How we stay current: automated tripwires (Federal Register, curated AZ/AHCCCS/CMS/ONC sources, deadline alerts) plus a deep-dive agent file issues against the specs below. See Regulatory Monitoring & Automation for the runbook.
CL-11 (42 CFR Part 2) — Implemented
Deadline: Feb 16, 2026Status: ✅ Compliant — fully implemented.
- Spec: CL-11 Consent Management
- Integration doc: CL-11-consent-management-42cfr-part2-INTEGRATION.md
- Capabilities: Consent capture (8 types, 4 categories), consent lifecycle (active/expired/revoked), disclosure logging with consent reference, accounting of disclosures export, SUD detection via
cl_check_sud_consent(), permission-gated UI. CL-11-EN-01: Electronic consent with e-signature, granular categories (treatment/payment/operations/providers/research), 42 CFR Part 2 § 2.32 redisclosure chain-of-custody audit trail, consent expiration alerts (30/14/7 days), revocation workflow, Part 2 compliance dashboard. Evidence:docs/compliance/evidence/CL-11-EN-01-42cfr-part2-EVIDENCE.md.
Status Legend
| Status | Meaning |
|---|---|
| ✅ Compliant | Implemented and verified |
| 🟡 In Progress | Implementation underway |
| ⏳ Not Started | Spec exists; 0% implemented |
| ⚠️ Overdue | Deadline passed; interim procedures in place |
| 📋 N/A | Not applicable or deferred |
| 🏗️ Scaffolded | Partial implementation — core structure (tables, UI shell, audit hooks) in place; vendor integration, gateway, or go-live still pending. Tracker cells may append a percentage (e.g. 🏗️ Scaffolded (70%)) for rough completeness. |
Tracker Table
| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| 42 CFR Part 2 (SUD confidentiality) | Feb 16, 2026 | ✅ Compliant | CL-11 — CL-11 Integration doc; CL-31 (consumer: SUD consent gating for COD assessments and dual-diagnosis notes via redactSUDFields helper); CL-48 (consumer: SUD consent check before CDA generation, SUD section filtering, redisclosure notice, disclosure logging; 📋 Specification); CL-55 (consumer: virtual group/multi-party event gating, 📋 Specification); CE-54 (consumer: AI triage SUD consent gating — edge function checks consent_obtained on ce_screening_attempts before including SUD fields in AI payload; blocked attempts audit-logged; AI response validated for PHI before storage; 📋 Draft); CL-69 (consumer: SUPRT-A/C outcome rows DS4P-labeled per CL-63; downstream emit to GR-28 gated on per-receiving-entity Part 2 consent; 📋 Specification — compliance_reviewed 2026-05-28); GR-28 (consumer: SPARS package generation queries CL-11 for per-receiving-entity Part 2 consent and surfaces a non-overridable consent_missing error per row; 📋 Specification — compliance_reviewed 2026-05-28); CL-29-EN-66 (consumer: ADT-derived SUD denominator events from PF-108 Contexture HIE inherit Part 2 considerations on payer-facing export; 📋 Specification — compliance_reviewed 2026-05-28) | — | — | Implemented: consent capture, revocation, disclosure logging, accounting export, SUD detection via cl_check_sud_consent. CL-31 Planned/in-progress: design/specs for consent capture, revocation, disclosure logging, accounting export and SUD detection via cl_check_sud_consent for COD documentation; interim controls in place; CL-31 will extend Part 2 coverage for COD documentation (redactSUDFields for ASI-6 SUD domains and progress note SUD sections). CL-48 planned: C-CDA generation checks cl_has_sud_consent(chart_id) before including SUD data in CDA sections; excludes SUD medications/diagnoses/notes when consent inactive; attaches redisclosure notice per § 2.32; creates disclosure log entry per § 2.31. CL-55 planned: SUD-related virtual group attendance, recording, export, and event publication must route through CL-11 consent/disclosure policy checks and keep events PHI-free. CE-54 planned: AI triage edge function verifies SUD consent on ce_screening_attempts before processing; SUD fields excluded if consent missing; PHI detection on AI response before storage; structured output prevents re-disclosure (§ 2.32). CL-69 planned: SUD-derived outcome rows carry DS4P labels at insert (FR-9, NFR-sec-1); downstream emit to clinical.outcome_assessment.recorded is gated by per-receiving-entity Part 2 consent enforced server-side. GR-28 planned: SPARS package generation excludes any SUD-derived row without a per-receiving-entity Part 2 consent on file and surfaces a non-overridable consent_missing error (FR-8, AC-4.1/4.2). CL-29-EN-66 planned: payer/AHCCCS-facing exports of FUA/FUI denominator events containing SUD diagnoses must route through CL-11 cl_check_sud_consent() and log to the disclosure log; ADT-derived events RLS-isolated per tenant. |
| CMS-2454-IFC (Medicaid community-engagement / work-requirement exemption verification; H.R.1 §71119; 42 CFR 435.560(c), 440.315(f)) | Jan 1, 2027 (state implementation; rule effective Jul 31, 2026; comments due Jul 31, 2026; good-faith extension ceiling Dec 31, 2028) | ⏳ Not Started | CEEM — PF-96-EN-01 (work_requirement_rules pack), PF-117 (status registry — the single CEEM evaluator; absorbed the former PF-114), PF-114 (rules-evaluator — ARCHIVED 2026-06-02, superseded by PF-117), PF-115 (80-hr activity tracker), PF-116 (verification/cure lifecycle), CL-70 (medically-frail determination + attestation), CL-71 (42 CFR Part 2 / DS4P disclosure gate), GR-32 (state/MCO export), FA-47 (revenue-at-risk). The 9 enhancement specs were renumbered to numeric -EN-{n} (e.g. PF-96-EN-01) on 2026-06-02. Epic #737; spec-tracking #719–#735; drafts under specs/{pf,cl,gr,fa}/specs/. | Compliance Officer / PF / CL | 2026-12-31 (enrollee outreach outer deadline) | Specs drafted and grounded against CMS-2454-IFC (FR 2026-11094), 42 CFR 440.315(f), and the 2024 42 CFR Part 2 final rule (89 FR 12472); recommendation report + P0 spec-review under specs/reviews/. Exemption verification not yet implemented — until CEEM ships, exemption evidence (provider attestations, treatment-episode records) is produced manually and disclosed to AHCCCS/MCOs only on a valid Part 2 basis (consent OR permissible TPO/claims-data basis) with minimum-necessary (yes/no exemption attestation, never the raw SUD record). The “disabling mental disorder” qualifying-diagnosis set and AZ lookback/cadence values are PF-96-configurable, not hardcoded. P0 spec-review verdicts: PF-96-EN-01 / PF-117 minor_fixes; PF-114 / CL-71 needs_work — CL-71 Part 2/DS4P gate MUST precede any SUD-derived disclosure (gates CL-70 and GR-32). Fail-safe toward coverage retention; audit every status transition (PF-04). |
| ONC HTI-1 / USCDI v3 | Jan 1, 2026 | ⚠️ Overdue | PM-01, CL-16, CL-48 (C-CDA R2.1 document format per §170.315(b)(1)) | — | — | Align demographics and export scope with USCDI v3 in new development; certification pathway documented in ONC_CERTIFICATION_ROADMAP.md. CL-48 addresses C-CDA R2.1 generation for Transitions of Care (§170.315(b)(1)). |
| Arizona CSPMP (PDMP) EMR integration | Dec 31, 2026 | 🏗️ Adapter shipped (85%) — vendor go-live pending | CL-17 / CL-17-EN-01 — CL-17 Arizona CSPMP/PDMP | Vendor-Selection Lead | — | Vendor-agnostic adapter shipped (#1964): PdmpAdapter seam + report persistence + fail-closed go-live gate (pdmp_adapter_enabled, off until vendor contract + BAA — EN-20). Go-live = file the AZ Integration Interest Form (Bamboo Customer Connect; state-funded, $0 license, new-vendor onboarding “weeks–months” — lead time is the deadline risk, START NOW), then config + vault credential + Bamboo XML call. Interim: AWARxE portal link-out + in-chart manual attestation satisfies the prescriber duty (§ 36-2606(F); AMPM 940 evidence in chart). ⚠️ Laws 2026 Ch. 94 (eff. 2026-09-12) reletters (F)→(E) / (I)→(H) and tightens the prescriber duty to EVERY prescription and refill. Research: specs/cl/research/CL-17-EN-01-RESEARCH.md. |
| HHS Section 504 WCAG 2.1 AA (web accessibility) | May 2026 | 🟡 In Progress — Owner: Accessibility Lead (Escalated, weekly updates until May 11, 2026) | CL-26, EN-64 — CL-26-EN-64 multi-language portal | Accessibility Lead | 2026-05-11 | Wave 1 (HIGH-priority). Weekly status updates until May 11, 2026. Immediate task: run WCAG 2.1 AA gap analysis (keyboard navigation, screen-reader checks, form labels, contrast fixes) linked to CL-26-EN-64. Acceptance criteria: portal meets WCAG 2.1 AA; multi-language support per EN-64. |
| HIPAA EDI — Clearinghouse Transport (45 CFR 162 X12 5010 compliance; 45 CFR 164.312(e)(2)(ii) PHI encryption in transit; 45 CFR 164.312(a)(2)(iv) credential encryption at rest; 45 CFR 164.312(b) audit controls) | Ongoing | ✅ Implemented | PM-15-P2 — PM-15-P2 Production Clearinghouse Transport | — | 2026-04-09 | PM-15-P2 implements REST-only transport for live X12 5010 claim submission (837P), ERA retrieval (835), eligibility (270/271), acknowledgment processing (999, 277CA), and connection health monitoring. Waystar OAuth2 via Edge Function Secrets. SFTP deferred (Deno Deploy incompatible). 72 unit tests passing. Evidence: docs/compliance/evidence/PM-15-P2-HIPAA-EDI-EVIDENCE.md. Sign-off: specs/pm/PM-15-P2-COMPLIANCE-SIGNOFF.md. |
| HIPAA EDI — Multi-vendor clearinghouse failover (45 CFR 162 X12 5010 continuity; 45 CFR 164.312(a)/(b)/(e) access, audit, transmission safeguards; 45 CFR 164.308(b)(1), 164.502(e) BAA controls) | Ongoing (go-live gate before non-Waystar PHI traffic) | ✅ Implemented (Waystar live; Availity / Change Healthcare gated by BAA) | PM-15-P2-EN-01 — PM-15-P2-EN-01 Clearinghouse Multi-Vendor Failover · Plan · Tasks · Context | PM / Compliance / Security | 2026-05-15 | Adds Availity / Change Healthcare adapter stubs (PHI-blocked until BAA recorded), per-payer route overrides (pm_payer_clearinghouse_routes), and health-based failover with configurable threshold. Routing precedence (payer_override → primary → secondary) implemented as pure resolveVendorRoute() with unit tests. BAA gate enforced in FailoverSettingsCard against pm_clearinghouse_config.custom_fields.baa_approved_vendors. Audit controls: config saves emit failover_config_change; runtime route flips emit clearinghouse_route_failover via resolveVendorRouteWithAudit() (in-memory dedupe per org+payer; PHI-free). Tenant isolation: RLS test tests/rls/pm/pm-clearinghouse-failover.test.ts. Seed data: supabase/seeds/pm/pm-15-p2-en-01-test-data.sql. Evidence: docs/compliance/evidence/PM-15-P2-EN-01-HIPAA-EDI-FAILOVER-EVIDENCE.md. Sign-off: PM-15-P2-EN-01-COMPLIANCE-SIGNOFF.md. Follow-ups (logged in specs/pm/IMPLEMENTATION_LOG.md): mobile Sheet variant, shared <EmptyState />, server-side router audit when submission moves to edge functions, dedicated pm_clearinghouse_baa_approvals table. |
| HIPAA EDI / CMS COB / AHCCCS Crossover (X12 837P/837I COB segments; 42 CFR Part 411 MSP; AHCCCS crossover procedures) | Ongoing | ✅ Implemented | PM-30 — PM-30 COB & Secondary Claims | — | — | PM-30 implemented: COB priority order, secondary/tertiary 837P/837I claim generation with COB2300/COB2400 segments, Medicare–AHCCCS dual-eligible crossover routing, and secondary ERA posting. Completed 2026-03-27. MSP situation enumeration (42 CFR Part 411) deferred to post-MVP (see PM-30 Known Limitations). Two pending compliance sign-off items: (1) crossover_routing = 'manual' default acceptable for rollout; (2) MSP reason code not required in MVP COB segments. |
| HRSA FQHC Sliding Fee / Financial Counseling (42 USC § 254b; HRSA PIN 2014-02) | Ongoing | 📋 Specification | PM-32, PM-21 | — | — | PM-32 specifies financial counseling workflow (income/FPL collection, assistance program referral tracking, charity care applications with board-approved policy tiers). PM-21 provides sliding fee schedule and discount application. HRSA compliance features (income verification enforcement, annual review reminder) configurable per org via PM-28. Pending: Compliance officer HRSA & HIPAA review required before Phase 1 implementation. |
| CMS-0057-F (Prior auth APIs) | Jan 1, 2027 (Medicaid MC) | ⏳ Not Started | PM-10 | — | — | Continue manual/portal prior auth; implement Da Vinci CRD/DTR/PAS per PM-10 plan. |
| HTI-4 NCPDP SCRIPT 2023011 | Dec 31, 2027 | ⏳ Not Started | CL-06 | — | — | Use current Surescripts version; plan SCRIPT transition in CL-06. |
| AHCCCS Policy 320-O, 940 | Ongoing | 🟡 Partial | CL-02, CL-04, CL-04-EN-66 (canonical Policy 940 gate, 📋 Specification), CL-36 (AI-assisted note quality; delegates to EN-66 for Policy 940 validation, Phase 2, 📋 Specification); CL-40 (intake 18-element assessment + compliance dashboard, 📋 Specification); CL-55 (virtual group modifier/contingency documentation, 📋 Specification); PM-34 (eligibility at encounter, ✅ Complete); PM-41 (intake funnel analytics — AHCCCS 48-72h scheduling compliance report, ⏳ Not started / Draft / 0%) | — | — | Implement per CL specs; 18-element assessment and progress note elements required. PM-34 is implemented: encounter-level eligibility verification (AHCCCS Policy 940) with auto-trigger 270/271 at check-in (see specs/pm/IMPLEMENTATION_LOG.md PM-34). CL-04-EN-66 is the canonical pre-finalize Policy 940 validation: Phase 1 covers 6 high-risk elements; Phase 2 adds remaining 6 categories (see CL-04-EN-66 Clarification #5). INSERT-only override audit; 6-year HIPAA retention; pf_organizations.ahcccs_contracted enforces FR-8. CL-55 uses PF-96/PF-70 for virtual group modifier suggestions (Arizona profile result 95 + HQ; non-Arizona/state-neutral profiles must not inherit AHCCCS constants) and requires contingency documentation before virtual group start. CL-36 delegates to EN-66 (or shared validatePolicy940) for Policy 940 validation; enforcement modes aligned; single org config. PM-41 is spec only (not implemented): planned AHCCCS AMPM 320-O lead-to-appointment latency reporting, configurable compliance window, and CSV export with exception reasons—interim: no automated compliance audit from PM-41 until implementation; use manual reporting as needed. |
| HIPAA — Coverage Discovery Vendor BAA (45 CFR 164.502(e), 164.308(b)(1); 45 CFR 164.312(e)(2)(ii) TLS; 42 CFR Part 2 §2.31 no SUD context) | Before Phase 1 go-live | 📋 Specification | PM-60 — PM-60 Coverage Discovery | Compliance Officer / IT Security | — | PM-60 sends patient PII (name, DOB, optional SSN) to coverage discovery vendor (Waystar/pVerify/Inovalon). BAA must be signed before production traffic. SSN consent gated per PF-96 jurisdiction profile. No clinical/SUD context sent to vendor (42 CFR Part 2 defense-in-depth). Compliance sign-off: PM-60-COMPLIANCE-SIGNOFF.md. |
| HIPAA 45 CFR 164 — Lead Insurance PHI (CE intake) (45 CFR 164.312(a) access control, (b) audit controls, (e)(2) transmission integrity; 164.502(b) minimum-necessary) | Ongoing | ✅ Compliant (Approved with conditions 2026-06-15) | CE-71 — CE-71 Lead Insurance Capture | CE / Compliance Officer | — | CE-71 captures pre-conversion lead insurance (payer_picklist_value, plaintext member_id PHI, coverage dates) in ce_lead_insurance. member_id follows the CE-65 pattern: plaintext storage + UI masking (insurance-mask.ts) + permission-gated Reveal that emits an append-only ce_lead_insurance_access_audit row (no column crypto). Two-leg RLS: org scope (ce_has_org_access) AND PHI role (pf_has_permission), FORCE RLS, anon REVOKE (AC-7/AC-8). PHI never crosses the event bus — conversion re-reads server-side (IDs-only payload, AC-5). 42 CFR Part 2 N/A: no SUD context at the lead stage; Part 2 boundary preserved downstream at PM/CL. Minimum-necessary exception (condition c): the member_id grant currently includes generic staff (per NFR-sec-1: intake/partnerships/billing roles) because no dedicated intake role exists in app_role; narrow when one is added (ref migration 20260614210200). Sign-off: CE-71-COMPLIANCE-SIGNOFF.md; findings: CE-71-COMPLIANCE-REVIEW-2026-06-15.md. Verification tail before spec-complete: AC-5 local-serve pass + a11y/docshots/browser-autoheal (pipeline-ordered; CE-71 stays status: draft until those land). |
| HIPAA — AI Vendor BAA (45 CFR 164.502(e), 164.308(b)(1)) | Before Phase 1 go-live | 🟡 Partial — Vercel Gateway BAA + ZDR confirmed 2026-05-29; Langfuse trace store metadata-only (no BAA required under current posture); model vendors (Anthropic/OpenAI) covered transitively through Gateway | CL-36, PM-64, PF-111 | Compliance Officer | — | Three-subprocessor chain (see AI_SUBPROCESSOR_BAA_POSTURE.md): (1) Vercel AI Gateway — BAA in place + Zero-Data-Retention confirmed 2026-05-29; all PHI-lane traffic routes through the single gateway seam (vercel-gateway.ts); only BAA-confirmed models in PHI_MODELS (cl/pm modules); fail-closed PhiLaneNotConfiguredError for any unconfigured module. (2) Langfuse Cloud — no BAA executed; acceptable under current metadata-only posture: prompt/response content is never attached to observations (invariant enforced in tracing.ts; live-verified 2026-06-03); tracing-mask.ts mask() is a defense-in-depth backstop (SSN/email/phone/CC only — not a de-identification engine). A Langfuse BAA + switch to hipaa.cloud.langfuse.com is a hard prerequisite before any content capture is ever enabled. Note: Langfuse Cloud has no configurable retention cap (EE-gated, Encore has no EE) — acceptable only while no PHI content is sent. (3) Model vendors (Anthropic claude-sonnet-4.6, OpenAI gpt-4o) — covered transitively by Vercel Gateway BAA + ZDR. Ops recommendation: rotate LANGFUSE_BASE_URL secret to https://us.cloud.langfuse.com for US residency alignment (currently defaults to EU). |
| HIPAA — Google Workspace Vendor BAA (45 CFR 164.502(e), 164.308(b)(1); Google Workspace/Cloud Identity HIPAA terms) | Before PHI-capable Workspace features enabled per tenant | 🏗️ Scaffolded | PF-101 — PF-101 Google Workspace Integration · Integration doc | Compliance Officer | — | PF-101 connector (38/44 tasks; tables baselined) enforces a fail-closed BAA gate: PHI-capable Gmail/Calendar/Drive/Chat/Meet operations are blocked unless pf_google_workspace_connections.baa_attested_at is set and the capability flag is enabled (assertCapabilityAllowed). Chat PHI is always blocked in MVP. Third-party apps are not automatically covered by Google’s BAA — Encore maintains its own vendor posture (see docs/integrations/GOOGLE_WORKSPACE_COMPLIANCE.md, security review docs/integrations/GOOGLE_WORKSPACE_SECURITY_REVIEW.md, ✅ approved for staging 2026-04-28). Interim: existing Gmail/Calendar flows use non-PHI data until tenant BAA attestation is recorded. |
| HIPAA — AI Coding Assistant (45 CFR 164.312 Security; 164.514 De-identification; 42 CFR Part 2 §2.31 SUD consent; HHS healthcare AI guidance; NIST AI RMF) | Before Phase 1 go-live | 📋 Specification | PM-64 — PM-64 AI Coding Assistant | Compliance Officer / Security / IT | — | PM-64 AI-powered coding assistant: PHI-redacted (Safe Harbor 18 identifiers) note metadata to LLM; fail-closed redaction; suggest-not-execute mandate; immutable audit trail (DELETE forbidden, 7-year retention); SUD consent check (FR-009, 42 CFR Part 2 §2.31); fairness monitoring (PM-50-EN-01); jurisdiction-specific coding rules via PF-96. Tables: pm_ai_coding_suggestions, pm_ai_coding_suggestion_audits. Compliance sign-off: PM-64-COMPLIANCE-SIGNOFF.md. |
| HIPAA — Telehealth Vendor BAA (45 CFR 164.502(e), 164.308(b)(1), 164.312(e)) | Before PHI-bearing telehealth go-live | 🟡 Partial / Pending sign-off | PM-13, CL-24 (clinical compliance wrapper — does NOT replace BAA boundary; links UUID-only PM-13 session references), CL-55 | Security / Compliance Officer | — | PM-13 owns telehealth vendor configuration, durable join URLs, session lifecycle, and platform credentials. CL-24 adds per-session compliance metadata (consent, safety checklist, jurisdiction, connectivity) on top of the PM-13 vendor session; CL-24 does not store vendor join URLs and references PM-13 sessions only by UUID. CL-55 may link UUID-only PM-13 session references but must not enable PHI-bearing virtual group or multi-party video workflows until vendor BAA coverage and encrypted transmission controls are verified in specs/cl/reviews/CL-55-COMPLIANCE-SIGNOFF.md. Interim: do not use unverified telehealth vendors for CL-55 PHI-bearing sessions. |
| HIPAA — WENO EZ e-Prescribing Vendor BAA (45 CFR 164.502(e), 164.504(e); 45 CFR 164.308/310/312; 42 CFR Part 2 SUD gating) | Before production enablement | 📋 Risk Assessment Complete (BAA pending) | CL-06-EN-23 — CL-06-EN-23 WENO EZ Integration Adapter; Spec | Compliance Officer / Security | — | Risk Assessment: WENO-HIPAA-RISK-ASSESSMENT.md documents threat/safeguard mapping per HIPAA Security Rule (45 CFR §164.308/310/312) and satisfies Test Plan §10. BAA Prerequisite: Signed HIPAA BAA with WENO Online, Inc. required before weno_adapter_enabled = true in production; BAA execution date recorded in cl_module_settings.custom_fields.weno_baa_executed_date. Technical Controls: Server-side credential vault (SECURITY DEFINER RPCs), AES-256-CBC payload encryption, 42 CFR Part 2 SUD consent gating via cl_check_sud_consent(), immutable audit trails (2-year PF-04 retention), multi-tenant RLS. Residual Risks: Per-prescriber credential audit trail missing (post-MVP); breach escalation SOP not yet in UI; fixed IV + shared EZ key (vendor constraint; post-MVP annual rotation). Interim: All WENO operations blocked by production gate weno_adapter_enabled = false. |
| Joint Commission CAMBHC | Survey cycle | 🟡 Partial | CL-01, CL-07, CL-07-EN-01, CL-24 (NPSG.15.01.01 — pre-session safety checklist for 1:1 telehealth: patient-current-location verification, local-emergency-number capture, disconnect-protocol acknowledgement; ✅ Phase 1 shipped 2026-05-28), CL-55, etc. | — | — | Align documentation and safety (NPSG.15.01.01) per CL specs. CL-24 adds the per-session safety record for 1:1 telehealth (audit-immutable connectivity issues + safety-checklist completion event; jurisdiction-mismatch banner). CL-07-EN-01 adds Zero Suicide Framework lethal means assessment and safety plan sharing per NPSG.15.01.01. CL-55 adds virtual group technology contingency, backup site, and emergency contact verification requirements. |
| EEOC UGESP (29 CFR 1607) — Internal selection / promotion audit trail | Ongoing | ✅ Implemented (Phase 1, 2026-05-22) | HR-35 — HR-35 Internal Mobility & Talent Marketplace | HR Director | — | HR-35 Phase 1 ships hr_internal_applications, hr_internal_application_stage_audit, hr_employee_transfers with RLS + WITH CHECK; manager-notify defaults OFF for employee privacy; disposition codes bound to PF-15 picklist hr_application_disposition (8 EEOC-aligned defaults seeded via pf_picklist_default_definitions on 2026-05-22); transfer execution requires approved HR-15 pay_change_id when internal_mobility_require_pay_approval_before_transfer = true (CAC-006). PHI-free domain events (hr.internal_application.submitted, hr.internal_application.advanced, hr.employee.transferred) registered in KnownEventName. Evidence: docs/compliance/evidence/HR-35-eeo-internal-selection-EVIDENCE.md. Deferred: US-4 compliance CSV export, adverse-impact (4/5ths rule) reporting. HR Director sign-off pending (specs/hr/reviews/HR-35-COMPLIANCE-SIGNOFF.md). |
| HTI-2 TEFCA | Emerging (2027) | ⏳ Not Started | CL-16, CL-16-EN-01 | — | — | TEFCA/QHIN enhancement scoped in CL-16-EN-01; continue CL-16 baseline interoperability controls until TEFCA transport and policy gates are implemented. |
| 42 CFR Part 8 (OTP) | Ongoing | ✅ Core Complete | Event consumers pending | PM-31 billing 📋 Specification | CL-34 UDS workflow 📋 Specification | CL-55 virtual OTP group documentation 📋 Specification | CL-21, CL-34, CL-55, PM-31 | — | — | MAT implemented; event consumers (cl_moud_monitoring_overdue, cl_moud_adherence_risk) pending — see High-priority event consumers below. Full OTP standards via enhancement EN-51 (CL-21). CL-34 adds dedicated UDS workflow with chain-of-custody (§8.12(f)(1): ≥8 tests/year/patient), presumptive/definitive ordering, and OTP rolling-year count reporting (Phase 3). CL-55 documents OTP-relevant virtual group modality, participant evidence, and contingency requirements when the virtual group is OTP-related. PM-31 adds OTP/MAT-specific billing (G2067–G2080, G2215/G2216, H0020, T1012; Medicare + AHCCCS billing periods); status: 📋 Specification. Compliance sign-off: PM-31-COMPLIANCE-SIGNOFF.md. |
| AHCCCS IAD dual-track | Ongoing | 🟡 Partial | CL-15, CL-15-P2-3 (Phase 2.1) | — | — | AZDHS deadlines implemented (Phase 1); AHCCCS Policy 961 dual-track specified in CL-15 Phase 2.1 (CL-15-PHASE-2-3-EXPANSION.md): org-configurable track selection (AZDHS/AHCCCS/dual), business-day definitions, sentinel classification. Compliance sign-off: specs/cl/reviews/CL-15-PHASE-2-3-COMPLIANCE-SIGNOFF.md. |
| NCQA HEDIS FUH/FUM/FUA/FUI (Follow-Up After Hospitalization / ED Visit for Mental Illness — MY 2025; ED-for-SUD / High-Intensity-SUD follow-up — MY 2025 + MY 2026) | 2026-03-31 17:00 MST (submission). Escalation: 2026-03-24 12:00 MST | 📋 Specification (plan + tasks ready for EN-65; EN-66 compliance_reviewed) | CL-29-EN-65 (FUH/FUM), CL-29-EN-66 (FUA/FUI MY2025+MY2026 via PF-96; compliance_reviewed 2026-05-28; consumes PF-108 Contexture ADT for out-of-network ED denominator), CL-15, CL-35 | Quality Team / Revenue Cycle | 2026-03-24 12:00 MST | Final MY 2025 reporting deadline: June 15, 2026 (9:00 PM ET). 42 CFR Part 2 implementation: 0% until consent/QSOA logic enforced and verified. CL-29-EN-65 status: Spec complete; plan + tasks ready; 13 tasks across 4 phases; ~9 days effort. CL-29-EN-66 status: compliance_reviewed 2026-05-28; awaiting AC-draft / plan. Interim: (1) June 1 plan-locked data snapshot; audit-ready manual extraction methodology. (2) Confirm HOQ (House of Quality) submission with Revenue Cycle/Contracts. (3) Enforce Part 2 compliance before payer-facing export. (4) Per-MY NCQA value-set OIDs require NCQA-portal acquisition at CL-29-EN-66 plan stage. ⚠️ 42 CFR Part 2 review required before enabling payer-facing SUD-diagnosis-based export (authorization or QSOA) — applies to both EN-65 and EN-66. Specs: CL-29-EN-65, CL-29-EN-66. |
| CMS Medicaid Adult Core Set — FUA-AD mandatory reporting (SUPPORT Act §5001; FFY 2024+ mandatory for 50 states + DC + territories) | Annual FFY reporting cycle | 📋 Specification | CL-29-EN-66 (compliance_reviewed 2026-05-28) | Quality Team / Compliance | — | FUA-AD is on the mandatory Adult Core Set starting FFY 2024 per SUPPORT Act §5001. CL-29-EN-66 produces the data side (CL-51 eCQM engine registration + dashboard); state submission cadence + format owned by Quality Team operationally. Interim: manual extraction for any FFY reporting window before CL-29-EN-66 implementation. |
| NCQA HEDIS FUA/FUI — CL-29-EN-66 (SUD ED & high-intensity follow-up) (NCQA HEDIS FUA/FUI MY2025 + MY2026; CMS Medicaid Adult Core Set / SUPPORT Act §5001; 42 CFR Part 2; HIPAA 45 CFR 164; AHCCCS DAP; Information Blocking / 21st Century Cures) | FFY Adult Core Set reporting cycle; AHCCCS DAP per payment year | 🏗️ Scaffolded — implementation complete on branch feat/cl-29-en-66-fua-fui; spec stays draft; human-merge, NEVER auto-merge (regulated CL/SUD core) | CL-29-EN-66 (integration, DS4P trace, admin guide, spec, sign-off), CL-51, CL-35, PF-96, PF-108 | Quality Team / Compliance / CL | — | FUA/FUI 7-day + 30-day rates; MY2025↔MY2026 selected from PF-96 at evaluation time; FUA from crisis/evaluation (+SUD) + PF-108 ADT, FUI from residential_daily — interim proxy behind PF-96, canonical PM-03 path stubbed TODO(PM-03). Four human-verify-open gates — fail-closed-shipped (sign-off items 6 / 10a-b / 10c / 8): (1) Gate 6 (item 6): ships a CL-51 measure-spec loader with zero NCQA codes inline (NFR-config-1); human must load per-MY (MY2025 + MY2026) NCQA value-set OIDs from the licensed NCQA portal into the CL-51 registry before denominator logic ships to prod. (2) Gate 10a-b (item 10a-b): cl_fua_payer_export_gate() fail-closes any payer/AHCCCS-facing SUD export at the DB unless active cl_check_sud_consent() + org-enabled payer export, writing the CL-11 redisclosure log on every permitted disclosure; internal org-scoped computation allowed, payer-facing export disabled until live; human must confirm a valid TPO consent / authorization / QSOA basis and that ADT events are not stored with identifiable SUD dx absent active Part 2 consent. (3) Gate 10c (item 10c): DS4P label propagation is now documented (T2/T4.2 trace CL-29-EN-66-DS4P-PROPAGATION — DB fail-close ds4p_security_label = 42CFRPart2,ETH|NORDSLCD, TS↔DB SSOT drift-trap, BLOCKING-before-payer-export); live PF-108 / Contexture feed end-to-end propagation remains human-verify-open (PF-108 is a planning stub). (4) Gate 8 (item 8): per-year AHCCCS DAP FUA/FUI measure weighting externalized to PF-96; human must obtain AHCCCS QM-team confirmation and record it here before the first DAP submission using platform rates. Closed residual: FUI age-floor ≥13 is enforced in code (FUA_MIN_AGE = FUI_MIN_AGE = 13, sign-off residual item 4). Interim (until gates clear): manual FUA/FUI rate extraction for any reporting window; maintain the same 42 CFR Part 2 payer-export gate as CL-29-EN-65. Sign-off: CL-29-EN-66-COMPLIANCE-SIGNOFF.md (Approved with Conditions). |
| CMS Care-Management Billing (BHI 99484; CoCM 99492/99493/99494/G2214; CCM 99490/99439/99491 + complex 99487/99489; PCM 99424–99427; SDOH G0136; MLN909432, MLN909188) | Ongoing | 📋 Specification (compliance_reviewed 2026-05-28; conditional pass) | PM-75 — PM-75 Care-Management Billing Engine | Billing Compliance / PM | — | PM-75 implements per-code-family time-threshold + credential gates with auto-post on gate-pass (per-org/per-payer kill switch + 100% immutable gate-evaluation audit with rule snapshot per NFR-audit-1/NFR-determinism-1). CMS mutually-exclusive-billing rules (no CoCM + BHI same month) enforced via concurrent-billing guardrail. CoCM auto-post requires active CL-54-EN-01 registry membership AND psychiatric-consultant evidence (US-7). AHCCCS / MCO coverage variance via payer-policy table consumed through PF-96 (no hardcoded constants). ONC §170.315(b)(11) DSI documented N/A (deterministic rule engine, not predictive). Conditions (before implementation plan): (1) human extraction of MLN909432 / MLN909188 verbatim thresholds from canonical PDFs to close [HUMAN-VERIFY] items in research appendix §5; (2) AZ MCO payer-policy seed accuracy is the deploying org’s operational responsibility per Admin Guide. Sign-off: PM-75-COMPLIANCE-SIGNOFF.md. |
| Psychotherapy notes (HIPAA 45 CFR 164.501) | Ongoing | ⏳ Not Started | CL-30 (proposed) | — | — | Do not document psychotherapy process notes in the EHR; maintain separate locked paper/electronic files with restricted access and exclusion from exports until CL-30 is implemented. Enforced by: Compliance/Privacy Officer. |
| 21 CFR Part 1304 (Controlled substance recordkeeping) | Ongoing | ✅ Compliant | CL-06 EN-21 | — | — | Implemented via cl_controlled_substance_inventory table: Schedule II-V tracking, transaction types (receive/dispense/adjust/count/return/destroy), witness requirement for Schedule II dispensing, lot/expiration tracking, audit trail. Route: /cl/controlled-substances. |
| 21 USC § 827 / DEA ARCOS (Automation of Reports) | Ongoing | ✅ Compliant | CL-06 EN-22 | — | — | Implemented via cl_arcos_report_view mapping inventory transactions to ARCOS categories (Receipt/Distribution/Return to Supplier/Destruction). CSV export with date range filter, permission-gated to cl.inventory.admin, audit-logged to pf_audit_logs. |
| Telehealth compliance | Ongoing | 🟡 Partial | CL-24 (clinical compliance layer — consent, safety checklist, jurisdiction, connectivity; ✅ Phase 1 shipped 2026-05-28 — stage-1 surface-only rollout), CL-55 (virtual group / multi-party telehealth, 📋 Specification), PM-13 (session lifecycle) | — | — | Basic modality in CL-04; CL-24 Phase 1 shipped 2026-05-28 with cl_telehealth_consents, cl_telehealth_sessions, daily expiry cron, and four PHI-free domain events (CL-24 integration contract, user guide, admin guide). Currently in stage-1 (surface-only); stage-3 hard-block on consent gated on AZ ARS 13-3005 template sign-off. CL-55 extends telehealth controls to virtual groups and multi-party encounters while PM-13 owns vendor/session lifecycle, durable join URLs, platform credentials, and BAA boundary. Interim (CL-55 only): manually document virtual group modality, contingency plan, and recording consent until CL-55 ships; do not store durable join URLs or recording URLs in CL tables. |
| AHCCCS Telehealth — CBHSG Chapter (Oct 2025 update; consent, originating site, audio-only modifier FQ, jurisdiction) | Ongoing | 🟡 Partial | CL-24 (✅ Phase 1 shipped 2026-05-28 — per-patient consent with annual renewal, audio-only consent distinct from general consent, jurisdiction-mismatch banner, compliance dashboard), PM-13 (session lifecycle), PM-07 (modifier FQ from clinical_note_finalized) | Compliance / Clinical | — | CL-24 Phase 1 shipped 2026-05-28 addresses the consent-capture and per-session evidence requirements of the AHCCCS CBHSG Oct 2025 telehealth chapter. Two consent types (telehealth_general, audio_only); annual renewal default 365 days (org-configurable via telehealth_consent_validity_days); audit-immutable revocation via trigger; consent-language version lineage. The FQ modifier is still emitted by PM-07 from CL-04’s clinical_note_finalized event — CL-24 does not publish modifier data (CL-PM-TELEHEALTH, CL-24 integration contract). Stage-3 hard-block on consent gated on AHCCCS Policy 320-O reconciliation and AZ ARS 13-3005 template sign-off. |
| CCBHC v2 telehealth (SAMHSA CCBHC Certification Criteria v2 — telehealth as a same-day-access modality with documented modality and connectivity per encounter) | Per grant cycle | 🟡 Partial | CL-24 (✅ Phase 1 shipped 2026-05-28 — per-session modality + connectivity-issue log + jurisdiction), CL-04, CL-55 (virtual group / multi-party CCBHC services; 📋 Specification), CL-51-EN-01 (CCBHC-E quality measures) | CCBHC Lead / Quality | — | CL-24 Phase 1 shipped 2026-05-28 records the per-session modality (synchronous_video, synchronous_audio_only, asynchronous, remote_monitoring), connectivity issues (JSONB append-only), and patient/provider state on cl_telehealth_sessions. Compliance dashboard surfaces audio-only ratio and connectivity-issue counts at the org level for CCBHC v2 evidence (admin guide § compliance dashboard). CCBHC-E quality measures consumed from CL-51-EN-01 (no recomputation in CL-24). CL-55 extends to virtual group / multi-party CCBHC services. |
| Arizona recording notice / ARS 13-3005 | Per recording | 📋 Specification / Pending sign-off | CL-24 (1:1 telehealth consent language with versioned consent_language_version lineage; ✅ Phase 1 shipped 2026-05-28), CL-55 (virtual group / multi-party recordings; 📋 Specification), CE-10 | Compliance / Privacy Officer | — | CL-24 stores consent_language_version per consent row (audit-immutable lineage) and inherits the active AZ template from pf_organizations.state = 'AZ' orgs. Stage-3 rollout (consent hard-block) is gated on AZ template sign-off in specs/cl/reviews/CL-24-COMPLIANCE-SIGNOFF.md — see admin guide § ARS 13-3005 sign-off. CL-55 requires ARS 13-3005 recording-notice language and participant sign-off evidence for virtual group recordings, but final user-facing copy remains pending in specs/cl/reviews/CL-55-COMPLIANCE-SIGNOFF.md. Interim: do not enable CL-55 recording unless notice/sign-off evidence is manually documented and approved by compliance/privacy. |
| Information blocking (21st Century Cures) | Ongoing | Escalated / In Progress | CL-16, CL-26, CL-48 (C-CDA document generation and Direct messaging transmission to external providers; Part 2 SUD exclusion documented as §171.202 privacy exception; 📋 Specification) | Compliance / Health Information | 2026-06-30 | Risk: Potential civil penalties and CMS implications if blocking occurs. Interim: Manual approval workflow for patient data requests; designate a point-of-contact (e.g. ROI/Health Information); provide/redact data per request (paper, secure portal, or encrypted copy) until FHIR/portal are live. Document requests and fulfillment. CL-48 planned: C-CDA generation provides machine-readable document exchange via Direct messaging; Part 2 SUD data exclusion is a recognized privacy exception per 45 CFR §171.202. |
| Restraint/seclusion (42 CFR 482.13(e)) | Ongoing | ⏳ Not Started | CL-13 | — | — | Interim: Staff must document every restraint/seclusion per facility forms; retain records per state/facility policy (e.g. 5+ years). Report incidents per facility policy to designated contacts (e.g. Risk Management, State survey agency). Implement CL-13 Crisis Intervention Documentation when spec is implemented. |
| TCPA / FDCPA / PCI DSS — Patient Collections (47 USC § 227 automated SMS; 15 USC § 1692 debt collection; PCI DSS SAQ-A) | Ongoing | 📋 Specification | PM-45 — PM-45 Patient Payment Plans & Collections | Revenue Cycle / Compliance | — | PM-45 specifies TCPA-compliant opt-out tracking (pm_patient_communication_preferences), FDCPA-required notice content per aging tier, and PCI compliance (no card data in PM-45 tables; tokenized payment method references only). Pending: FDCPA notice template content review by compliance officer before collections reminders are enabled. Compliance sign-off: PM-45-COMPLIANCE-SIGNOFF.md. |
| No Surprises Act / Good Faith Estimate | January 1, 2022 | ✅ Complete | PM-20 | Revenue Cycle | 2026-02-28 | GFE generation from appointment type + CPT + fee schedule; 1/3-business-day delivery compliance; acknowledgment tracking; $400+ dispute workflow. Implemented 2026-02-28. |
| HIPAA — PF PHI-bearing tables | Ongoing | ✅ Compliant | PF-71 | — | — | pf_patient_identities stores MRN (HIPAA PHI per 45 CFR 164.514). Protected by org-scoped RLS (pf_has_org_access), admin-only DELETE (pf_is_org_admin), and audit columns (created_by/updated_by). Data minimization: only id + org_id + mrn stored. |
| HIPAA Security Rule — Contingency Plan (45 CFR 164.308(a)(7): backup, disaster recovery, emergency mode, testing) | Ongoing | ⏳ Not Started | PF-90 — PF-90 DR & BCP | Platform / Compliance | — | Interim: Rely on Supabase project backups and provider runbooks; document manual recovery steps. Target: PF-90 application-layer RTO/RPO policies, encrypted offsite artifacts, tenant-scoped restore workflows, quarterly drills, and compliance evidence packages. Integration: PF-90 Integration. |
95 + HQ is a profile result, not a universal constant. |
| CL-35 Population Health & Care Gap Management (AHCCCS VBP; NCQA HEDIS AMM/IET; CMS MA STARS BH; SAMHSA CCBHC; CARF; HIPAA Privacy 45 CFR 164.514(b); 42 CFR Part 2) | Ongoing | ✅ Implemented | CL-35 — CL-35 Population Health; FUH/FUM consumed from CL-29-EN-65 | CL / Quality Team | — | AHCCCS VBP: population dashboards + cl-vbp-export CSV with required aggregate columns (org/measure/period/denominator/numerator/rate). NCQA HEDIS: AMM/IET implemented per MY 2026 thresholds (84/180/14/2 days), versioned JSON seed definitions under supabase/seeds/cl_hedis_measure_definitions/, calculator edge function cl-hedis-calculator UPSERTs into cl_quality_measure_periods and emits cl_quality_measure_period_calculated. FUH/FUM owned by CL-29-EN-65 (no duplicate logic). CMS MA STARS: separate MA_STARS variants in seed files; Quality Measures page renders dedicated MA STARS tab. SAMHSA CCBHC: systematic care gap work list, clinician panels, supervisor view, proactive identification of overdue assessments / missing follow-ups / due screenings. CARF: aggregate population dashboard with risk-tier distribution and outcome trends for data-driven program evaluation. HIPAA Privacy: applySmallCellSuppression (n < 5 → <5) on every aggregate hook + edge function; CSV export contains no chart_id/patient_id/mrn; logger sanitization verified statically. 42 CFR Part 2: calculateRiskScore excludes the MOUD component and proportionally redistributes weight when cl_check_sud_consent is false; MOUD never exposed as a dashboard disaggregation dimension. Tests: 30 + integration tests under tests/integration/cl/cl35-compliance-*.test.ts. User guide: docs/cl/population-health-user-guide.md. Admin guide: docs/cl/population-health-admin-guide.md. Integration: CL-35, CL–FA VBP, CL–FW Events. |
High-priority event consumers (patient safety / compliance)
| Item | Responsible Spec | Status | Owner | Target date | Notes |
|---|---|---|---|---|---|
cl_moud_monitoring_overdue | CL-21 | ⏳ No consumer | Engineering / CL | 2026-05-31 | Implement reliable consumer/alerting (test cases, monitoring/SLAs); cron or event consumer; verify in REGULATORY_COMPLIANCE_TRACKER and ARCH-NOTES. |
cl_moud_adherence_risk | CL-21 | ⏳ No consumer | Engineering / CL | 2026-05-31 | Same as above; prioritize with cl_moud_monitoring_overdue. |
cl_assessment_completed (PM-07) | CL-02, PM-07 | ⏳ Consumer not verified | PM / Billing | 2026-06-30 | Next priority after MOUD events; verify consumer for charge-capture; prevents silent charge-capture failures. |
cl_group_session_documented (PM-07) | CL-14, CL-14-EN-01, PM-07 | 🟡 CL-14-EN-01 adds new subscriber for encounter generation; PM-07 consumer TBD | PM / Billing | 2026-06-30 | CL-14-EN-01 subscribes to cl_group_session_documented for encounter generation; PM-07 consumer still needs verification. Event name corrected from cl_group_session_completed per CL-PM-GROUP-SESSIONS.md contract. |
HR module — Human Resources Workforce Compliance
Status: Tracked below. Detailed requirements, spec mapping, and authoritative references: HR_WORKFORCE_COMPLIANCE_TRACKING.md. FCRA/TCPA gates: FCRA_TCPA_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| FLSA (minimum wage, overtime, classification) | Ongoing | 🟡 Partial | HR-05, HR-05-EN-10, HR-07, HR-29 | — | — | Time tracking and payroll in place; HR-05-EN-10 adds employer-initiated correction audit trail (PF-04 punch_correction / punch_insert / timesheet_admin_override) satisfying 29 CFR §516 correction recordkeeping. HR-29 provides FLSA classification engine (exempt/non-exempt per 29 CFR 541), duties test documentation, salary threshold monitoring, reclassification workflow, and DOL audit reports. Arizona minimum wage tracking needed in HR-07. |
| State privacy — precise geolocation retention (CPRA §1798.121 sensitive PI; state comprehensive privacy laws) | Before prod-at-scale | ⏳ Not Started | HR-05 | — | — | HR-05 clock-in captures precise geolocation (lat/lng) as sensitive PII. NFR-misc-5 declares 90-day retention but no purge job exists — coordinates retained indefinitely. Interim: RLS-restricted (employee/manager/HR-admin only); coordinates never written to audit logs (“location captured: yes/no” only). Required before scale: a data-lifecycle cron nulling location_lat/lng past the org-configured window (default 90 days). Surfaced by the HR-05 #1443 compliance review. |
| Arizona Wage Payment Act (ARS 23-353 final pay) | Ongoing | 🟡 Partial | HR-30 | — | — | HR-30 specifies final-paycheck automation and deadline tracking per ARS 23-353 (7 working days involuntary; next payday or 3 working days after demand for voluntary). |
| Arizona Earned Paid Sick Time (ARS 23-371) | Ongoing | ⏳ Not Started | Pending spec | — | — | Interim: Track accrual manually; implement dedicated spec/workflow for ARS 23-371 accrual and usage tracking. |
| FMLA (family/medical leave) | Ongoing | ⏳ Not Started | HR-06 | — | — | Interim: Track FMLA requests manually; maintain eligibility records (12 months / 1,250 hours). Implement HR-06 leave management for automated eligibility and tracking. |
| ERISA / COBRA (benefits, continuation coverage) | Ongoing | ⏳ Not Started | HR-11 | — | — | Interim: Benefits administered externally; COBRA notices managed by TPA. Implement HR-11 benefits module for tracking. |
| ACA employer mandate (1095-C, FTE tracking) | Annual (Jan 31) | ⏳ Not Started | HR-11 | — | — | Interim: FTE count managed via payroll; 1095-C prepared by benefits administrator. |
| I-9 / E-Verify (employment eligibility) | Within 3 days of hire | 🟡 Partial | HR-01, HR-03, HR-26 | — | — | Interim: HR-03 EN-3 implements I-9/W-4 forms in onboarding; E-Verify integration pending (HR-26). Manual E-Verify submission per Arizona mandate (ARS 23-214) until integration live. |
| FCRA (background checks) | Per-hire | 🟡 Partial | HR-09, HR-09-P5 | — | — | Detailed tracking in FCRA_TCPA_COMPLIANCE_TRACKING.md. Checkr integration designed; sign-off gates pending. |
| TCPA (SMS consent) | Per-message | 🟡 Partial | HR-09-P5 | — | — | Detailed tracking in FCRA_TCPA_COMPLIANCE_TRACKING.md. Consent framework designed; sign-off gates pending. |
| DOL / workforce policy communication (employee handbook distribution) | Ongoing | 📋 Spec complete | HR-43, GR-01 | — | — | HR-43 handbook hub, new-hire bundles, compliance dashboard; GR-01 system of record for acknowledgments. Interim (until HR-43 implemented): HR will maintain signed/manual acknowledgment log with electronic export and backup. PII/PHI handling requirements: (1) Minimum required fields: employee full name, employee ID, timestamp, acknowledgment method, signature/hash; (2) Role-restricted access: HR-only write, read access limited to HR and Compliance roles, Admins for emergency/legal only; (3) Retention boundary and storage: encrypted-at-rest location, retention period and deletion policy documented; (4) Export constraints: PII-safe export format, redaction or tokenization where applicable, audit-safe logging; (5) Verification and audit: periodic export cadence defined, verification responsibility assigned, required audit checklist entry. GR-01 remains system of record for acknowledgments; interim owner: HR; HR-43 rollout dependency tracked. |
| EEOC / Title VII / ADA / GINA (anti-discrimination) | Ongoing | 📋 Policy | HR-01, HR-14, HR-14-ENHANCEMENTS (HR-14 EN-1), HR-09-ENHANCEMENTS (HR-09 EN-1) | — | — | Organizational policy; hiring workflows in HR-01. HR-14 EN-1 (when implemented): ADA interactive process, accommodations, and HIPAA-aligned medical file handling per spec. HR-09 EN-1: structured interview scorecards for documented, consistent selection criteria (Uniform Guidelines). EEO-1 data export for applicable employers. |
| HIPAA Privacy Rule — workforce training documentation (45 CFR 164.530(b)) | Ongoing | ⏳ Not Started | GR-01, HR-43, HR-03 | — | — | Interim: Paper sign-off or LMS exports. Target: GR-01 acknowledgments + HR-43 handbook bundles/onboarding assign (HR-31 consolidated into GR-01). See HR_WORKFORCE_COMPLIANCE_TRACKING.md §3.3. |
| OSHA / ADOSH (workplace safety) | Ongoing | ⏳ Not Started | HR-01 (incidents), GR-01 / HR-43 (policy acknowledgments) | — | — | Interim: Manual OSHA 300 log; safety programs per ADOSH requirements. Implement incident tracking in HR-01. GR-01 tracks acknowledgments; HR-43 adds handbook bundles and HR compliance reporting (HR-31 consolidated into GR-01, 2026-03-26). |
| EEOC / Title VII / ADA / GINA (anti-discrimination) | Ongoing | 📋 Policy | HR-01, HR-42, HR-14, HR-14-ENHANCEMENTS (HR-14 EN-1), HR-09-ENHANCEMENTS (HR-09 EN-1) | — | — | Organizational policy; hiring workflows in HR-01. HR-42: workforce EEO-1 Component 1 scheduled export (distinct from HR-09 applicant/hiring EEO). HR-14 EN-1 (when implemented): ADA interactive process, accommodations, and HIPAA-aligned medical file handling per spec. HR-09 EN-1: structured interview scorecards for documented, consistent selection criteria (Uniform Guidelines). |
| HIPAA Privacy Rule — workforce training documentation (45 CFR 164.530(b)) | Ongoing | ⏳ Not Started | HR-31, HR-03 | — | — | Interim: Paper sign-off or LMS exports. Target: HR-31 electronic acknowledgments, versioning, audit exports. See HR_WORKFORCE_COMPLIANCE_TRACKING.md §3.3. |
| OSHA / ADOSH (workplace safety) | Ongoing | ⏳ Not Started | HR-01 (incidents), HR-31 (policy acknowledgments) | — | — | Interim: Manual OSHA 300 log; safety programs per ADOSH requirements. Implement incident tracking in HR-01. HR-31 provides acknowledgment evidence for safety-related HR policies (complements operational programs). |
| Credentialing (state licensure, NPI, payer, AZ fingerprint clearance) | Ongoing | 🟡 Partial | HR-02, HR-28 | — | — | Credential tracking in HR-02; AZ fingerprint clearance (ARS 36-425.03): HR-28. Payer credentialing and other gaps remain tracked under HR-02. |
| Workers’ compensation (ARS 23-961) | Ongoing | 📋 External | HR-11 | — | — | Insurance carrier manages claims; system tracks incident data. |
| IRS worker classification / 1099-NEC (independent contractors) | Ongoing (tax year reporting Jan 31) | ⏳ Not Started | HR-34, HR-PAY-04 | — | — | Interim: Maintain IC agreements, factor tests, and W-9s outside the system; finance aggregates pay for 1099-NEC per existing FA-10/HR processes. Target: HR-34 for contractor records, classification documentation, and approved time → HR-PAY-04 for 1099-NEC inputs. See HR-34 spec. |
RH module — Recovery Housing Compliance
Status: Tracked below. Detailed requirements, spec mapping, and authoritative references: RH_RECOVERY_HOUSING_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| Arizona DHS sober living home licensure (ARS 36-2062, AAC Title 9 Ch 12) | Before operation | 🟡 Partial | RH-06, RH-01, RH-UX-10 | — | — | License application and renewal tracked in RH-06; inspection tracking partial. RH-UX-10 adds auditable intake provenance (custom_fields.admission_source) for resident-record traceability (DHS-06). Distinct from BHRF below: sober living = non-clinical recovery housing. |
| Arizona BHRF licensure (A.A.C. R9-10-701 to R9-10-722, adult subclass) | Before operation / per AZDHS renewal cycle | ⏳ Not Started | CL-68 (clinical residential lifecycle), GR-27 (facility licensure, staffing minimums, incident timeframes, retention), PM-74 (per-diem billing & BHRF prior authorization) | — | — | BHRF is a licensed clinical residential level of care — distinct from recovery housing. Clinical lifecycle (15-day comprehensive assessment, LOC at admission, treatment-plan cadence, restraint linkage, discharge) reuses CL-02/03/04/13-EN-01/29 via CL-68. Licensure/staffing(awake/on-call/BHP/RN/clinical-director≥10)/incident timeframes (death 1 working day, self-injury 2 working days, abuse immediate per ARS 46-454/13-3620, sentinel 6 hours, restraint-injury 24 hours)/retention (adult 6 years, A.R.S. § 12-2297) in GR-27. Per-diem (H0018/H0019/T2048, POS 56) + AHCCCS 5-day urgent exemption + continued-stay PA in PM-74. Cross-core lifecycle: CL-GR-PM-BHRF-EPISODE-LIFECYCLE. State-variable values via PF-96. Interim: manual licensure/clinical-timeliness/per-diem tracking until specs implemented. |
| NARR National Standard 3.0 (Levels I–IV) | Ongoing | ⏳ Not Started | RH-01, RH-05, RH-11 | — | — | Interim: Self-classify recovery homes per NARR levels; document governance structure. AzRHA certification recommended. Spec: RH-11. |
| Fair Housing Act (disability, group homes) | Ongoing | 📋 Policy | RH-01, RH-02, RH-UX-10 | — | — | Organizational policy; system must not discriminate in waitlist/placement. RH-UX-10: admission prefill must not apply discriminatory defaults; all prefilled fields editable (spec: RH-UX-10-COMPLIANCE-SIGNOFF.md). Reasonable accommodation tracking needed. |
| Fire and life safety (local codes, NFPA) | Ongoing | ⏳ Not Started | RH-01, RH-06, RH-10 | — | — | Interim: Manual fire inspection tracking per property; ensure posted evacuation plans and working detectors. Spec: RH-10. |
| Arizona Title 36 (patient rights, grievances) | Ongoing | 📋 Policy | RH-09, RH-02, RH-UX-10 | — | — | Resident rights via residency agreements; grievance workflow: RH-09. RH-UX-10: prefill does not bypass RH-UX-00 documentation/rights attestations. |
| HIPAA / 42 CFR Part 2 (resident SUD data) | Ongoing | 🟡 Partial | CL-11, RH-04, RH-04-EN-4, RH-UX-10 | — | — | CL-11 consent management covers Part 2; UDS access controls: RH-04-EN-4. RH-UX-10: v1 excludes SUD clinical fields from cross-core prefill; CE-65 insurance permission gates. Sign-off: RH-UX-10-COMPLIANCE-SIGNOFF.md. |
| Zoning compliance (per property) | Before operation | ⏳ Not Started | RH-01 | — | — | Interim: Zoning attestation provided at DHS licensing; track per property. |
FA module — Finance & Accounting compliance
Status: Tracked below. Detailed deadlines, spec mapping, and authoritative references: FA_FINANCIAL_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| IRS 1099-MISC/NEC (vendor payments) | Jan 31 annually | 🟡 Partial | FA-10 (85%) | — | — | Generate forms via FA-10; file paper or use IRS FIRE/IRIS when e-file enhancement is implemented. Ensure W-9 collection per FA-03. |
| IRS W-2 (employee wages) | Jan 31 annually | 🟡 Partial | FA-10 + HR-07 | — | — | Generate W-2 via FA-10 from HR-07 payroll data; distribute to employees by Jan 31. File with SSA per current process until e-file live. |
| IRS Form 941 (quarterly payroll tax) | Quarterly (last day of month after quarter) | 🟡 Partial | FA-10 | — | — | Prepare 941 from FA-10/HR-07 data; file and pay by deadline. Use IRS e-file when enhancement implemented. |
| IRS Form 940 (annual FUTA) | Jan 31 annually | 🟡 Partial | FA-10 | — | — | Prepare 940 from payroll data; file by Jan 31. |
| FASB ASC 958 (nonprofit financial statements) | Ongoing (annual audit) | ✅ Compliant | FA-23 | — | — | Use FA-23 Statement of Financial Position, Statement of Activities, Statement of Functional Expenses; FA-07 for trial balance and fund-based reporting. |
| GAAP revenue timing / multi-period & deferred revenue | Ongoing (month-close, audit) | ⏳ Not Started | FA-18 | — | — | Interim: Manual recognition schedules and journal entries; reconcile deferred balances outside the module. Target: FA-18 straight-line schedules, period recognition runs, GL linkage, and audit trail. See FA_FINANCIAL_COMPLIANCE_TRACKING.md §2. |
| OMB Uniform Guidance (2 CFR 200) | Ongoing (grant lifecycle) | ⏳ Not Started | FA-13 (spec only) | — | — | Interim: Track grant budgets and expenditures in spreadsheets or external tools; document allowable costs and procurement per 2 CFR 200. Implement FA-13 (Project Accounting & Grant Tracking) for system support. |
| Single Audit (2 CFR 200 Subpart F) | Annual (if federal awards > $750K) | ⏳ Not Started | No spec | — | — | Interim: Prepare Schedule of Expenditures of Federal Awards (SEFA) and support single audit via external auditor and manual data export until dedicated spec is implemented. |
| Federal Financial Report (FFR/SF-425) | 90 days after budget period; 120 days final | ⏳ Not Started | FA-13 (data support) | — | — | Interim: Prepare from project/GL data; submit via PMS. Implement FA-13 to improve data availability. |
| Financial internal controls (SOX-analogous) | Ongoing | ⏳ Not Started | FA-25 (spec only) | — | — | Interim: Enforce segregation of duties via role assignments; retain GL audit trail (FA-02 append-only ledger). Implement FA-25 audit log viewer, segregation-of-duties report, and export-to-auditor when spec is implemented. |
| IRS Form 990 data preparation | Annual (May 15 for calendar-year) | 📋 Out of scope | FA-10 (deferred) | — | — | Tax return preparation (990) handled by external CPA. Functional expense categorization (Program/G&A/Fundraising) supported in FA-23 for 990 reporting input. |
| State nonprofit (Arizona) | Ongoing | 📋 N/A | No spec | — | — | Arizona Corporation Commission annual report: File by formation anniversary date (ARS 10-11622). Include directors/officers, principal office, activities, certificate of disclosure, statement that tax returns have been filed. Extension up to 6 months available. Use org profile/board data for content; no system automation. See azcc.gov and ARS 10-11622. |
GR module — Governance & Risk Compliance
Status: Tracked below. Detailed requirements, spec mapping, and authoritative references: GR_GOVERNANCE_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| CARF Behavioral Health accreditation | Survey cycle | ⏳ Not Started | GR-08, CL-10, CL-15, CL-15-P2-3 (Phase 3.3) | — | — | Interim: Manual survey preparation; policy library and QIP outside system. Implement GR-08 for survey readiness. CL-15 Phase 3.3 adds CARF survey readiness dashboard with pre-survey checklist and readiness scoring (consumes GR-08 data via platform layer). |
| Joint Commission CAMBHC accreditation | Survey cycle | ⏳ Not Started | GR-08, CL-07, CL-15 | — | — | Interim: Manual NPSG compliance tracking; tracer preparation outside system. |
| NCQA HEDIS behavioral health measures | Annual | ⏳ Not Started | CL-15, CL-10, CL-15-P2-3 (Phase 3.2) | — | — | Interim: Manual measure calculation; implement CL-15 reporting for automated HEDIS calculation. CL-15 Phase 3.2 adds automated QM calculation from CL-10 outcomes for HEDIS/CARF measures (FUH, FUM, IET, AMM). Part 2 consent gating required for IET/SUD measures per compliance sign-off. |
| SAMHSA SUPRT-A/C + NOMs (Unified Performance Reporting Tools; replaces GPRA effective 2025-10-01; CMHS NOMs 10-domain framework) | Per grant (intake / 6-month / annual / discharge) | 📋 Specification (compliance_reviewed 2026-05-28; approved with conditions) | CL-69 (SUPRT-A/C + NOMs capture spine, instruments via CL-47 library, profile-driven via PF-96; emits clinical.outcome_assessment.recorded); CL-10 (generic outcomes substrate — extended, not replaced) | Quality Team / Clinical | — | CL-69 status: compliance_reviewed 2026-05-28. Conditions before Phase 1: (1) grant manager validates CL-47 SUPRT-A/C seed definitions against the SAMHSA published codebook; (2) clinical lead reconciles 2 missing NOMs domains in spec FR-6 (8 of 10 named) against the official SAMHSA NOMs PDF; (3) clinical compliance extracts AHCCCS AMPM 320-O cadence verbatim and verifies PF-96 AZ profile values; (4) CL-63 DS4P labeling must be active before CL-69 Phase 1 production PHI deployment (high-severity dependency). Sign-off: CL-69-COMPLIANCE-SIGNOFF.md. Interim: Manual outcome data collection and reporting per grant requirements until CL-69 implemented. |
| SAMHSA SPARS / PPR / CCBHC-E grant reporting (Performance Accountability and Reporting System; CCBHC-Expansion grant terms; CAA 2024 §209 expansion) | Per grant reporting cadence (SPARS rolling; PPR semi-annual) | 📋 Specification (compliance_reviewed 2026-05-28; approved with conditions) | GR-28 — GR-28 SAMHSA Grant Performance Reporting; upstream from CL-69 (SUPRT capture) and CL-51-EN-01 (CCBHC-E quality-measure computation) | Grant Manager / Compliance | — | GR-28 status: compliance_reviewed 2026-05-28. GR-28 packages SPARS submissions (CSV batch-upload v1, no direct API), assembles structured PPR drafts, and surfaces per-grant follow-up-rate dashboard with SPARS-submission-risk signal (≥80% threshold sourced from PF-96, not hardcoded). CCBHC-E quality-measure values consumed from CL-51-EN-01 (no recomputation in GR). Per-receiving-entity 42 CFR Part 2 consent enforced server-side before SPARS package generation (FR-8); non-overridable consent_missing error per row. Conditions before Phase 1: (1) document HIPAA disclosure pathway for mandatory grant reporting in docs/architecture/integrations/GR-28-SPARS-REPORTING-INTEGRATION.md — likely §164.512(a) “required by law” rather than §164.508 authorization; (2) pin SAMHSA SPARS CSV column list (from canonical SAMHSA codebook PDF) into PF-96 seed before implementation. Sign-off: GR-28-COMPLIANCE-SIGNOFF.md. |
| Arizona mandatory reporting (ARS 46-454, ARS 13-3620) | Immediately upon knowledge | 📋 Specification | GR-09 (intake), GR-14 (automation), GR-08, CL-13 | — | — | Interim: Staff trained on mandatory reporting obligations; manual reporting to APS/DCS/law enforcement. GR-09 provides incident intake; GR-14 automates obligation creation and deadline tracking. |
| AHCCCS critical incident reporting (AMPM 1620-O) | Per policy timeline (verbal: 8 business hrs, written: 40 business hrs) | 📋 Specification | GR-09 (intake), GR-14 (automation) | — | — | Interim: Manual AHCCCS critical incident reporting per policy. GR-09 captures incident; GR-14 generates AHCCCS report package with business-day deadline calculator. |
| Nonprofit governance (SOX whistleblower/document retention, COI) | Ongoing | ⏳ Not Started | GR-03 | — | — | Interim: Board maintains policies manually; whistleblower and COI policies in place per IRS best practice. |
IT module — Information Security Compliance
Status: Tracked below. Detailed requirements, spec mapping, and authoritative references: IT_SECURITY_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| HIPAA Security Rule (45 CFR 164 Subpart C) | Ongoing | 🟡 Partial | IT-05, PF-30, PF-01, PF-40 | — | — | Auth (PF-01), RBAC (PF-30), audit logging (PF-40), TLS in place. Risk analysis, training, incident response, contingency planning needed. |
| HITECH Act (breach notification) | Within 60 days of breach | ⏳ Not Started | IT-05, PF-44 | — | — | Interim: Manual breach assessment and notification. Implement IT-05 breach response workflow. |
| NIST CSF 2.0 (cybersecurity framework) | Best practice | ⏳ Not Started | IT-05 | — | — | Interim: Align security program with NIST CSF functions; formal maturity assessment needed. |
| CIS Controls v8 (critical security controls) | Best practice | 🟡 Partial | IT-05 | — | — | Some controls in place (access management, data protection); formal CIS assessment needed. |
| Arizona ARS 18-552 (data breach notification) | 45 days from breach | 📋 HIPAA exemption | IT-05 | — | — | HIPAA-covered entities following HIPAA breach rules are exempt; ensure HIPAA compliance. |
| SOC 2 Type II | If required by customers | ⏳ Not Started | IT-05 | — | — | Interim: Evaluate need based on payer/customer requirements. Supabase has SOC 2; Encore OS readiness pending. |
| PCI DSS (if payment processing) | Ongoing | 📋 Assessment needed | IT-05 | — | — | Interim: If using Stripe tokenization, SAQ-A scope; assess and document. |
| OAuth/API credentials at rest (HIPAA §164.312) | Before production go-live | ⏳ Deferred (E-2) | IT-05, FA-30, CE-07, HR-09, CE-03 | — | — | Tracking (Security Audit F4): fa_ramp_connections (access_token, refresh_token), ce_email_accounts (OAuth tokens), hr_job_board_integrations (API keys), ce_ringcentral_subscriptions (webhook tokens) currently store credentials as plaintext TEXT. Supabase Vault is installed; migration plan exists but implementation deferred. Interim: Restrict access via RLS; no new plaintext credential columns. Target: migrate to vault.create_secret() and store only vault secret IDs in tables. |
PF module — Platform Foundation Compliance
Status: PF implements HIPAA technical safeguards (auth, RBAC, audit logging, encryption) tracked under the IT section above. Accessibility compliance tracked below.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| WCAG 2.1 AA / Section 504 (web accessibility, HHS rule) | May 11, 2026 (15+ employees) | ⏳ In Progress | PF-93 (platform a11y infra, axe CI); CL-26, EN-64 (multi-language portal) | Accessibility Lead | 2026-02-27 | Interim: Follow WCAG 2.1 AA guidelines in new development; audit existing UI. HHS rule applies to all organizations receiving federal funding (Medicare/Medicaid). Phased: 15+ employees by May 2026; <15 by May 2027. Actions: Assign leadership escalation; run rapid WCAG 2.1 AA gap analysis; prioritize keyboard, screen-reader, form-labels, and contrast fixes; engage accessibility consultant. Cadence: Weekly status updates until May 11, 2026 deadline. |
| HIPAA technical safeguards (§164.312) | Ongoing | 🟡 Partial | PF-01, PF-30, PF-40, PF-91 | — | — | Auth (PF-01), RBAC (PF-30), audit logging (PF-40), TLS in place. PF-91 (📋 Specification): continuous compliance dashboard, PHI column classification, RLS/audit drift detection, evidence packages — see PF-91. See IT section for full HIPAA Security Rule tracking. |
| HIPAA audit controls & activity review (§164.312(b), §164.308(a)(1)(ii)(D)) | Ongoing | ⏳ Not Started | PF-91, PF-04, PF-40 | — | — | Interim: RLS and audit coverage proven at CI; manual evidence assembly for surveys. Target: PF-91 automates control status, access patterns, and downloadable audit evidence (ZIP/PDF/CSV) per org. PF-91 spec, integration doc. |
| 42 CFR Part 2 — platform monitoring & evidence | Ongoing | ⏳ Not Started | CL-11 (consent), PF-91 (dashboard/enforcement layer) | — | — | CL-11 implements consent capture and disclosure logging (✅). PF-91 adds SUD-tagged column classification, drift alerts, and audit packages; does not replace CL-11 storage. |
| MFA (multi-factor authentication) (§164.312(d), NIST SP 800-66r2) | Before production go-live | ⏳ Deferred (W-3) | PF | — | — | Tracking (Security Audit F8): MFA not yet enforced on Supabase project. Enable TOTP in Supabase Dashboard: Authentication → Providers → enable MFA; require for platform_admin and org_admin roles where possible. Document in IT_SECURITY_COMPLIANCE_TRACKING.md when enabled. |
| ONC Certification (45 CFR Part 170) | Per ONC timeline | 🟡 Partial | PF, CL-16, PM-01 | — | — | Tracked in ONC_CERTIFICATION_ROADMAP.md. |
| Data retention (per data type) | Ongoing | ⏳ Not Started | PF | — | — | Interim: Retention policies documented per module; automated enforcement needed. |
| HIPAA §164.312(a)/(b), §164.502(b), §164.514; 42 CFR Part 2 §§2.12–2.35; HITECH §13401 — Embedded Analytics (PHI-adjacent marts; external signed-embed; SUD-aggregate) | Before external-embed go-live (no regulatory due date) | ⏳ Not Started (spec pipeline_status: reviewed; compliance sign-off DRAFT) | PF-123 — Embedded Analytics Platform | Platform / Compliance Officer | — | Sign-off DRAFT at PF-123-COMPLIANCE-SIGNOFF.md — 14 reviewer items unsigned; must clear before pipeline_status → compliance_reviewed and before external-embed go-live. Open conditions: (1) AC-010 SUD-embed gate verified server-side via @/platform/clinical consent seam; (2) complementary suppression verified (NFR-priv-1 differencing-recovery test); (3) PF-96 min_cell_size federal baseline n=11 (HIPAA Safe Harbor + SAMHSA NOMs); (4) applySmallCellSuppression() parameterized to PF-96 threshold; (5) per-recipient Part 2 consent seam confirmed; (6) pf_analytics_query_log audit on all 5 paths. MotherDuck cloud tier is a hard-gated Phase-2 target — requires a signed HIPAA BAA + 42 CFR Part 2 posture review before any PHI-derived data leaves the perimeter (§164.502(e)). The BAA-free in-perimeter postgres_mv tier ships first. |
HIPAA §164.312(a)/(b), §164.502(b); 42 CFR Part 2 §§2.12–2.35; HITECH §13401 — Agentic Workspace (cowork) (multi-participant visibility re-scope over PHI-bearing pf_ai_conversations; AI agents as first-class participants under scoped principals) | Before the cowork RLS re-scope / agent participation reaches production (no regulatory due date) | 🟡 Partial — Phase 1A schema + RLS authored; spec pipeline_status: tasks_generated; compliance sign-off CONDITIONAL, owner countersigned 2026-06-25 | PF-124 — Agentic Workspace | Platform / Compliance Officer | — | CONDITIONAL sign-off at PF-124-COMPLIANCE-SIGNOFF.md. Phase 1A ships DDL + RLS for pf_agents/pf_threads/pf_thread_agents, re-scopes pf_ai_conversations RLS, and seals shared visibility behind a temporary visibility='private' CHECK + migration drift-guard. 5 blocking go-live conditions (verified before production, not before implementation): (1) PF-30-EN-01 pf_agent_can(p_org_id, p_agent_principal_id, p_scope) principal/delegation contract callable before Phase 1B agent-participation RPCs; (2) PF-126 pre-disclosure consent gate live before any SUD-derived pf_ai_conversations row flips private→shared_thread/shared_org (Part 2); (3) service-role denial test (AC-11) in the regression suite; (4) migration drift-guard RAISE EXCEPTION test (AC-12); (5) audit-coverage exactly-once test on thread-create / agent-join / agent-leave (AC-10, Phase 1B). Agents act under scoped AgentPrincipal — never service_role, never auth.uid(); delegated-and-attributed (every agent message records the agent principal + authorizing human, bounded to ≤ that human’s permissions). Phase gates tracked in specs/pf/plans/PF-124-agentic-workspace-PLAN.md; epic #1779. |
CE module — Community Engagement Communications Compliance
Status: Tracked below. Detailed requirements: CE_COMMUNICATIONS_COMPLIANCE_TRACKING.md.| Regulation | Deadline | Status | Responsible Spec | Owner | Escalation date | Interim Procedures |
|---|---|---|---|---|---|---|
| CAN-SPAM Act (commercial email) | Ongoing | ⏳ Not Started | CE-09, CE-16 | — | — | Interim: Manual compliance with CAN-SPAM in email campaigns. CE-09 implements headers, subject lines, ad identification, physical address, unsubscribe link. CE-16 centralizes email suppression registry (ce_suppressions) and consent evidence for opt-out list management (CS-05, CS-06). |
| TCPA (SMS messaging) | Per-message | ⏳ Not Started | CE-08, CE-16 | — | — | Interim: No automated SMS until consent framework implemented. CE-08 owns consent collection UI/flow, business hours, sender ID, 10DLC. CE-16 stores consent evidence (ce_consent_evidence), manages suppression registry, and enforces pre-send validation (TC-01–TC-04). |
| Arizona call recording (ARS 13-3005, HB 2038) | Per-call | ⏳ Not Started | CE-10 | — | — | Interim: Play recording notice at call start; obtain consent for interstate calls. |
| FCC Do Not Call (telemarketing) | Per-campaign | ⏳ Not Started | CE-10, CE-16 | — | — | Interim: Manual DNC list check before outbound marketing calls. CE-16 owns DNC registry import (ce-import-dnc-registry edge function) and internal DNC list via ce_suppressions (FCC-01, FCC-02). CE-10 consumes suppression check before outbound calls. |
| Federal Anti-Kickback Statute (AKS) / Stark Law (referral relationships) | Ongoing | ⏳ Not Started | CE-53 | Compliance / Legal | — | Interim: Referral influence analytics remain informational only; no compensation-based referral recommendations or inducement workflows until legal review and controls are implemented. |
| HIPAA Privacy/Security + 42 CFR Part 2 (contact document upload and AI extraction) | Ongoing (Phase 2 go-live gate) | 📋 Specification | CE-59 — CE-59 Contact Document Management & AI Extraction | CE / Compliance / Security | — | CE-59 adds contact-level document storage with potential PHI/SUD content. Phase 2 AI extraction remains blocked until redaction/no-disclosure controls and compliance sign-off are complete. Sign-off artifact path: specs/ce/reviews/CE-59-COMPLIANCE-SIGNOFF.md. Interim: manual review only; no outbound AI extraction for unapproved SUD-sensitive content. |
| HIPAA Privacy/Security for contact history audit trail (45 CFR 164.312(a),(b); 45 CFR 164.502 minimum-necessary) | Before CE-60 production go-live | 📋 Specification | CE-60 — CE-60 Contact Activity History & Audit Trail | CE Product / Security / Compliance | — | CE-60 adds immutable contact history events and profile-change tracking. Required controls: org-scoped RLS, split permissions (ce.contacts.history.view, ce.contacts.history.sensitive_view), and default masking/redaction for sensitive values. Interim: rely on existing CE access controls; do not expose unredacted historical value details outside explicitly authorized views. |
| HIPAA Privacy/Security for intake insurance identifiers (45 CFR 164.502, 164.514, 164.312) | Before CE-65 production go-live | 📋 Specification | CE-65 — CE-65 Pipeline Tile Customization & Dashboard Embeds | CE Product / Security / Compliance | — | CE-65 adds insurance_carrier and insurance_member_id capture/display in CE contacts and pipeline contexts. Interim controls until implementation complete: (1) enforce org-scoped access only, (2) mask member IDs outside authorized detail views, (3) prohibit cleartext IDs in telemetry/logs/events, (4) require permission-gated unmasked access. Platform-wide HIPAA safeguards remain tracked in IT/PF rows. |
| HIPAA Privacy/Security for lead urgency + requested services metadata (45 CFR 164.502 minimum-necessary; 45 CFR 164.312 audit/access controls) | Before CE-58 production go-live | 📋 Specification | CE-58 — CE-58 Lead Creation Enhancements — Urgency Visibility & Requested Services | CE Product / Security / Compliance | — | CE-58 introduces lead-level urgency/service-intent metadata surfaced in pipeline UI. Required controls: org-scoped access, non-color-only urgency rendering, sanitized error/log payloads, audit coverage for urgency/requested_services changes, and CE-16 consent/suppression boundary for any downstream outreach usage. Compliance sign-off: CE-58-COMPLIANCE-SIGNOFF.md. |
Modules with dedicated sections above
- CL/PM: Clinical and Practice Management compliance tracked in the main Tracker Table above. See also ONC_CERTIFICATION_ROADMAP.md, PHI_CLASSIFICATION.md.
- HR: Dedicated section above. Details: HR_WORKFORCE_COMPLIANCE_TRACKING.md, FCRA_TCPA_COMPLIANCE_TRACKING.md.
- RH: Dedicated section above. Details: RH_RECOVERY_HOUSING_COMPLIANCE_TRACKING.md.
- GR: Dedicated section above. Details: GR_GOVERNANCE_COMPLIANCE_TRACKING.md.
- FA: Dedicated section above. Details: FA_FINANCIAL_COMPLIANCE_TRACKING.md.
- IT: Dedicated section above. Details: IT_SECURITY_COMPLIANCE_TRACKING.md.
- PF: Dedicated section above (accessibility, HIPAA technical safeguards, ONC).
- CE: Dedicated section above. Details: CE_COMMUNICATIONS_COMPLIANCE_TRACKING.md.
Low-regulation modules (FW, FM, LO)
These modules have minimal or no direct regulatory exposure. Compliance requirements are inherited from other modules.- FW (Forms & Workflow): Infrastructure module. No direct regulatory obligations. PHI handling inherited from PF (HIPAA technical safeguards) and CL (42 CFR Part 2). Form content validation and access controls enforced by the platform layer. No dedicated compliance tracking needed.
- FM (Facilities Management): Building and facility operations. Potential OSHA workplace safety requirements (tracked under HR for employer obligations) and ADA physical accessibility (operational, not system-level). Fire code compliance tracked under RH for recovery housing properties. No direct FM-specific regulations requiring system-level compliance tracking.
- LO (Logistics & Inventory): Supply chain and inventory management. Controlled substance inventory management (DEA, 21 CFR Part 1304) is owned by CL-06, not LO. General inventory has no specific regulatory requirements. No dedicated compliance tracking needed.
Interim Procedures (42 CFR Part 2)
Until CL-11 is fully implemented:- Consent: Obtain and file written consent for TPO and any SUD-specific disclosure per organization policy. Do not rely on system to enforce; manual checklist.
- Disclosure log: Maintain a log (spreadsheet or document) of all disclosures with date, recipient, purpose, and consent reference.
- Redisclosure: Include notice that redisclosure is prohibited on any disclosed information.
- Training: Ensure staff trained on Part 2 requirements and interim process.
New Regulatory Requirements (May 2026 Analysis)
The following requirements were identified in the May 2026 ONC Certification Strategy & Regulatory Readiness analysis. Seedocs/compliance/ONC_REGULATORY_READINESS_IMPLEMENTATION_PLAN.md for full implementation plan.
| Regulation | Requirement | Deadline | Owning Spec | Status | Priority |
|---|---|---|---|---|---|
| DEA EPCS (21 CFR 1311) | Third-party audit for controlled substance e-prescribing | Before MAT prescribing launch | CL-64 | ⏳ Not Started | P1 |
| EKRA (18 U.S.C. § 220) | Anti-kickback compliance for NorthSight relationship | Immediate | PF-107 | ⏳ Not Started | P0 |
| HITRUST e1 | Security assessment by authorized external assessor | 12 months | PF-109 | ⏳ Not Started | P2 |
| Section 1557 ACA | Language access, TTY, nondiscrimination in patient portal | Ongoing | PF-93 (update) | 🟡 Partially Covered | P2 |
| ADA Title III / DOJ Rule | WCAG 2.1 AA for patient-facing web properties | HHS May 2026 | PF-93 | 🟡 In Progress | P2 |
| SAMHSA SUPTRS/TEDS | Treatment episode reporting for block-grant compliance | Per grant cycle | GR-26 | ⏳ Not Started | P3 |
| USCDI+ BH | FHIR BH profiles mapping | Proactive alignment | CL-16-EN-03 | ⏳ Not Started | P2 |
| DS4P §170.315(b)(7)/(b)(8) | Privacy segmentation for SUD data in FHIR/C-CDA | Before production FHIR exchange | CL-63 | ⏳ Not Started | P1 |
| HTI-4 NCPDP SCRIPT 2023011 | E-prescribing standard upgrade | Jan 1, 2028 | CL-06 (update) | ⏳ Not Started | P2 |
| DEA Telemedicine Registration | MAT-via-telehealth prescribing rules | Pending final rule (2026?) | CL-64 | 📋 Monitoring | P2 |
| Contexture Participation | HIE connectivity for AHCCCS DAP/TI 2.0 | 30 days (business) | PF-108 | ⏳ Not Started | P1 |
| OIG Info Blocking CMP | $1M per violation for HIT developers | Live since Sept 2023 | PM-55 | 🟡 In Progress | P1 |
| ONC API Conditions | Terms, fees, transparency governance for FHIR APIs | Before API publication | PM-72 | ⏳ Not Started | P2 |
| DSI Transparency §170.315(b)(11) | Source attribute disclosures for AI features | Before AI ships | CL-65 | 🟡 In Progress — Phase A schema committed (cl_dsi_disclosures + opt-out); public registry route app-layer pending | P2 |
| Surescripts Certification | Production e-prescribing staged onboarding | Before eRx launch | PM-73 | ⏳ Not Started | P3 |
References
- CL-11 Consent Management
- CL-11 Integration (interim controls, action checklist)
- ehr_research_updated.md
- ONC_CERTIFICATION_ROADMAP.md
- ONC_CERTIFICATION_GAP_MATRIX.md
- ONC_REGULATORY_READINESS_IMPLEMENTATION_PLAN.md
- PHI_CLASSIFICATION.md
- FA_FINANCIAL_COMPLIANCE_TRACKING.md
- HR_WORKFORCE_COMPLIANCE_TRACKING.md
- FCRA_TCPA_COMPLIANCE_TRACKING.md
- RH_RECOVERY_HOUSING_COMPLIANCE_TRACKING.md
- GR_GOVERNANCE_COMPLIANCE_TRACKING.md
- IT_SECURITY_COMPLIANCE_TRACKING.md
- CE_COMMUNICATIONS_COMPLIANCE_TRACKING.md
Enhancement references (internal RFC)
- EN-51: CL-21 § Future Enhancements — OTP Federal Guidelines (42 CFR Part 8).
- EN-42: CL-15 § Future Enhancements — AHCCCS IAD dual-track (Policy 961).
- CL-25 Clinical Audit & Compliance Dashboard: User Guide | Admin Guide