Matisse AI — Implementation Playbook (DSO)

Matisse AI Implementation Playbook

3D Printing & Digital Workflow Optimization for Dental Service Organizations

---

1. Executive Summary

What Matisse AI Does

Matisse AI is an intelligent digital workflow platform that streamlines 3D printing operations for dental applications, automating print job optimization, material management, and production scheduling while integrating quality control checkpoints throughout the digital dentistry workflow. The platform uses machine learning to optimize print orientations, support structures, and nesting configurations while providing real-time production analytics across your 3D printing fleet.

Why DSOs Specifically Benefit

DSOs operating at scale gain compounding advantages from Matisse AI that single practices cannot replicate:

• Production Consolidation: Centralized or hub-and-spoke 3D printing operations become viable when intelligent scheduling eliminates the chaos of managing multiple printers across locations
• Data Aggregation for Predictive Operations: With 15–50 locations generating print jobs, Matisse AI's machine learning models improve exponentially—your collective case data trains smarter optimization algorithms than any single practice could achieve
• Standardization Without Rigidity: Enforce consistent quality standards for surgical guides, aligners, dentures, and models while allowing location-specific production priorities
• Material Cost Arbitrage: Aggregate consumption data enables better vendor negotiations and just-in-time inventory management across your network
• Labor Efficiency at Scale: Reduce the specialized labor required per location by centralizing technical oversight while distributing production capacity

Expected Timeline: Decision to Full Deployment

Phase	Timeline	Milestone
Pre-Implementation	Weeks 1–2	Infrastructure audit complete, pilot locations selected
Wave 1 Pilot	Weeks 3–6	2–3 locations live, initial optimization data collected
Wave 2 Expansion	Weeks 7–12	Next 5–8 locations deployed
Wave 3 Full Rollout	Weeks 13–20	All remaining locations live
Optimization Phase	Weeks 21–28	Cross-network analytics active, ROI validation complete

Total Timeline: 5–7 months for a 30-location DSO, with meaningful ROI data available by month 4.

---

2. Pre-Implementation Checklist (Weeks 1–2)

Technical Requirements

Hardware Requirements per Location

☐ 3D printer(s) with network connectivity (WiFi or Ethernet) ☐ Dedicated workstation: Intel i5/AMD Ryzen 5 or higher, 16GB RAM minimum, 512GB SSD ☐ Compatible 3D printer models (verify with Matisse AI compatibility list) ☐ Intraoral scanner with STL/PLY/OBJ export capability ☐ Post-processing equipment with tracking capability (if applicable)

Network Requirements

☐ Minimum 50 Mbps upload/download per location (100 Mbps recommended) ☐ Static IP or DDNS capability for printer fleet management ☐ Ports 443, 8443, and 3000 open for cloud communication ☐ VPN compatibility if using centralized hosting model ⚠️ Latency under 100ms to Matisse AI cloud servers—test from each location

Software Requirements

☐ Windows 10/11 Pro or macOS 12+ on workstations ☐ Chrome, Edge, or Firefox (latest versions) for web interface ☐ Practice management system API access enabled ☐ DICOM viewer for CT/CBCT integration (if applicable)

Vendor Onboarding Steps

Step	Owner	Timeline	Vendor Contact
🔵 Execute enterprise licensing agreement	Legal/Procurement	Day 1–3	Enterprise Sales
🔵 Receive enterprise admin credentials	Central IT	Day 3–5	Implementation Manager
🔵 Schedule kickoff call	Project Lead	Day 5	Customer Success Manager
🔵 Assign dedicated implementation specialist	Matisse AI	Day 5	Account Executive
🔵 Obtain API documentation	Central IT	Day 5–7	Technical Support
🔵 Schedule technical architecture review	Central IT + Matisse	Day 7–10	Solutions Architect

Key Vendor Contacts to Establish

☐ Enterprise Account Executive: Strategic escalations, contract modifications ☐ Implementation Manager: Deployment coordination, timeline management ☐ Technical Support Tier 2: Integration troubleshooting, API issues ☐ Customer Success Manager: Adoption metrics, optimization recommendations

Data/Access Prerequisites

☐ PMS API credentials for each location (read access minimum; write access for case status sync) ☐ Scanner software export settings configured for automated STL delivery ☐ Historical case data export from existing workflow tools (past 12 months recommended) ☐ Printer manufacturer portal credentials for fleet integration ☐ Cloud storage access for file staging (if using external storage) ☐ Active Directory or identity provider credentials for SSO configuration

Enterprise-Level Requirements

Network Standards Across Locations

🟣 ☐ Decision: Centralized hosting vs. location-level hosting

• Centralized: Single cloud instance, all locations connect remotely. Better for standardization, harder if locations have inconsistent connectivity.
• Location-Level: Each location runs local instance with cloud sync. Better resilience, more configuration overhead.
• Recommended for 15–50 locations: Centralized hosting with local caching for production continuity during outages

☐ Standardize network topology documentation across all locations ☐ Verify firewall rules are consistent (or can be made consistent) across locations ⚠️ ☐ Audit locations with legacy networking equipment—these will cause delays

Single Sign-On (SSO) Configuration

☐ SAML 2.0 or OAuth 2.0 compatibility verification 🔵 ☐ Provide identity provider metadata to Matisse AI ☐ Role-based access control (RBAC) matrix defined:

• Super Admin: Central IT, CDO
• Regional Admin: Regional managers
• Location Admin: Office managers
• Production User: Lab techs, dental assistants
• View Only: Providers (if not directly managing prints)

Centralized Credentialing

☐ Map organizational hierarchy in Matisse AI admin console ☐ Create location groups aligned with regional structure ☐ Define permission inheritance rules (what regional admins can modify vs. view)

Stakeholder Alignment Map

Stakeholder	Role in Implementation	Inform (I) / Approve (A) / Execute (E)	Key Concerns to Address
Board/Investors	Strategic oversight	I	ROI, competitive positioning, capital allocation
CEO	Executive sponsor	A	Timeline, resource commitment, risk exposure
CDO	Clinical governance	A	Clinical quality, workflow impact, provider adoption
VP Operations	Program owner	A + E	Execution complexity, location readiness, staff impact
CFO	Budget approval	A	Capital vs. OpEx, ROI timeline, vendor terms
VP IT/CIO	Technical approval	A + E	Security, integration, infrastructure
Regional Managers	Cascade execution	E + I	Location-specific challenges, staff capacity
Office Managers	Local implementation	E	Day-to-day workflow changes, training burden
Lead Providers	Clinical validation	I + E	Workflow disruption, quality assurance
Lab Technicians	End users	E	Tool usability, job impact concerns

Alignment Meeting Cadence

🟣 ☐ Week 1: Executive steering committee kickoff (CEO, CDO, VP Ops, CFO, CIO) ☐ Week 1: Regional manager briefing session ☐ Week 2: Location manager notification and Q&A ☐ Ongoing: Weekly executive sponsor update (15 minutes) ☐ Ongoing: Bi-weekly regional manager syncs

Baseline Metrics to Capture BEFORE Go-Live

⚠️ Critical: Without baseline metrics, ROI measurement is impossible. Capture these across ALL locations using standardized definitions.

Production Efficiency Metrics

Metric	Definition	How to Capture	Standardization Notes
Print jobs per day	Total completed prints per 24-hour period	Printer logs or manual tally	Count by location and aggregate
Print failure rate	Failed prints / total print attempts	Manual log or printer software	Define "failure" consistently (partial, total, post-cure)
Material waste %	Wasted resin (mL) / total resin used	Weight-based tracking or estimation	Train all locations on measurement method
Average job setup time	Time from STL receipt to print start	Time-motion study (sample 20 jobs/location)	Exclude atypical cases
Post-processing time	Time from print complete to case-ready	Time-motion study	Include wash, cure, finishing

Operational Metrics

Metric	Definition	How to Capture	Standardization Notes
Case turnaround time	Days from impression/scan to delivery	PMS case tracking	Define start/end points identically
Remake rate	Reprints required / total cases	Case tracking	Distinguish clinically-driven vs. print-driven remakes
Outsourced case volume	Cases sent to external labs	Lab invoice data	Include reason codes
Equipment downtime	Hours printer unavailable / total hours	Maintenance logs	Include scheduled and unscheduled

Financial Metrics

Metric	Definition	How to Capture	Standardization Notes
Material cost per case	Total material spend / cases produced	Invoice reconciliation	Allocate shared materials consistently
Labor cost per case	Tech labor hours × rate / cases	Payroll + production data	Include only production-related time
External lab spend	Monthly outsourcing costs	AP records	Segment by case type
Equipment cost per case	Depreciation + maintenance / cases	Asset tracking	Standardize depreciation method

Standardization Protocol for Baseline Metrics

🟣 ☐ Approve standardized metric definitions document ☐ Distribute measurement protocols to all location managers ☐ Assign regional managers to audit 2 locations each for measurement consistency ☐ Collect 4 weeks of baseline data minimum before Wave 1 go-live ⚠️ ☐ Reconcile any locations using different definitions—flag for manual baseline adjustment

---

3. Location Readiness Assessment

Readiness Scoring Framework

Score each location on the following factors (1–5 scale). Composite score determines rollout wave assignment.

Factor 1: IT Infrastructure Maturity (Weight: 25%)

Score	Network Speed	Hardware Age	PMS Version	Overall IT Health
5	100+ Mbps, stable	< 2 years	Current version	Dedicated IT support
4	75–100 Mbps, stable	2–3 years	1 version behind	Shared IT support
3	50–75 Mbps, occasional issues	3–4 years	2 versions behind	Ad-hoc IT support
2	25–50 Mbps, frequent issues	4–5 years	3+ versions behind	Minimal IT support
1	< 25 Mbps, unreliable	5+ years	Unsupported version	No IT support

Assessment Method: ☐ Central IT runs network speed tests (3 tests at different times of day) ☐ Inventory hardware purchase dates from asset management ☐ Verify PMS version from vendor portal ☐ Survey location manager on IT support experience

Factor 2: Staff Tenure and Adaptability (Weight: 20%)

Score	Average Staff Tenure	Turnover Rate (Annual)	Tech Comfort	Prior Tech Adoption
5	5+ years	< 10%	Actively seeks tech	Led prior implementations
4	3–5 years	10–20%	Comfortable with tech	Participated in prior implementations
3	2–3 years	20–30%	Neutral toward tech	Used current systems adequately
2	1–2 years	30–40%	Tech-resistant	Struggled with prior changes
1	< 1 year	40%+	Actively avoids tech	Prior implementations failed

Assessment Method: ☐ Pull tenure data from HR system ☐ Calculate 12-month turnover from HR records ☐ Regional manager rates tech comfort (1–5) based on observation ☐ Review prior technology rollout notes if available

Factor 3: Patient Volume (Weight: 20%)

Score	Monthly Patient Volume	Production Volume	Impact Potential	Risk Level
5	1,000+	200+ cases/month	Highest impact	Highest risk
4	750–1,000	150–200 cases	High impact	High risk
3	500–750	100–150 cases	Moderate impact	Moderate risk
2	250–500	50–100 cases	Lower impact	Lower risk
1	< 250	< 50 cases	Minimal impact	Minimal risk

Assessment Method: ☐ Pull patient visit counts from PMS ☐ Estimate 3D printing case volume from lab logs or outsourcing invoices ☐ Note: High volume locations are NOT necessarily best for Wave 1—balance impact with risk

Factor 4: Existing Tech Stack Compatibility (Weight: 20%)

Score	PMS Compatibility	Scanner Integration	Printer Fleet	Other Digital Tools
5	Native integration	Direct API available	All Matisse-certified	Digital workflow mature
4	Documented integration	Export automation	Most certified	Moderate digital adoption
3	Custom integration needed	Manual export	Some certified	Basic digital tools
2	Complex integration	Limited export options	Few certified	Minimal digital
1	No integration path	No export	None certified	Paper-based workflows

Assessment Method: 🔵 ☐ Provide tech stack inventory to Matisse AI for compatibility scoring ☐ Verify scanner models and software versions ☐ Audit 3D printer models against certification list ☐ Survey digital workflow maturity with office manager

Factor 5: Local Champion Availability (Weight: 15%)

Score	Champion Profile	Availability	Authority	Motivation
5	Tech-forward provider or manager	Dedicated implementation time	Can make local decisions	Actively requested tool
4	Engaged manager	Partial dedicated time	Influences local decisions	Supportive of initiative
3	Capable staff member	Limited additional time	Informal influence	Neutral but willing
2	Reluctant participant	No dedicated time	Limited influence	Compliant but unenthusiastic
1	No candidate identified	No capacity	No authority	Resistant

Assessment Method: ☐ Regional managers nominate champion candidates ☐ Interview candidates for willingness and capacity ☐ Verify office manager support for champion role ☐ Assess whether champion has production floor credibility

Scoring Calculation

Composite Score = (IT × 0.25) + (Staff × 0.20) + (Volume × 0.20) + (TechStack × 0.20) + (Champion × 0.15)

Composite Score	Rollout Wave Recommendation
4.0–5.0	Wave 1 Pilot Candidate
3.0–3.9	Wave 2
2.0–2.9	Wave 3
< 2.0	Remediation Required Before Deployment

Rollout Sequence Recommendation

Wave 1 Selection Criteria (2–3 Locations)

Select locations with: ☐ Composite score 4.0+ ☐ At least one location in each major region (for geographic coverage) ☐ At least one high-volume and one moderate-volume location (for diverse testing) ☐ Strong local champion identified and committed ☐ Representative PMS/scanner mix (avoid Wave 1 being all Dentrix if portfolio is mixed) ⚠️ Avoid: Locations with new office managers (< 6 months tenure) or active renovation/relocation

Wave 2 Selection Criteria (5–8 Locations)

Select locations with: ☐ Composite score 3.0–3.9 ☐ No critical infrastructure remediation required ☐ Champion identified (even if less experienced than Wave 1) ☐ Geographic clustering with Wave 1 sites (enables peer support)

Wave 3 Selection Criteria (Remaining Locations)

☐ All remaining locations with score 2.0+ ☐ Locations requiring remediation—schedule remediation during Waves 1–2

Remediation Tracking

For locations scoring < 2.0:

Location	Deficiency	Remediation Action	Owner	Target Date
[Location]	Network speed	ISP upgrade	Regional + IT	[Date]
[Location]	Hardware age	Workstation replacement	IT + Finance	[Date]
[Location]	No champion	Recruit/hire	Regional Manager	[Date]

---

4. Rollout Strategy

Wave Structure Recommendation

Wave 1: Pilot (Weeks 3–6)

• Locations: 2–3 sites
• Duration: 4 weeks
• Objective: Validate integration, refine training materials, identify configuration issues, establish baseline performance data under Matisse AI

Wave 2: Early Majority (Weeks 7–12)

• Locations: 5–8 sites
• Duration: 6 weeks (2 cohorts of 3–4 locations if needed)
• Objective: Scale deployment, stress-test support model, validate train-the-trainer approach

Wave 3: Full Rollout (Weeks 13–20)

• Locations: Remaining sites
• Duration: 8 weeks (cohorts of 5–7 locations)
• Objective: Complete deployment, shift to operational mode

Detailed Wave 1 Pilot Plan

Week 3: Pre-Pilot Preparation

☐ Confirm Wave 1 locations and champions (Day 1) 🔵 ☐ Matisse AI technical setup for pilot locations (Days 1–3) ☐ Install and configure workstations (Days 2–4) ☐ Complete champion training—intensive 2-day program (Days 3–4) ⚠️ ☐ Verify network connectivity and test print job submission (Day 5) ☐ Configure printer fleet in Matisse AI (Days 4–5) ☐ Run test prints with sample files (Day 5)

Week 4: Pilot Go-Live

☐ Go-live Day 1 (see Go-Live Day Runbook, Section 8) ☐ On-site support present at each pilot location (Days 1–2) ☐ Daily check-in calls with champions (Days 1–5) ☐ Issue tracking and resolution (ongoing) 🔵 ☐ Matisse AI support on standby for escalations

Week 5: Pilot Stabilization

☐ Transition to virtual support only ☐ Daily check-ins shift to 3x weekly ☐ Begin collecting performance metrics ☐ Gather staff feedback (mid-pilot pulse survey) ☐ Document workflow adjustments and workarounds

Week 6: Pilot Evaluation

☐ Compile pilot performance data ☐ Conduct champion debrief sessions ☐ Update training materials based on pilot learnings ☐ Finalize configuration template for Wave 2 🟣 ☐ Go/No-Go decision for Wave 2

Go/No-Go Criteria

Criteria to Advance from Wave 1 to Wave 2

Criterion	Threshold	Measurement
System uptime	> 98%	Matisse AI monitoring
Print job success rate	> 90%	Production logs
Champion confidence score	> 3.5/5	Champion self-assessment
Staff training completion	100%	Training tracking
Critical issues resolved	All P1 issues closed	Issue tracker
User adoption	> 80% of jobs through Matisse	Usage analytics

🟣 ☐ VP Operations + CDO sign-off required to proceed to Wave 2 ⚠️ If any criterion not met, implement remediation plan before proceeding (add 1–2 weeks)

Criteria to Advance from Wave 2 to Wave 3

Criterion	Threshold	Measurement
System uptime	> 99%	Matisse AI monitoring
Print job success rate	> 92%	Production logs
Train-the-trainer success	All location staff trained	Completion tracking
Average setup time reduction	> 15% vs. baseline	Time-motion comparison
Support ticket volume	Declining week-over-week	Help desk data

Timeline with Buffers

Wave	Target Start	Target End	Buffer for Learnings
Wave 1	Week 3	Week 6	1 week (Week 7)
Wave 2	Week 8	Week 12	1 week (Week 13)
Wave 3	Week 14	Week 20	Ongoing optimization

Rollback Plan

Triggers for Rollback Consideration

• System uptime < 90% for 48+ hours
• Print failure rate > 30% attributable to Matisse AI
• Data integrity issues (missing cases, corrupted files)
• Security incident or breach
• Provider refusal rate > 25%

Rollback Procedure

1. Pause: Stop new location deployments immediately
2. Assess: Determine if issue is systemic or location-specific
3. Communicate: Brief executive sponsor, regional managers, and affected locations
4. Isolate: If location-specific, quarantine that location; others continue
5. Revert: If systemic, instruct all locations to revert to manual workflow
6. Preserve: Maintain Matisse AI access for troubleshooting (read-only)
7. Resolve: Work with vendor on root cause; do not resume until resolved
8. Re-validate: Repeat Wave 1 process for affected locations before continuing

⚠️ Rollback Decision Authority: VP Operations can pause; CEO approval required for full rollback

---

5. Configuration & Integration (Weeks 2–3)

Practice Management System Integration

Dentrix Enterprise Integration

Prerequisites: ☐ Dentrix Enterprise version 8.0 or later ☐ API access enabled by Dentrix (contact Dentrix support) ☐ Matisse AI Dentrix connector license activated

Step-by-Step Integration:

1. 🔵 ☐ Obtain Dentrix API credentials from vendor support (2–3 business days)
2. ☐ In Matisse AI Admin Console, navigate to Integrations → PMS
3. ☐ Select "Dentrix Enterprise" from dropdown
4. ☐ Enter API endpoint URL (provided by Dentrix)
5. ☐ Enter authentication credentials
6. ☐ Configure data sync options:
   • ☐ Patient demographics: Read-only
   • ☐ Appointment data: Read-only
   • ☐ Case/procedure data: Read-write (for status updates)
   • ☐ Provider information: Read-only
7. ⚠️ ☐ Test connection—verify with 3 sample patient lookups
8. ☐ Configure auto-refresh interval (recommended: every 15 minutes)
9. ☐ Enable event webhooks for real-time case status sync
10. ☐ Document integration settings for enterprise configuration template

Estimated Time: 2–4 hours per location (can be parallelized with central IT)

Eaglesoft Integration

Prerequisites: ☐ Eaglesoft version 21 or later ☐ Eaglesoft Online enabled for cloud connectivity ☐ Practice-level admin credentials

Step-by-Step Integration:

1. 🔵 ☐ Request Eaglesoft API access through Patterson Dental (3–5 business days)
2. ☐ Verify Eaglesoft Online is active and syncing
3. ☐ In Matisse AI Admin Console, navigate to Integrations → PMS
4. ☐ Select "Eaglesoft" from dropdown
5. ☐ Enter practice ID and API key
6. ☐ Map field mappings:
   • ☐ Patient ID field
   • ☐ Procedure code field (CDT codes)
   • ☐ Provider ID field
7. ⚠️ ☐ Test connection with read operation
8. ☐ Configure write-back settings for case status updates
9. ☐ Set sync frequency (recommended: every 10 minutes for Eaglesoft)
10. ☐ Test end-to-end: create test case in Eaglesoft, verify appears in Matisse AI

Estimated Time: 3–5 hours per location

Open Dental Integration

Prerequisites: ☐ Open Dental version 22.1 or later ☐ Open Dental API access enabled (Open Dental API subscription required) ☐ Static IP or DDNS configured (for webhook delivery)

Step-by-Step Integration:

1. ☐ In Open Dental, navigate to Setup → Program Links → Matisse AI
2. ☐ Enable the Matisse AI program link
3. ☐ Generate API key in Open Dental (Setup → Security → API)
4. ☐ In Matisse AI Admin Console, navigate to Integrations → PMS
5. ☐ Select "Open Dental" from dropdown
6. ☐ Enter practice database name and API key
7. ☐ Configure OAuth (if using Open Dental Cloud)
8. ☐ Map procedure codes to Matisse AI case types:
   • ☐ Surgical guides (D6190, D6191)
   • ☐ Dentures (D5110–D5140)
   • ☐ Models (D9999 custom codes)
9. ⚠️ ☐ Test bidirectional sync
10. ☐ Configure attachment storage (link printed case images back to patient record)

Estimated Time: 2–3 hours per location (Open Dental typically easiest)

Imaging and Scanner Integration

Intraoral Scanner Integration (3Shape, iTero, Medit)

3Shape TRIOS:

1. ☐ Enable TRIOS "Send to Lab" functionality
2. ☐ Configure Matisse AI as a destination in TRIOS Design Studio
3. 🔵 ☐ Obtain 3Shape Communicate credentials if using cloud transfer
4. ☐ Set default export format: STL (binary)
5. ☐ Configure automatic case creation in Matisse AI upon receipt
6. ⚠️ ☐ Test with sample scan—verify geometry integrity

iTero:

1. ☐ In iTero Element, navigate to Settings → Export
2. ☐ Add Matisse AI as export destination
3. ☐ Configure MyiTero cloud sync if using cloud pathway
4. ☐ Set export format: STL
5. ☐ Enable automatic naming convention matching Matisse AI requirements
6. ☐ Test export and verify file appears in Matisse AI queue

Medit:

1. ☐ In Medit Link, configure Matisse AI as connected application
2. ☐ Enable "Design Service" workflow to Matisse AI
3. ☐ Set export parameters (STL, medium resolution minimum)
4. ☐ Configure case metadata to transfer with file
5. ☐ Test integration with sample scan

Estimated Time: 1–2 hours per scanner type

CBCT Integration (for Surgical Guides)

1. ☐ Configure DICOM export from CBCT software
2. ☐ Set up secure file transfer to Matisse AI (SFTP or direct integration)
3. ☐ Map DICOM study to patient record in PMS
4. 🔵 ☐ Verify Matisse AI can ingest DICOM and generate planning views
5. ⚠️ ☐ Test surgical guide design workflow end-to-end

Estimated Time: 3–4 hours (requires clinical validation)

Test Environment Setup

Centralized Test Environment (Recommended for DSO)

🟣 ☐ Decision: Use shared test environment vs. per-location test instances

• Recommendation: Shared test environment for integration testing; brief per-location testing for local validation only

☐ Request test environment provisioning from Matisse AI 🔵 ☐ Matisse AI provisions sandbox with sample data ☐ Configure test environment with representative configuration ☐ Grant access to central IT, regional IT leads, and champion group ☐ Document test scenarios and expected outcomes

Validation Checklist

☐ File upload: STL files process correctly ☐ Auto-orientation: Algorithm produces expected results ☐ Support generation: Supports appropriate for case type ☐ Nesting: Multi-part jobs nest efficiently ☐ Print job submission: Jobs queue to correct printer ☐ Status tracking: Job status updates reflect accurately ☐ PMS sync: Case updates flow to PMS ☐ Reporting: Analytics dashboards populate ☐ User permissions: RBAC enforced correctly ☐ SSO: Login via identity provider works

Data Migration

Historical Data Ingestion (Optional but Recommended)

1. ☐ Export historical print job data from existing systems (past 12 months)
2. ☐ Format data per Matisse AI import template (CSV)
3. 🔵 ☐ Submit to Matisse AI for bulk import
4. ☐ Verify imported data in analytics dashboards
5. ☐ Note: Historical data enables better optimization immediately

Decision Point: 🟣 ☐ Determine if historical data import is worth effort vs. learning from fresh data

• Import recommended if you have digital records of > 500 print jobs

Security and HIPAA Compliance

Enterprise-Level HIPAA Checklist

Business Associate Agreement: 🟣 ☐ Execute BAA with Matisse AI (required before any PHI transfer) ☐ Verify BAA covers all data types being transferred ☐ Confirm BAA chain includes any Matisse AI subprocessors ☐ File BAA with compliance/legal team

Data Governance: ☐ Document what PHI is stored in Matisse AI:

• Patient names (if synced from PMS)
• Patient identifiers
• Case images/files
• Provider information ☐ Confirm data residency requirements (US-based servers for US practices) ☐ Verify encryption standards:
• At rest: AES-256 or equivalent
• In transit: TLS 1.2+ ☐ Document data retention policy:
• How long does Matisse AI retain case data?
• What is the deletion process upon request?

Access Controls: ☐ Implement role-based access per RBAC matrix (Section 2) ☐ Configure automatic session timeout (recommended: 15 minutes) ☐ Enable MFA for all admin accounts ☐ Document user provisioning/deprovisioning process ☐ Verify audit logging captures access events

Technical Safeguards: ☐ Confirm Matisse AI SOC 2 Type II certification ☐ Request most recent penetration test summary ☐ Verify backup and disaster recovery capabilities ☐ Confirm incident response process and notification timelines

Compliance Documentation: ☐ Add Matisse AI to vendor inventory ☐ Complete risk assessment questionnaire ☐ Document Matisse AI in system architecture diagrams ☐ Update