D — Commercial Positioning
Technical Questions for Regis
These questions are offered constructively. They identify the technical information that public material cannot establish, and that would need to be understood before any assessment of alignment is meaningful.
These questions are framed for a confidential technical discussion. They are not assertions about how Regis systems currently operate.
01 · Identity and point of care
- How is a resident or client identified at the point of care today?
- Is presence at the point of care evaluated when information is requested?
- Does identification of a resident change what a user can see, or only which record is opened?
02 · Role, authority and purpose
- Are permissions derived from job title alone, or from role plus assignment plus purpose?
- Is professional registration verified at the point of release for clinical attributes?
- Is the purpose of a request captured, and does it affect what is returned?
- How is legal authority — guardianship or enduring power — modelled distinctly from family relationship?
03 · Attribute-level release
- Is access controlled at record level, screen level or individual attribute level?
- Can allergy or dietary information be released without exposing the clinical record?
- Can two users with the same role receive different attribute sets based on context?
04 · Time, revocation and expiry
- Is access time-bounded to a shift, visit or episode?
- How quickly does revocation propagate to mobile devices, vendors and integrations?
- Is data cached on mobile devices, and for how long?
05 · Integration and analytics
- Which interoperability standards are used across residential, home care and external partners?
- Are API scopes attribute-level or record-level?
- Where is the decision made about whether analytic inputs are identifiable, pseudonymised or aggregated?
- Do AI or analytics services receive identifiable data at any stage?
06 · Recording and evidence
- Are disclosures logged at attribute level?
- Is the reason for release recorded alongside the release itself?
- Can a past disclosure decision be reconstructed for an incident or complaint review?
- Is external and vendor access separately traceable?
07 · Jurisdiction and location
- Are storage location and jurisdiction evaluated when information is released?
- How is offshore service-provider access controlled at the point of disclosure?
How these questions would be used
Answers would inform a joint technical assessment of where CareBand's architecture could add control, evidence or exposure reduction — and equally, where Regis' existing systems already address the requirement.