Compliance, survey readiness & security
Grievances, abuse reporting, emergency-preparedness drills, monthly OIG/SAM exclusion screening, infection surveillance, corrective action plans, QAPI, a mock-survey self-assessment, policy attestation, and staff training — one Compliance hub, framed by the OIG's seven elements. Plus the HIPAA security controls the whole platform is built on.
One hub, seven elements
Administrative compliance is where most home-health and assisted-living software goes quiet — it's left to binders, shared drives, and the DON's memory. Carelytic makes it a first-class module: one Compliance hub with a calendar built around the OIG's seven elements of an effective compliance program, and every obligation tracked in the platform instead of a spreadsheet nobody opens until the surveyor is in the lobby.
Every recurring obligation — policies, screening, drills, QAPI, reassessments — lands on one calendar organized by the seven elements CMS and the OIG expect. Due and overdue items surface before a surveyor finds them.
Open incidents, open corrective actions, HIPAA risk-assessment status, expired and soon-to-expire credentials, pending policy acknowledgments — the whole survey-readiness snapshot on one landing tab.
The hub is care-setting aware. Home health sees OASIS, chart readiness, and quality measures; assisted living sees resident reassessments and its Minnesota 144G obligations. Same roof, right rules.
Occurrences — incidents, grievances, abuse
An incident, a grievance, and an abuse report are the same shape underneath — a documented occurrence with a reporter, a timeline, and a reporting deadline. Carelytic runs them on one occurrence engine so the state's clock starts the moment it's logged, and the record is survey-ready without a separate binder.
Log a grievance against the resident/client it concerns, capture the acknowledgment and resolution, and keep the full trail. Client-scoped grievances also surface on that person's chart — one record, two lenses (agency-wide and per-person).
Minnesota's Maltreatment of Vulnerable Adults reporting runs on a 24-hour clock — Carelytic starts it automatically and tracks the report to the MAARC common entry point so the deadline never slips.
A serious incident can spawn a corrective action plan directly, pre-scoped to the client/resident and the finding — so the follow-through is tracked, not forgotten.
Prevention & monitoring
Emergency preparedness plans plus a drill log — the exercises CMS's Emergency Preparedness rule requires, tracked with dates and after-action notes instead of a filing cabinet.
Automated exclusion screening against the OIG LEIE and SAM.gov — every employee, every month. An excluded provider on your roster is a False Claims Act exposure; Carelytic checks so a payroll clerk doesn't have to remember to.
Line-list infections, watch for clustering, and flag a possible outbreak — the surveillance an infection-prevention program is expected to run, in the platform rather than a side spreadsheet.
Plans of correction with steps, owners, due dates, and an activity log — spun from an incident or a mock-survey finding, tracked to closure.
Performance Improvement Projects with the QAPI structure a surveyor expects — aim, measures, interventions, and progress — kept as a living record, not a once-a-year artifact.
Run a survey-readiness self-assessment before the state does. Findings roll straight into corrective action plans so the gap you found becomes the work you tracked.
Records surveyors ask for
The annual SRA the Security Rule requires — tracked to completion — plus a breach register for documenting and timing incident notifications. The paperwork an OCR inquiry opens with.
A register of your business associates and their signed BAAs, so "show us your BAAs" is a click, not a scramble through email.
Track receipt and review of your PEPPER and CASPER reports — evidence you're actually reading the comparative data CMS sends, not letting it pile up unopened.
A pre-billing, pre-survey read on whether charts are actually complete — reusing the same readiness engine that gates billing, so "ready" means the same thing everywhere.
A directional roll-up of the HHVBP / Star-adjacent measures your outcomes drive — an in-platform read on where you stand between official reports.
For assisted living, the 144G reassessment cadence (including the bed-rail and physician-re-exam clocks) rolls into the same hub so nothing lapses.
Policies & procedures
A policy nobody signed isn't a policy — it's a liability. Carelytic ships a house-style, fillable policy & procedure library and runs the acknowledgment loop: assign to staff, notify, capture the signature, file it, and re-acknowledge automatically when the policy is revised.
Compliance packs
Compliance packs bundle the policies and procedures for a state and license type into one push — so a new agency starts survey-ready instead of assembling a manual from scratch.
Staff training
Annual in-service hours (§484.80), HIPAA, OSHA bloodborne pathogens, infection control — the training a surveyor will ask you to prove. Carelytic runs it in-platform: read-and-attest lessons plus curated links, an auto-graded quiz, and a certificate on the record. No video infrastructure to buy, no separate LMS to reconcile.
Build a course from readings and curated external links, attach an auto-graded knowledge-check quiz with a passing score, and issue a certificate on completion — which feeds the employee's in-service hours automatically.
Define required training by job title and it's assigned to the right staff — including new hires the moment they're activated. No chasing a spreadsheet of who's done what.
Recurring courses re-assign themselves on their cadence, so the annual mandatories come back around on their own. Training packs let a whole starter curriculum be sent to an agency at once.
Role-based access control
Under all of it is the security model. Most platforms gate UI elements but leave the
underlying URL accessible. Carelytic's RolePermissionMixin runs the perm check in
dispatch() — if a user without the right perm types the URL, they get a 403
before any database query touches PHI.
Clients, Scheduling, Authorizations, Billing, Reconciliation, Payroll, Users & Settings, Reports, Intake, Clinical, EVV, HR, Compliance, Documents, Help Tickets, Audit, Tools — each with its own verbs.
Agency Admin · Manager · Scheduler · Biller · Skilled Nurse · Therapist · Clinical Manager/QA · Payroll/HR · Intake/Admissions · Office Staff/Read-Only, plus assisted-living direct-care roles.
clients.view_assigned_only narrows the queryset for clinicians and aides — they only see clients they're assigned to. Defense in depth, not just UI gating.
visible_clients(user, tenant) is the canonical replacement for Client.objects.all(). Used in every list view, dropdown, autocomplete, and dashboard count.
Holding evv.checkin auto-grants evv.view — you can't perform the action without seeing the surface to navigate to it. Never the reverse.
Caregivers see a separate dashboard — no revenue numbers, no agency-wide KPIs. Routed automatically by clients.view_assigned_only.
Modern authentication
Most home health platforms still ask clinicians to type a TOTP code on every login. We treat the second factor as a problem to solve at the device level — not a hoop the user re-jumps every shift.
Touch ID, Face ID, Windows Hello, hardware keys — all supported via WebAuthn. Once enrolled, login is one biometric tap. No SMS codes, no authenticator app to lose with the phone.
After the first successful MFA on a device, that device is trusted for a configurable window. The clinician's phone stops re-prompting between shifts — but a new browser or a stolen session still pays the full MFA cost.
Lost authenticator? Self-service email recovery code with a 15-minute TTL, single-use, rate-limited. Plus tenant-admin and super-admin reset paths — all audit-logged with the reason.
Clinical drafts saved while offline are encrypted in the browser with WebCrypto — AES-GCM with a per-device key. The PHI never sits in localStorage in the clear, even on a device that's been lost.
TOTP enrollment is required for every user account. The middleware forces enrollment on first login and verification on every fresh session. No opt-out — not even for the agency owner.
The MFA verify, password reset, and email recovery pages render with no sidebar, no nav, no chrome. A half-locked-out session can't peek at navigation, KPIs, or client lists.
Audit trail
Every significant action logs to an activity trail with user, IP, before/after diffs, and entity type. Queryable per entity, per user, per action, per date range — with a separate, surveillance-grade log of who viewed a chart, gated to the roles that should see it.
Two tiers: a change log (who created / edited / deleted) and a PHI-access log (who viewed or printed). The access log is force-excluded for anyone without the surveillance perm.
Every UPDATE captures what changed, what it was, and what it became. Confidential columns (pay, SSN, private notes) are redacted from the trail by design.
Login / logout / failed login, OASIS CMS exports, and every status transition (Draft → Signed → Locked) captured with actor and timestamp.
Required, not optional
Three things competitors leave to per-tenant toggles or off-platform workflows. Carelytic ships them on by default, in the platform, audit-logged.
Every user enrolls TOTP and verifies on every fresh session. No per-tenant opt-out, no admin override. Three audit-logged recovery paths: email self-recovery, tenant admin reset, super admin reset.
The CMS HETS Trading Partner Agreement is signed inside Carelytic — Settings → Compliance → HETS Attestation. Captures signer name, title, IP, timestamp, and exact agreement text + version in an immutable audit log.
When a CSM views your tenant for support, a sticky red banner appears across every page and every action is logged with session id, reason, and duration. Standard B2B SaaS practice (Stripe, Linear, Intercom) — but most home health vendors don't disclose how support accesses your data.
Onboarding & legal artifacts
A guided onboarding wizard walks a new agency admin through the day-one essentials — agency identity, HIPAA officers, and the two legal documents — instead of emailing PDFs back and forth. Every signature is captured as an immutable, audit-grade attestation.
Steps through agency identity, the legally-required HIPAA Privacy Officer and Security Officer (45 CFR §164.530 / §164.308), the BAA, and the Service Agreement. It auto-disappears from the sidebar once the day-one essentials are done — no perpetual "finish setup" nag.
Sign the HIPAA Business Associate Agreement and the Service Agreement with a typed or hand-drawn signature. Each signing writes an immutable attestation row: signer name + title, IP, user agent, timestamp, every affirmation checked, and the frozen agreement text + version. Re-signing a new version creates a new row — the original stays valid for the version it was signed under.
Carelytic (a product of Vice Shield LLC) counter-signs on the same record, so both agreements are fully executed in-platform. A dated PDF receipt — agreement text, affirmations, and the full audit trail — is downloadable on demand by both your admins and our team. The binding force is the audit trail, not the script font.
The HIPAA BAA is signed on every tier — most home-health vendors gate it behind their top plan — modeled on the same immutable-attestation pattern as the HETS agreement above.
What we don't claim
