Cohort
Security and privacy

Nothing is deleted. Nothing leaves.

Every write is stamped and kept. A correction is a new line under the old one.

What it holds.

Three kinds of record, in the same words as the product.

Protected health information

Fourteen tables. Residents, their allergies and diagnoses, medication orders and doses, care notes, incidents and plan versions — everything a shift is run from.

Personal information

Two tables: the people who sign in, and their membership of an organisation and its houses.

Public

Three tables, holding nothing about any person.

The mechanism

How the record is held up.

The protection is mechanism, not adjectives.

Append-only

Every entry is stamped with who and when. A correction goes under the original. A dose cannot be un-given.

Audited

Every change, print, export and support session writes a row. The log outlives the account.

What a push says

WH-1: 4 medications due

A house code and a count. Never a name. The set of messages is closed, so nothing can invent one.

What leaves the phone

Error reports are scrubbed of anything resembling a record. Exports are made on your device with redaction on by default.

Where it lives

Under a vendor business associate agreement, reaching only a signed-in phone. You accept the customer agreement at signup.

Solo houses

A house with one caregiver on shift cannot produce a witness. The product records the absence in those words rather than making anyone lie.

Leaving

Export at any time, without asking. On the way out: export, a hold, then a hard delete. The audit log is kept for the statutory period.

What left the house

An incident, and everything that left the house because of it.

Filed, notified by house code and nothing else, reviewed, signed off, locked.

The same incident, on the desktop

Shown at true size. Drag sideways for the rest.The app’s own narrow layout. Drag sideways for the panel beside it.

The two stops

Exactly two actions can stop a caregiver.

Both stops exist because the harm is physical. To go on, a caregiver types a reason, the reason is recorded on the dose, and the manager is told. There is no third stop and there are no countdown timers.

1

A medication that matches a recorded allergy. The stop names the allergen, its severity and its reaction, and it runs even when no allergy is on file, so the absence is stated too.

2

An as-needed dose before the order’s minimum interval, or past its daily ceiling. The stop shows when the last dose was given and when the next is allowed.

Write to usAsk a questionTalk to a personSay hello