Trust center
Built around resident data and human approval.
AcuityRow is designed for HIPAA-aware workflows in senior living operations. This page, maintained by the AcuityRow, Llc team, is the plain-language version of how resident data moves, where AI is allowed, and where it isn't.
Last reviewed: July 26, 2026 — an audit-update date, not a legal approval date.
Seven commitments
What operators get on day one.
Role-based access
Caregivers, nurses, managers, and families see only what their role allows.
BAA available before production PHI
Business associate agreement available for review before production PHI is connected.
Audit trail on every action
Every accept, override, approval, and export is recorded with user and source.
Human approval before family send
End-of-life, hospitalization, and incident updates always require a named approver.
AI boundaries documented
No diagnosis, no prescribing, no autonomous family messages. Every output keeps source context.
Data export & deletion
Operators export or delete their data on demand, with retention windows disclosed.
Incident response plan
Written plan covering detection, containment, recovery, and operator notification.
What AcuityRow does
- Organize signals from resident records, eMAR, incidents, and PT logs into a reviewable morning brief.
- Match staffing coverage to today's acuity load and surface gaps before the shift.
- Draft family update language for a human reviewer to approve, edit, or discard.
- Keep an audit trail of every signal, intervention, and approved family update with its source.
- Enforce role-based access so caregivers, nurses, managers, and families see only what they should.
What AcuityRow does not do
- Does not diagnose residents.
- Does not prescribe treatment.
- Does not submit survey responses.
- Does not send family updates without named human approval.
- Does not replace your compliance program or the judgement of licensed staff.
Trust posture
Sourced from brand.ts
HIPAA-aware workflows
Every workflow assumes PHI and treats it accordingly.
Role-based access
Caregivers, nurses, managers, and families see only what they should.
Audit trail
Every signal, intervention, and family update is logged with source.
Encryption at rest and in transit
Standard envelope encryption across the stack.
Human approval
Nothing reaches a family without a human reviewer signing off.
Source context
Every recommendation links back to the underlying observation.
Least privilege
People and services receive only the access required for their task. No blanket admin.
Role-based access
Who sees what.
Caregiver / CNA
Assigned residents on the current shift and the next handoff.
Licensed nurse
Neighborhood roster, signals with source context, family draft queue.
Manager / DON
Facility-wide queue, staffing fit, survey trail, approval logs.
Family member
Approved updates for their resident only, in their preferred channel.
AI boundary
Where the model is allowed.
AcuityRow uses AI to cluster signals, summarize notes, and draft family-facing language. Every model output is tied to its source observation and held for review.
AI may summarize notes, cluster signals, draft family-facing language, and prepare source-linked review packets. AI may not diagnose, prescribe, approve care plans, determine staffing compliance, or send messages without human approval.
End-of-life, hospitalization, and incident messages always require a named human approver before they leave the building.
We do not promise the model is correct in every case. We promise that nothing the model produces reaches a resident's family or a regulator's review without a person signing off.
What we won't promise
- Prevent every fall, elopement, or adverse event.
- Eliminate staffing shortages or guarantee coverage.
- Guarantee survey outcomes or any regulatory result.
- Replace licensed clinical judgement or autonomous decisioning by a clinician.
Certifications
What we will and will not claim.
AcuityRow does not publish SOC 2, HITRUST, or HIPAA certification badges unless a current report or approval is available. The product is designed for HIPAA-aware operations, supports BAA review before production PHI, and keeps AI outputs under human review.
A BAA is available for review before production PHI is connected. Security review packets are available on request through security@acuityrow.com.
Data export & deletion
Your data leaves the way it came in.
- Operators can export resident records, audit trail, and family update receipts on demand.
- Per-resident exports are available from the survey trail packet.
- Deletion on contract end or written request, with retention windows for legal hold disclosed in writing.
- Backups roll off on the stated schedule; we don't keep silent copies after a deletion request completes.
Incident response
If something goes wrong, the call goes out fast.
- Written response plan covering detection, triage, containment, eradication, recovery, and post-incident review.
- Affected operators are notified without unreasonable delay so HIPAA breach obligations on your side can be met.
- Report a concern: security@acuityrow.com — acknowledged within one business day.
Need a deeper review?
Procurement, IT, or compliance teams can route their questionnaire to our security desk.