CareStack

Discovery and scoping (2–4 weeks)

Current state assessment: Review of existing systems (PMS, EHR, payment workflows, imaging, labs, LIS if applicable).

Data readiness plan: What data will migrate (patients, appointments, treatment plans, invoices, insurance details) and how it will be mapped.

Success metrics: KPIs to measure post-implementation (e.g., claim acceptance rate, average cycle time, no-show rate).

Compliance and security review: Ensure alignment with HIPAA, data residency requirements, and user access policies.

System configuration and setup (4–8 weeks)

Tenant provisioning: Create your CareStack environment, users, roles, and permissions.

Clinical workflows setup: Treatment templates, procedures, consent forms, radiographs/IMaging links, and charting defaults.

Billing and revenue cycle setup: Fee schedules, payer contracts, CPT/HCPCS mapping, ICD-10 codes, claim submission rules, and denial management workflows.

Scheduling and CRM: Appointment types, calendars, reminders, patient portals, and intake forms.

Integrations: Connect with ERP/accounting, labs, imaging, imaging storage (PACS), and any external imaging devices or sources.

Security and audits: User access reviews, audit trails, data encryption settings.

Data migration (2–6 weeks, parallel with configuration)

Data extraction from legacy systems.

Data cleansing: Deduplication, standardization, and validation.

Migration: Patient records, history, treatment plans, invoices, payments, insurance details, and appointment history.

Verification: Reconciliation and sample data checks to ensure accuracy.

Training and change management (2–4 weeks)

Admin training for office managers, billers, and IT staff.

Clinician training on charting, treatment planning, and notes.

End-user training: Front desk, scheduling, and patient portal usage.

Clinical and documentation customization

Treatment templates and workflows: Custom procedures, workflows for restorative, endodontics, implants, ortho, perio, etc.

Charting and notes: Custom note templates, checklists, standardized documentation fields.

Consent forms and patient education: Customizable PDFs and consent workflows.

Scheduling and patient intake

Appointment types and rules: Custom appointment durations, recurring appointments, block scheduling, recall intervals.

Intake forms: Custom new patient forms, health history questionnaires, and consent capture.

Reminders and communications: Customizable SMS/email reminders, patient portal messages.

Billing and revenue cycle management

Fee schedules and CPT/HCPCS mappings: Custom fee schedules per payer or practice group.

Payer contracts and claim rules: Custom adjudication rules, eligibility checks, and denial management workflows.

Payment workflows: Custom payment plans, co-pay collection rules, and patient-facing payment portals.

Claim edits and scrubbing: Custom validation rules before submission.

Reporting and analytics

Dashboards: Custom KPIs (e.g., days in accounts receivable, production by provider, case acceptance rate).

Reports: Customizable revenue by payer, patient lifecycle reports, scheduling efficiency, no-show reasons.

Data export: Standard and ad-hoc exports for external BI tools.

Integrations and data mapping

Third-party systems: Integrations with practice management, imaging, labs, ERP/accounting, and legacy EHR systems.

Data mapping: Custom field mappings during migration or ongoing syncs.

APIs: Access to APIs for additional integrations or automation.

Setup and implementation fees

Initial implementation/setup fee: Often a one-time fee covering discovery, configuration, data migration, integrations, and training.

Data migration costs: Depending on data volume and complexity.

Customization charges: If you require significant custom templates, workflows, or reports.

Hardware or infrastructure (if applicable): In rare cases, though most modern CareStack deployments are cloud-based.

Recurring subscription and licensing

Monthly/annual subscription per user or per location: Licensing for clinicians, billers, administrators, and special roles.

Tier differences: Core features vs advanced analytics, telehealth, or premium integrations.

Maintenance, updates, and cloud costs

Software maintenance: Included in subscription in many cloud models; may be separate in some arrangements.

System upgrades and patching: Typically covered under ongoing maintenance or support.

Data storage fees: If data storage exceeds included quotas.

Support and services

Support contracts: Levels vary (standard, premium, 24/7). Includes access to help desk, remote assistance, and on-site support if contracted.

Training and onboarding: Additional charges for extended training sessions or ongoing coaching.

Consulting for optimization: Fees for workflow optimization, reporting enhancements, or deeper integrations.

Add-ons and integrations

Third-party integration fees: If you require connectors to other systems (PACS, ERP, imaging vendors, etc.).

APIs and developer access: Some plans bill for API usage beyond included limits.

Admin and IT staff onboarding

• Role-based training: Structured sessions for system admins covering user provisioning, RBAC, security settings, data backups, and integrations.

• Sandbox environment: Access to a practice/test environment for hands-on configuration and testing before going live.

• Documentation: Quick-start guides, admin playbooks, and configuration checklists.

Clinician training

• Charting and clinical workflows: Training on treatment templates, notes, assessments, imaging linkage, and documentation standards.

• Templates and best practices: Guidance on optimizing templates for efficiency and compliance.

• Consultation and case-based practice: Hands-on sessions with typical patient scenarios.

Front-d desk and billing training

• Scheduling, patient intake, and reminders: How to manage appointments, recalls, and patient communications.

• Billing and revenue cycle: CPT/HCPCS mapping, claim submission, denial management, and payment workflows.

• Office-specific workflows: Customizing day-to-day processes to fit the practice.

Training formats

• Live virtual training: Webinars or instructor-led sessions.

• On-site training: In-person workshops (where available via partner networks).

• E-learning: Self-paced modules, videos, and quizzes.

  
  Reference materials: Quick guides, process checklists, cheat sheets, and FAQs.

  
  Train-the-trainer: Designated super-users who can train their team after initial onboarding.

Ongoing education

• Refresher sessions: Periodic training on new features or updated workflows.

• New feature onboarding: Targeted sessions when major updates are released.

  
  Certification or competency tracking: Optional programs to ensure users stay current.

Change management support

• Change impact assessments: Help in planning rollout phases and user adoption strategies.

• User adoption analytics: Tracking uptake and identifying training gaps.

Data protection and access control

• Role-based access control (RBAC): Fine-grained permissions aligned to user roles.

• Least privilege principle: Users receive only the access needed to perform their duties.

  
  Audit trails: Comprehensive logs of user activity, access, and changes.

Data security and privacy

• HIPAA alignment: Compliance controls for handling protected health information (PHI).

• Data encryption: Encryption at rest and in transit (e.g., TLS in transit, disk-level or database encryption at rest).

• Data residency options: Potential choices for where data is stored, per contract and region.

Operational security

• Regular security reviews: Vulnerability assessments and patching cycles.

  
  Incident response: Defined procedures for security incidents, containment, notification, and remediation.

  
  Backups and disaster recovery: Scheduled backups, recovery objectives (RPO/RTO) and tested DR plans.

Identity and access management

• Multi-factor authentication (MFA): Encouraged or required for privileged and remote access.

  
  Single sign-on (SSO) readiness: SAML/OIDC compatibility where applicable.

Compliance and governance

• Data retention policies: configurable retention periods and archival processes.

  
  Audit and compliance reporting: Ability to generate audit reports for audits or regulatory checks.

Vendor and third-party security

• Third-party risk management: Assessments for integrations and external vendors.

  
  Security certifications: Information on any relevant certifications or attestations (SOC 2, ISO 27001, etc.) upon request.

Update frequency

• Regular release cadence: CareStack typically follows a scheduled cycle with periodic updates (e.g., monthly or quarterly). Major releases may occur a few times a year, with smaller feature drops or bug fixes in between.

Update types

• Feature updates: New capabilities, enhancements to existing modules, and UI improvements.

• Security updates: Critical patches and vulnerability fixes prioritized for rapid deployment.

• Maintenance updates: Performance improvements and bug fixes.

Update management approach

• Staged rollout: Updates may be deployed in phases (pilot teams or locations first, then broader rollout).

• Backward compatibility: Efforts to maintain compatibility with existing workflows, with deprecation notices and migration guidance as needed.

  
  Testing in sandbox: Updates can be tested in a non-production environment before production deployment.

  
  Changelog and release notes: Communication detailing new features, changes, and any actions required by users.

Impact and planning

• Downtime expectations: Most updates are non-disruptive, but some may require brief maintenance windows or feature-specific configuration.

  
  User acceptance and training: New features may require quick training or updated process docs.

  
  Rollback options: Procedures if an update introduces issues (where available).

Support during updates

• Proactive notices: Release notes and upgrade schedules shared in advance.
  Support availability: Enhanced support during major updates to assist with transition.

Data ownership

Typically, the customer (your practice) is the owner of the data you generate and store within CareStack (patient records, appointments, billing data, imaging metadata, etc.).

The vendor generally has the right to use aggregated, de-identified data for product improvement, analytics, and benchmarking, provided no PHI is exposed. Ensure explicit language about not using identifiable patient data without consent.

Data access and export rights

• You should have ongoing access to your data via export capabilities, APIs, or data dumps.

• Regular data exports (e.g., CSV, JSON, HL7/FHIR where applicable) should be available.

• During and after termination, you should retain rights to retrieve your data in a usable format for migration to another system.

Data portability during termination

• Clear timelines and processes for data export after contract termination.

• A defined data format (standardized schemas for patients, demographics, encounters, invoices, payments, CPT/ICD codes, etc.).

• Secure data deletion or anonymization options in line with regulatory requirements after data handover is complete.

Data retention and deletion

• Retention periods for historical data post-termination (e.g., 30–90 days for export, beyond that may require archival access or a separate agreement).

• Procedures for secure deletion of data from CareStack systems when no longer needed, consistent with regional laws and contractual terms.

Data residency and cross-border transfers

• If applicable, options for storing data in a specific geographic region.

• Clauses around international data transfers (SCCs/standard contractual clauses, GDPR considerations if applicable).

Regulatory compliance alignment

• Explicit statements about HIPAA compliance and PHI handling.

• Provisions for incident response, breach notification timelines, and customer notification requirements.

Scaling up (growth)

• Add more users, locations, or modules (e.g., more clinicians, additional billing teams, telehealth, imaging integration) with a proportional adjustment to:

  • Subscription/licensing fees (per-user or per-location).

  • Data storage capacity and throughput needs.

  • Implementation or onboarding support if new locations/modules require configuration.

• Timeline for onboarding new users/modules typically mirrors initial onboarding but may be streamlined via a standardized addendum.

Scaling down (reduction)

• Terms for reducing seats, disabling features, or consolidating locations.

• Possible short-term impact on pricing (e.g., lower monthly fees, prorated reductions).

• Exit or pause of certain modules should be governed by an addendum or amendment, with any data migration or deprovisioning steps spelled out.

Notice periods and lead times

• Minimum notice periods for changes (e.g., 30–90 days) to adjust licensing, billing, and provisioning.

• Impact on data storage, backups, and offboarding for reduced usage.

Tier and feature adjustments

• Ability to switch between tiers (e.g., standard vs. advanced analytics, additional integrations) without a full renegotiation, subject to approval.

• Potential migration path if moving between modules (e.g., from basic PMS to full practice management with billing and analytics).

Contractual alignment

• Ensure pricing holds steady for agreed terms unless there are explicit scale-up/scale-down addenda.

• Any minimum commitments or annual uplift clauses should be clearly defined.

Renewal structure

• Auto-renewal terms (duration, e.g., annual or multi-year).

• Renewal pricing mechanics (fixed escalation, CPI-based adjustments, or market-based renegotiation).

• Notice window for non-renewal or termination before renewal (e.g., 60–90 days prior).

Cancellation and termination

• Termination rights (for convenience or for cause) and corresponding notice periods.

• Cure periods for material breaches (e.g., 30–60 days to remedy if failed to meet obligations).

• Rights and process for data export at termination.

• Exit assistance or transition services (helpful for a smooth migration to another system)

Data and access post-termination

• Access rights to export data for a defined period after termination.

• Decommissioning assistance and timelines for de-provisioning user access.

• Ongoing data retention by CareStack for archival purposes (if any) and removal timelines.

Fees at renewal or cancellation

• Any termination penalties or early termination charges (if applicable).

• Fees for data extraction, migration support, or transitional services, if required.

• Outstanding invoices and payment terms on termination.

SLA and support continuity

• Service levels during the term and after termination, including support contact channels and response times.

• Any obligations to provide critical updates or security patches during wind-down.

HIPAA/HITECH

• Expectation: CareStack supports HIPAA-compliant handling of PHI, including access controls, audit logging, encryption, and business associate agreement (BAA).

SOC 2 (Trust Services Criteria)

• Many modern healthcare SaaS providers pursue SOC 2 reports to demonstrate control effectiveness around security, availability, processing integrity, confidentiality, and privacy.

ISO/IEC 27001 (Information Security Management)

• Some providers obtain ISO 27001 certification or align with its controls as part of an information security management system.

GDPR (where applicable)

• If serving EU customers or processing EU residents’ data, look for GDPR data protection measures, data processing agreements, and transfer mechanisms.

Data residency and localization standards

• Depending on region, options for data storage within a country or region to meet local regulatory requirements.

Industry-specific standards

• Depending on the exact specialty (e.g., dental imaging workflows, radiology), there may be additional standards or best practices, especially around imaging data (PACS integrations) and consent management.

Vendor risk management

• Third-party risk assessments and due diligence often aligned with enterprise procurement standards.