Security & PHI Notice

NICI.care public forms are for business inquiries and relationship-building only. Visitors should not submit resident names, medical information, medication information, incident details involving identifiable residents, medical record numbers, photos, passwords, payment details, or other sensitive data.

If sensitive information is submitted accidentally, CAOMS should route it through an internal privacy/security review process and avoid using it for marketing or analytics.

Before production PHI use, CAOMS and the facility should confirm approved hosting, storage, access controls, audit logging, export controls, role permissions, user training, facility policy alignment, and any required written agreements.

Medication, MAR, PRN, incident, infection, emergency, surveyor/reviewer access, exports, and compliance report workflows should be reviewed against facility policy and CAOMS compliance approval before live production use.

NICI™ production use should rely on role-based and permission-based access, not role labels alone.

Read-only reviewer access should remain read-only in both the user interface and backend permission checks. Correction workflows should preserve original records and timestamps rather than silently overwriting source records.

Public materials may state that NICI™ is designed with HIPAA-aware architecture and HIPAA-compliant storage planning.

NICI™ should not be treated as a guaranteed HIPAA compliance solution unless the production environment, policies, business associate arrangements, vendors, safeguards, training, and operational controls are reviewed and documented.