By John Hauber, Founder & CEO, SeniorCRE · 8 min read
What CARF actually said
CARF’s new AI standards, published in January and effective for surveys on or after July 1, 2026, are deliberately non-prescriptive. They ask accredited aging-services organizations to demonstrate four things.
Written AI policies & procedures
The organization must define how AI is used, by whom, for what decisions, and under what boundaries — in writing.
Disclosure of AI use
Residents, families, and staff must be told when AI is involved in a decision, recommendation, or communication that affects the person served.
Protection of PHI & sensitive data
AI systems that touch PHI must respect the same HIPAA, state-privacy, and consent obligations as the rest of the clinical record.
Human oversight in the chain of accountability
Every AI output that could affect a person served must be reviewable, attributable, and stoppable by a named human role.
CARF accredits 888 aging-services programs worldwide, 230 in the United States, and its accreditation is written into aging-services regulations in 14 states. This is not a thought experiment. It is a survey checklist.
Gaps to check in any AI workflow
“Generic agent software” — the wave of general-purpose chat agents, browser agents, and copy-paste LLM tools that operators have been quietly adopting for the past 18 months — must be evaluated for the actual regulated use. Do not infer a vendor’s controls from its category; inspect these questions:
- Check for a written record of prompts, models and versions behind each material output.
- Check whether material outputs and approvals are retained in an appropriate audited record.
- Verify PHI handling, applicable Business Associate Agreements and data-use restrictions before any model call.
- Check for appropriate disclosures to residents, families and staff when AI is involved.
- Require a named human owner for material recommendations and actions.
- Test whether a model can be suspended and affected outputs reviewed when an incident or survey requires it.
These questions identify evidence to request, not a prediction of a survey finding. Actual accreditation expectations and findings belong to the applicable standards and survey process.
What auditable, operator-controlled intelligence looks like
The six controls below are design requirements, not CARF-ready defaults. The Operator-Controlled Operating Record is designed and not yet implemented in any community. Build, scoped validation, professional review and operator acceptance are required before reliance.
Canonical operating record
Design requirement: retain attributed inputs, outputs and review context against the appropriate resident, community and period. Record-native implementation and complete audit coverage remain to be built and accepted.
Named agents, versioned prompts
Design requirement: retain model and prompt versions, source references and reviewer identity. Validation-environment agent work does not prove this complete operating-record workflow.
Decision-support only, human-in-the-loop by default
Design boundary: no independent clinical, medication, ledger or admission action. Explicit authorization and retained approval evidence must be implemented and tested before any proposed action path is enabled.
Disclosure records — design requirement
Design requirement: appropriate versioned disclosure text, timestamp and recipient evidence. This article does not establish an available community disclosure workflow.
PHI governance & data residency
Design requirement: approved hosting, scoped access, encryption, applicable agreements and tested egress restrictions before PHI use. Contracts and security evidence must be verified for the actual scope; this is not a completed deployment claim.
Operator-controlled kill switch
Design requirement: scoped suspension and tested refusal, recovery and escalation. A one-click production kill switch is not established by this design description.
Evidence an organization should prepare for review
A design diagram cannot answer a survey question on behalf of a community. The examples below specify evidence to retain; they are not actual SeniorCRE deployment answers.
“Show us where AI is used in your organization.”
Required evidence: an actual inventory of AI uses, accountable roles, models, permissions and dated reviews. A proposed screen is not a completed inventory.
“How do you disclose AI use to residents and families?”
Required evidence: the organization’s disclosure policy and retained examples showing when and to whom disclosures were made. SeniorCRE’s proposed library is not an implemented survey artifact.
“How do you protect PHI when AI is involved?”
Required evidence: actual hosting and access scope, applicable signed agreements, egress tests and approved data-use terms. Review current control evidence in the Trust Center.
“Who is accountable for an AI recommendation?”
Required evidence: named decision rights, retained approvals and tested action boundaries for the actual use. The operating-record workflow remains design-stage.
“Can you stop an AI system if we ask you to?”
Required evidence: a tested suspension procedure for the actual AI system, including access revocation and recovery. The proposed scoped control is not a deployed SeniorCRE capability.
The category difference, in one line
AI tools may help draft or analyze. Operators remain accountable for definitions, permissions, disclosures and evidence. SeniorCRE’s proposed operating record is intended to support that accountability in senior housing & care; implementation and accreditation fitness are not established.
What operators should do this quarter
- Inventory every AI tool in use — including “shadow” browser and chat agents used by staff.
- Write the four-part CARF policy: use, disclosure, PHI protection, human oversight.
- Kill any tool that ingests PHI without a BAA and a data-use agreement.
- Move AI-assisted work into an audited system of record — not email, not chat, not spreadsheets.
- Assign a named human owner to every AI-assisted decision path.
- Run a 90-Day Leak Audit to find where AI is quietly making decisions no one is auditing.
CARF® is a registered trademark of CARF International; nominative use only. Standards summary based on CARF’s January 2026 publication and reporting in McKnight’s Senior Housing & Care. This article is informational and does not constitute legal or accreditation advice; operators should confirm survey expectations with their CARF surveyor and legal counsel.