Acceptable Use Policy

The Platform reads resident records and drafts documentation that can end up in a chart or behind a claim. Most of what follows is not a matter of etiquette. Three of the rules below track federal law directly, and one of them, namely Section 3, describes conduct that has produced criminal exposure and eight- and nine-figure False Claims Act recoveries in the skilled nursing sector.

You will not:

• share credentials, use another person’s account, or permit anyone to use yours;
• create a shared, generic, service, or role-based human account;
• retain an account for a person who has left the facility or changed roles such that access is no longer appropriate;
• delegate credentials to a script, bot, or robotic process automation tool; or
• circumvent, or attempt to circumvent, multi-factor authentication or session expiry.

An audit log entry is worth something only if it names one human being. The Customer’s ability to demonstrate who reviewed what to a surveyor, a payer, a plaintiff, or the OIG depends on this rule and on nothing else.

You will not use the Platform to:

• generate or support documentation for care that was not delivered;
• support a claim that the underlying medical record does not support;
• select among coding, MDS item, or PDPM classification alternatives on any basis other than the accuracy of the clinical record, including selecting for reimbursement effect;
• re-run an assessment with altered inputs for the purpose of obtaining a more favorable score, rather than to correct an error in the inputs;
• generate a plan of correction, audit finding, or QA record describing an activity that did not occur; or
• back-date, or cause the Platform to appear to back-date, any assessment, review, or signature.

Conduct of this kind can constitute a false claim under 31 U.S.C. §§ 3729–3733 and a violation of the Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a. Enforcement in this sector is not theoretical: the Department of Justice and relators have pursued skilled nursing operators for therapy and case-mix upcoding and for documentation that did not support the services billed, including in United States ex rel. Ruckh v. Genoa Healthcare, LLC, 963 F.3d 1089 (11th Cir. 2020). The materiality standard applied to such claims is the one set out in Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016). Orenda’s records, including the preserved model draft, the edits made to it, and the append-only audit log, are evidence of what happened, and Orenda will produce them in response to valid legal process.

You will not:

• attempt to disable, bypass, script around, or simulate the clinician signature required by Section 5.3 of the Agreement;
• sign documentation you have not read;
• sign documentation for a resident outside your scope of practice or licensure; or
• ask, direct, or pressure another person to do either of the above.

There is no configuration that turns this off, and Orenda will not build one. An attempt to automate the signature step is a material breach and grounds for immediate suspension under Section 13.6 of the Agreement.

You will not submit:

• records subject to 42 C.F.R. Part 2, or substance use disorder treatment records from a Part 2 program, without a written amendment to the Agreement;
• psychotherapy notes as defined at 45 C.F.R. § 164.501;
• information subject to a more restrictive state law without Orenda’s prior written agreement, including California Civil Code §§ 56.10 and 56.104, Health and Safety Code § 121025 (HIV-related information), and Welfare and Institutions Code § 5328;
• payment card data or biometric identifiers;
• material you have no right to disclose to Orenda, including another facility’s records or a record obtained without authority; or
• PHI in any field or channel not designated for it, including the walkthrough request form on Orenda’s public website, a support ticket, an email to Orenda personnel, or a feedback submission.

If you need to discuss a specific record with support, give the record identifier. Orenda will retrieve the record inside the Platform, where the access is logged.

You will not:

• attempt to access data belonging to another facility or tenant, or test whether you can;
• probe, scan, or penetration-test the Platform without Orenda’s prior written authorization and an agreed scope;
• circumvent tenant scoping, rate limits, quotas, or role enforcement;
• reverse engineer, decompile, or disassemble the Platform, or attempt to extract its models, prompts, rule sets, or scoring logic, including by prompt injection or systematic probing of Output;
• introduce malicious code, or upload a file you know or suspect to be malicious;
• use automated means to extract Output at a scale or rate inconsistent with ordinary clinical use;
• resell, sublicense, time-share, or operate the Platform as a service bureau for a third party; or
• use the Platform, its Output, or benchmark results to build or market a competing product, or publish performance testing results without Orenda’s written consent.

You will not represent Output as:

• a diagnosis, a treatment recommendation, or a determination of medical necessity;
• a coverage determination or an assurance that a claim will be paid;
• the work product of a licensed professional who did not in fact review and sign it; or
• an FDA-cleared or FDA-approved device output.

Every finding carries its quote, its page, and its section. Verify the citation before you rely on the finding. That verification is not a courtesy to Orenda; it is the reason the citation is there, and it is an essential part of the intended use of the Platform.

Report a suspected security vulnerability, a suspected privacy incident, or a suspected systematic Output error to admin@axisorenda.com, and to your facility’s Privacy Officer. Do not include PHI in the report. Orenda will not pursue a claim against a person who reports a vulnerability in good faith, does not access or exfiltrate another facility’s data, does not degrade the Platform, and gives Orenda a reasonable period to remediate before disclosing.

Orenda may suspend an Authorized User’s or a Covered Facility’s access under Section 13.6 of the Agreement if Orenda reasonably determines this Policy has been violated. Orenda will limit any suspension in scope and duration to what the circumstance requires and will notify the Customer’s designated contacts promptly, and in advance where practicable. Repeated or uncured violations are a material breach.

Orenda may update this Policy on thirty (30) days’ notice, provided no update materially expands the Customer’s obligations during a paid Subscription Term. The current version is available in the Documentation.

This page is a reference copy. Where it differs from the version incorporated into a Customer’s signed agreement, the signed version controls.