HIPAA & AI use

AcuityRow supports senior-living operators that handle PHI. The system drafts, clusters, and summarizes care-loop information for review; the operator remains responsible for care decisions, family communication, and compliance obligations.

AcuityRow is designed for HIPAA-aware workflows. It is not certified under HIPAA, SOC 2, or HITRUST, and this page does not claim guaranteed compliance.

AcuityRow, Llc acts as a business associate to senior living operators that are covered entities or business associates themselves. A business associate agreement (BAA) is available for review and execution before production PHI is connected. The BAA controls in any conflict with these public statements.

Our operational program addresses the HIPAA Privacy, Security, and Breach Notification rules: administrative, physical, and technical safeguards; workforce training; access controls; incident response; and breach notification procedures.

Internal access to PHI is least-privilege. Engineers do not have routine production data access. Time-bound, audited break-glass access is used for incident response and is logged for review.

• Role-based access inside the operator product (caregiver, nurse, manager, family).
• Workforce SSO and MFA on internal systems.
• Quarterly access reviews on operator-impacting systems.

AcuityRow uses AI inside three operator-facing surfaces:

• Care Signals. Cluster and rank observations from the EHR, eMAR, PT logs, and incident reports.
• Family Loop. Draft family-facing language from approved source observations, scoped by the operator's policy controls.
• Survey Trail. Summarize chronological events and attach source links for human review.

Model calls run inside a private inference path under a BAA with the underlying provider. Prompts and outputs are not used to train any third-party model and are not shared across operators.

No AI output reaches a resident's family, a surveyor, or a regulator without a named human approver. End-of-life, hospitalization, and incident messages always require an approver assigned by name in the operator's policy.

The approving reviewer is recorded on every delivered family update and on every export from the survey trail. If the approver is unavailable, the draft holds in the queue; nothing auto-sends as a fallback.

AI may summarize notes, cluster signals, draft family-facing language, and prepare source-linked review packets. AI may not diagnose, prescribe, approve care plans, determine staffing compliance, or send messages without human approval.

• Does not diagnose residents.
• Does not prescribe treatment.
• Does not submit survey responses.
• Trigger emergency response or replace the operator's emergency procedures.
• Does not send family updates without named human approval.
• Make hiring, scheduling, or disciplinary decisions about staff.

We maintain a written incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review. In the event of a security incident that affects PHI, we notify affected operators without unreasonable delay and cooperate with the operator's own breach notification obligations under HIPAA.

AcuityRow supports care operations and human review. It is not a medical device, does not deliver clinical care, and does not take autonomous action on behalf of a clinician. Output is decision support for licensed staff — every consequential action (medication, hospitalization, end-of-life conversations, emergency response, sensitive family communication) is owned by a named human and governed by the operator's own clinical and compliance policies.

We do not promise to prevent falls, eliminate staffing shortages, guarantee survey outcomes, or replace licensed clinical judgement. Where AcuityRow surfaces a signal or drafts language, treat it as one input into a human decision, not the decision itself.

• Maintain valid resident and family consent under your jurisdiction's rules.
• Configure family update policies and approvers before turning on Family Loop.
• Review the survey trail and audit logs as part of your compliance program, not as a substitute for it.
• Notify security@acuityrow.com of any suspected security incident on your side.