Dental software legal battle raises, questioning who controls patient data

The legal battle between Henry Schein One (HS One) and Vyne Dental has entered its final stages over whether third-party integrations can access patient data without causing a security risk. On March 18, the court heard final arguments for dueling motions for the preliminary injunctions, with Vyne seeking to restore access to Dentrix-integrated systems and HS One arguing that Vyne’s methods created security and legal risks.

Vyne Dental has been providing and processing claims that patient engagement using Henry Schein’s Dentrix practice management system for over 20 years. The system works by using printer driver integration, software that allows Vyne to read Dentrix data and processing into insurance claims.

HS One learned that Vyne’s integration was looking at more information than originally disclosed. It allegedly was accessing configuration files, administration credentials and databases HS One has as unauthorized.

HS One blocked the printer driver and followed up by sending security concerns to customers. The company decided to offer discounts on competing products and released a software update in September that would disable any software running with Vyne.

The companies filing lawsuits

On September 30, Vyne filed a lawsuit in Maryland federal court under the Cures Act, claiming that HS One had launched an aggressive campaign to interfere with Vyne and the company’s customers. Vyne argues that the dental record stored in Dentrix is patient records and belongs to the dental practice not HS One.

On October 3, HS One filed a lawsuit in Utah federal courts under trespass claims against alleging unauthorized computer access and data corruption. The claims from HS One were that Vyne was hacking the Dentrix software.

How the companies and court responded

HS One said it believes the court will rule in its favor.

“Henry Schein One believes in a connected ecosystem,” said HS One in a news release. “We work with more than 100 partners through our API program — one of the largest integration networks in dentistry — and process billions of data requests every year. We want practices to have access to the tools they need. “

“But every integration that touches our systems has to meet our security and performance standards. That structure is what allows us to say yes to so many partners while still protecting the tens of thousands of practices that depend on us every day,” the company added.

During the preliminary hearing on March 18, the court addressed the security concerns and commented on customer response to the lawsuits.

“You have customers complaining about data integrity issues, issues that point to the fact that some corruption is occurring, problems with referential integrity, problems that are preventing you from updating the software,” said the court to HS One.

HS One presents its position as preserving 7,000 dental practices and electronic health information and blocking the printer driver, which the company refers to as a virus in court, is the way to do so.

Vyne is claiming that HS One is using health information exchange (HIE), a data-shared network, and therefore should not be allowed to block access. The issue the company is running into is that these definitions of what is qualifies as HIE remain unclear.

The way this case could change the industry

A larger highlight of this case is that it will change healthcare technology. The industry does have rules around data sharing, but without a clear definition the court will have to decide on the terms. This outcome can affect how the dental industry is structured moving forward based on what the court rules as a data-sharing network and what data has to be shared.

There has been no immediate ruling.