Care Coordination & Provider Integration

Part of the Anaya Care Handbook — the source of truth for how the product must behave. When the product needs to change, change this document first, then make the system match it.

Implementation status — this module is specified but not yet built. Every rule below is 🚧 Spec only until the feature ships and this page is audited against the code. Legend: ✅ In code · ⚠️ Partial · 🚧 Spec only (not yet built).

What this covers

This page governs care coordination with a client's outside healthcare providers: how a representative authorizes a specific doctor, specialist, or home health team to see a read-only slice of the client's health information; how the agency is held to a strict boundary that it may never reach out to an external party on its own; how Care Summary Reports are generated and delivered to authorized providers on a schedule or before an appointment; and how care managers and authorized providers exchange secure messages, including doctors sending updated orders back into the platform.

Care coordination is the bridge between the agency and the people who care for the client outside it. It deliberately keeps the agency in a supporting role: the representative (or a Durable Power of Attorney) decides who may be contacted and what they may see, and the platform never substitutes its own judgment for that decision.

Key terms

• Authorized provider — A healthcare provider (primary care doctor, specialist, home health team, hospital, or hospice) whom the representative has explicitly approved to receive a read-only view of the client's relevant health information.
• Representative — The family contact who speaks for the client; here, the person who authorizes provider access and outreach.
• Responsible party — The data and access gatekeeper (representative or Durable Power of Attorney) who grants provider access and approves external contact.
• DPOA — Durable Power of Attorney; a responsible party with legal authority to authorize contact and access on the client's behalf.
• Provider Contact Authorization Boundary — The rule that the agency may not initiate contact with any external party unless the representative or DPOA has explicitly authorized it, case by case.
• Authorization recommendation — A prompt the platform surfaces to suggest that obtaining authorization would enable provider outreach; it is advice only and never sends anything.
• Care Summary Report — A health summary built from the Health Snapshot template and delivered to authorized providers on a schedule or ahead of an appointment.
• Pre-appointment summary — A Care Summary generated before a scheduled appointment, which a care manager must authorize before it is delivered.
• Updated orders — Instructions a doctor sends back into the platform through secure messaging, for the care team to act on.
• EHR integration — A future capability to connect with external health record systems such as Epic and Cerner.

How it works

Authorized provider access

The representative authorizes specific healthcare providers, one at a time. Each authorized provider gets a read-only view that is limited to the information necessary for their role — a specialist sees what is relevant to their specialty, not the client's entire record. Providers cannot edit data in the platform; their only inbound channel is secure messaging (see below). Access is tied to the authorization the representative grants and ends when that authorization is withdrawn.

The provider contact boundary

The agency cannot initiate contact with any healthcare provider, APS (Adult Protective Services) office, legal representative, or other external party on its own. Contact is permitted only when the representative or DPOA has explicitly authorized it, on a case-by-case basis. The platform supports this without ever overriding it: when authorization would unlock useful outreach, it surfaces a recommendation to the care team to seek that authorization — but it never triggers an external communication automatically. Every authorization is logged with the identity of the person who gave it and a timestamp, so there is always a record of who approved which outreach and when.

Care Summary Reports

Care Summary Reports are generated through Report Generation using the Health Snapshot template, and pull together the client's recent picture: vital sign trends, symptom changes, medication reminder adherence, incidents, and care provider observations. They are auto-generated and sent to authorized providers either on a recurring schedule or ahead of an appointment.

A pre-appointment summary is generated automatically before a scheduled appointment, but it is not delivered automatically. A care manager must authorize delivery first, so a person always reviews what goes out to a provider before the appointment.

Two-way secure messaging

Care managers and authorized providers can exchange secure messages directly. This is a two-way channel: doctors can send updated orders into the platform through it, so changes to the client's care reach the team without leaving a paper trail behind. Secure messaging runs through the platform's Communication infrastructure and, where a live consult is needed, connects with Telehealth Services.

EHR integration (Future)

Direct integration with external health record systems — Epic, Cerner, and others — is a future capability. It is not part of this release and is tracked alongside other external connections in Integrations & API.

Rules

1. COORD-1 — A representative authorizes specific healthcare providers individually; access is never granted to a provider the representative has not named. (🚧 Spec only)
2. COORD-2 — An authorized provider's view is read-only and limited to the information necessary for their role; they cannot edit data in the platform. (🚧 Spec only)
3. COORD-3 — The agency cannot initiate contact with any healthcare provider, APS office, legal representative, or other external party unless the representative or DPOA has explicitly authorized it, case by case. (🚧 Spec only)
4. COORD-4 — The platform surfaces a recommendation when obtaining authorization would enable provider outreach, but the recommendation only advises the care team and sends nothing. (🚧 Spec only)
5. COORD-5 — The platform never triggers an external communication automatically. (🚧 Spec only)
6. COORD-6 — Every authorization is logged with the identity of the person who granted it and a timestamp. (🚧 Spec only)
7. COORD-7 — Care Summary Reports are generated through Report Generation using the Health Snapshot template and include vital sign trends, symptom changes, medication reminder adherence, incidents, and care provider observations. (🚧 Spec only)
8. COORD-8 — Care Summary Reports are delivered to authorized providers on a recurring schedule or ahead of an appointment. (🚧 Spec only)
9. COORD-9 — A pre-appointment summary is generated automatically before a scheduled appointment but requires care-manager authorization before it is delivered. (🚧 Spec only)
10. COORD-10 — Care managers and authorized providers exchange messages through a secure two-way channel. (🚧 Spec only)
11. COORD-11 — Doctors can send updated orders into the platform through secure messaging. (🚧 Spec only)
12. COORD-12 — When an authorization is withdrawn, the provider's read-only access ends and any further outreach to that party is no longer permitted. (🚧 Spec only)
13. COORD-13 — Integration with external health record systems (Epic, Cerner, and others) is a future capability and is out of scope for this release. (🚧 Spec only)

Who can do what

Decisions needed

• Who may withdraw a provider authorization — only the representative or DPOA who granted it, or any responsible party for the client?
• When a representative and a DPOA both exist for a client, which one's authorization governs, and what happens if they conflict?
• How is a Care Summary delivered to an authorized provider who is not a platform user (for example by secure link or email), and what proves they received it?
• Does the read-only "information necessary for their role" slice need a per-specialty definition, or does the care manager curate it per provider?
• How long is a pre-appointment summary's care-manager authorization valid if the appointment is rescheduled?
• Should the authorization log feed the broader audit trail in Security & Compliance, and what is its retention period?