HIPAA compliance for ecommerce orders that link to a patient or clinic, what do I actually need?

Most dental supply orders are not in HIPAA scope. A clinic ordering 50 boxes of gloves doesn’t touch protected health information (PHI). HIPAA kicks in when an order line links to a specific patient: custom dental appliances, ortho cases, surgical kits with patient ID, prescription-driven items, or order data shared back to the clinic’s practice-management system.

If you’re in scope, the Magento implementation:

• Auto-purge order line PII after 6 years, the standard dental records retention rule (varies by state: 10 years in some, lifetime for minors until 18+6). Cron-driven purge with audit log of every purged record.
• Immutable audit log, every read or write to PHI-touching records logs user + IP + timestamp + action. Append-only table, no UPDATE / DELETE allowed.
• BAA (Business Associate Agreement), you sign with each clinic that shares PHI through your ordering system. Magento tracks signed-BAA status per clinic account; orders with PHI flags block at checkout if no BAA on file.
• Two-factor auth + IP allowlist + session timeout on the admin side. Server-level encryption at rest (AES-256), TLS 1.3 enforced for all transit.
• Hosting on a HIPAA-eligible provider, AWS (with BAA), Azure (with BAA), or specialised HIPAA-hosting like Aptible / Datica. Standard Magento on Cloudways without a BAA is not HIPAA-defensible.

If you’re not in scope, you still want most of this hygiene (audit log, 2FA, encryption), HIPAA is the spec, not the bar.