01
The resident’s record is not ours.
SeniorCRE never asserts ownership of clinical or care data. Rights are allocated by the operator’s agreements and applicable law; SeniorCRE operates as a Business Associate and steward.
The single status table lives at /trust-center. Compliance posture as of October 22, 2026: HIPAA safeguards are in progress; a BAA template does not establish an executed agreement. Encryption is implemented, independent test pending; SOC 2 is PLANNED, with no certification or report claimed; HITRUST is NOT YET AUDITED; ONC health IT certification is NOT PURSUED; no completed independent penetration-test report is claimed.
SeniorCRE · Open Data Governance
What SeniorCRE commits to on the access, exchange, and protection of senior care data — published so that any partner, customer, or counsel can verify exactly where we stand.
Sending this to your legal team? The Legal Hand-Off Packet contains this page, our Charter, and all five standard agreement templates in one PDF.
Clinical data carries a further commitment: the Data-Origin Policy — the operator’s EHR and eMAR remain the legal clinical record, and every value in the operating record carries one of four origin labels.
Version 1.0 · Effective August 29, 2026
§ 1
The resident owns the story; the operator owns its operations. Everything below follows from that single allocation.
01
SeniorCRE never asserts ownership of clinical or care data. Rights are allocated by the operator’s agreements and applicable law; SeniorCRE operates as a Business Associate and steward.
02
Operators retain the rights allocated in their agreement over operational, financial, and census data, including export and sharing rights on the terms stated in the executed agreement.
03
Any restriction on electronic health information requires an advance written justification under a specific regulatory exception, tailored to a specific risk — never to a category of user or technology.
04
Whether a requester competes with SeniorCRE is inadmissible in every access decision. Our own products consume the same APIs, under the same limits, as any third party.
05
FHIR and USCDI are the designed standard rails; proprietary formats only where no standard exists, always documented and exportable. Network participation posture is under counsel review.
06
Data export at termination is free, in standard formats, on defined timelines. API fees are cost-based, published, and uniform.
07
Access decisions, denials, and justifications are logged, audited, and reported in an annual public transparency report.
Under counsel review
Rights in resident, clinical, operational, and financial data are allocated by the operator’s agreements and by applicable law. SeniorCRE operates as a Business Associate and does not assert ownership of operator or resident data. The precise allocation of rights is under counsel review and is stated in the executed agreement.
Version 1.0 · Effective August 29, 2026
§ 2
Portability is the test of operator control. A record the operator cannot take with it is not the operator's record.
| Tier | What it covers | Price |
|---|---|---|
| Individual access (resident- or representative-directed) | Retrieval and delivery of a resident’s own record to the resident or their designated representative. | Free, always |
| Treatment & care-coordination exchange | Standards-based exchange at network-required levels for treatment and care coordination. | Free |
| Commercial API tiers | Sustained programmatic access for analytics, integration, and third-party product use. | Published, cost-based rates with a disclosed reasonable margin |
SeniorCRE commits not to charge:
Version 1.0 · Effective August 29, 2026
§ 3
Access follows the operator's authorization, not SeniorCRE's commercial interest. SeniorCRE's own products consume the same interfaces, under the same limits, as any third party.
Version 1.0 · Effective August 29, 2026
§ 4
“Any structured data element visible to a human user in our interfaces must be retrievable via API by an equivalently authorized system — or a documented infeasibility exception must exist for that element.”
The principle is bounded by constraints that are written down rather than applied case by case: authenticated identity and scope for every request; segmentation where consent law is stricter than HIPAA; and documented infeasibility exceptions where no equivalent interface exists.
SeniorCRE does not self-attest to any information-blocking or interoperability standard that depends on capabilities that are not live and measured.
API equivalence is the design standard SeniorCRE builds to, with documented exceptions published on this page. It is not represented as an unconditional promise pending counsel review.
Export rights settle who may retrieve a record. They do not settle who the operator asks what it means — the separate question of interpretation is taken up in Hosting a record is not governing it.
Version 1.0 · Effective August 29, 2026
§ 5
No restriction on data access takes effect at SeniorCRE without a completed Exception Justification Memorandum containing:
the specific requester or access affected;
the specific risk or legal basis, with evidence attached;
the regulatory exception invoked and how each condition is met;
why no narrower measure suffices;
duration and review date;
confirmation the same rule applies to all similarly situated parties, including SeniorCRE’s own products;
signatures of the CISO or Privacy Officer and the General Counsel.
Memoranda are retained for ten years. During any commercial dispute, no restriction may be imposed against the disputing party without the additional signatures of the Chief Executive Officer and General Counsel.
Designed governance
Designed governance body, to be constituted before applicable production access operations. As designed: five seats — Chief Data & Interoperability Officer (chair), General Counsel, CISO, a customer-operator representative, and an external interoperability expert — meeting monthly to adjudicate denials, suspensions, and appeals, with a written record for each decision.
Commitment
SeniorCRE commits to publishing, annually: access requests received, granted, and denied by exception category; average time-to-credential; suspensions and outcomes; and performance against published objectives. No report has been issued yet.
Version 1.0 · Effective August 29, 2026
§ 6
What exists today, stated at the lowest level the record supports. The single status table lives at /trust-center.
| Element | State |
|---|---|
| Published standard agreement templates | Published |
| Open Data Governance principles and exception process | Adopted policy |
| Data Access Review Board | Designed governance — seats not yet seated |
| Annual transparency report | Commitment — no report issued yet |
| FHIR / USCDI export rails | In development |
| Event streams and subscription notification | In development — no service level published |
| Structured extraction of scans, PDFs, and faxed labs | Documented exception to API equivalence |
Compliance posture as of October 22, 2026: HIPAA safeguards are in progress; a BAA template does not establish an executed agreement. Encryption is implemented, independent test pending; SOC 2 is PLANNED, with no certification or report claimed; HITRUST is NOT YET AUDITED; ONC health IT certification is NOT PURSUED; no completed independent penetration-test report is claimed.
Version 1.0 · Effective August 29, 2026
§ 7
Health data no longer sits behind the discretion of whoever happens to hold it. SeniorCRE treats that as a design constraint rather than a compliance burden: a platform that shares data only when it is commercially convenient cannot be the operating record for anyone.
“Data must flow unless the holder can prove a specific, documented, narrowly tailored reason it should not. SeniorCRE does not resist this rule. SeniorCRE is built on it.”
Under counsel review
SeniorCRE designs every access surface to the strictest reading of federal information-blocking expectations. The characterization of SeniorCRE’s regulatory status under 45 C.F.R. Part 171 is under counsel review and is not stated here.
SeniorCRE does not publish its own reading of federal information-blocking law or of who may enforce it. Bracketed fields identify SeniorCRE's standard negotiated ranges; material deviations require designated approval.
SeniorCRE designs every access surface to the strictest reading of federal information-blocking expectations. The characterization of SeniorCRE’s regulatory status under 45 C.F.R. Part 171 is under counsel review and is not stated here.
Version 1.0 · Effective August 29, 2026
§ 8
These are SeniorCRE's standard forms, published so that negotiations start from a known, uniform baseline.
Governance charter: principles, governance machinery, audit, and metrics. Adoption formalities are under counsel review.
Operator terms: data ownership, portability, service levels, and limits on suspension.
Published uniform terms for all third-party integrators, including the suspension protocol.
HIPAA terms plus a mutual information-blocking covenant.
Plain-language notice, consent registry, 42 C.F.R. Part 2 consent, and state addenda.
Clean-room and provenance rules; contains no non-compete.
Version 1.0 · Effective August 29, 2026
§ 9
10-business-day SLA
Concerns are logged to our audit ledger and reviewed at the next Data Access Review Board session. You will receive a written response.
This page is a statement of policy and published standard terms. It is not legal advice, and templates are finalized with counsel in execution.
Version 1.0 · Effective August 29, 2026
SeniorCRE is operator-controlled operating infrastructure for senior housing & care. AI in senior housing & care only earns trust when the operator governs the record it runs on. The governing rules, use classes, and data-handling posture are published rather than described.
Start at Data Sovereignty in Senior Care — this page adds: The policy commitments — portability and API equivalence.
The full argument for operator ownership of the record.
Definition and the tests a claim of sovereignty has to pass.
Why ownership became a governance question in the AI era.
Where every field comes from, and who may write to it.