot certify de-identification. Software cannot be the expert under 45 CFR 164.514(b)(1)(ii). What the box gives you is the field-level record that a named expert works from, which is the part every practice currently improvises.
Ten objections, answered in the order you raise them.
- My PMS vendor handles this.
- Your PMS gives you a toggle per vendor and no field list. It cannot tell you what left.
- We don’t send patient data anywhere.
- Two-thirds of dental egress belongs to the imaging archive, the clearinghouse and the recall list. None of those is an AI vendor. If your log really is empty, we will show you an empty log and say so.
- What if it breaks the clinic?
- The charting app, the imaging viewer and the e-prescriber stay off the box. An outage then stops the AI tools, not the appointments.
- I’m selling the practice in three years.
- The receipt is a diligence artefact. A missing risk analysis is a price cut at a table where practices change hands for $700k to $1.5M.
- Can’t my lawyer do this?
- He can write the policy. Nobody can produce the record of what left on a Tuesday, after the fact, and he bills more per hour than this costs per month.
- Who are you?
- Catalytic AI, in Manhattan: a build you can sign into, and a phone number that reaches the people who built it.
- Is it expensive?
- $299 to $849 a month. The number is printed further up this page, which is unusual in a category where 19 of 23 products do not print a monthly number.
- Does this make us a bigger target?
- No new inbound path. The box holds the credential and does not expose the record set. A breach is a target; a register is a defence.
- My IT guy objects.
- They usually do. They also sign the risk analysis, which makes them the easiest person in the building to convince. Show them the verifier.
- How long does install take?
- One afternoon, and the first two weeks are passive: a census of what leaves, with nothing enforced.
$299, $599 or $849 a month, billed annually.
Mediation, the ledger and the attestation are in all three. The tiers buy the work around the appliance.
- Mediation, ledger and attestation
- Flow map and BAA register
- Refusal register, with reason codes
- De-identification review queue
- Install, done remotely in one afternoon
- Everything in Govern
- Risk analysis regenerated once a year
- BAA and subprocessor review, twice a year
- Tabletop exercise with your team
- Read-along response to an audit or an insurer
- Everything in Assured
- Inference on the box: the model reads the chart, and the chart does not leave the room
- Replaces a per-provider cloud scribe subscription
Also sold: a Diligence Pack at $4,500 for a practice in the middle of a sale, which reconstructs the record from what is still recoverable and says plainly what is not.
Why the price is on the page
Twenty-three products in this category were checked in October 2026. Four publish a monthly number. We are one of the four, and that is the whole reason the number is here instead of behind a call.
The HIPAA software your practice probably already pays for runs $169 to $679 a month and produces documents you fill in. A consultant who does the rest of it properly runs $10,000 to $30,000 a year. This is $3,588 a year and produces the record neither of them can make.
Open the demo. It is six screens and five minutes.
The practice in it is synthetic, so you can break it. One email gets the password, and the password does not expire.
GATECHART · BUILT AND SUPPORTED BY CATALYTIC AI, IN NEW YORK (917) 667-1002