How fast can we deploy?

Forty-eight hours to a live tenant subdomain in the standard configuration. The platform is FHIR R4 native against an already-running Vertex AI + AWS + pgcrypto stack, so a tenant deployment is a configuration job — branding, instrument set, SDOH item set, resource catalog, BAA execution — not a code-build job. Custom EHR integrations beyond the FHIR R4 baseline (athenahealth lives today; Epic, eClinicalWorks, and others are reachable through standard FHIR R4 connections) are scoped separately and measured in weeks, not months. The forty-eight-hour clock assumes the BAA is executed day one and a designated clinic admin is available for the configuration call.

Does this fit CMS CCBHC quality measure reporting?

Yes. PHQ-9 is captured on a measurement-based-care cadence with remission and response thresholds flagged per CMS quality-measure convention (remission below five at six and twelve months; response at a fifty-percent reduction from baseline). C-SSRS positive answers route to a same-shift safety-plan task with documented twenty-four-to-seventy-two-hour and seven-to-fourteen-day follow-up callbacks per the Stanley / Brown safety-planning intervention cadence. Closed-loop referral status is recorded against a thirty-day window with documented disposition. The collaborative-care evidence base sits underneath the CMS measure design — Archer 2012 Cochrane across seventy-nine RCTs and twenty-four-thousand-three-hundred-and-eight participants reports a short-term and long-term standardized mean difference of negative-zero-point-three-four for depression symptoms versus usual care, and Unützer 2002 IMPACT is the foundational randomized trial cited throughout the CCBHC quality-measure technical specifications.

Who owns the patient data?

The clinic owns the patient data. HealthcareCheck is a processor under the BAA, not a data owner. A tenant can export every record in FHIR R4 on exit — that is contractual and is part of the mutual BAA. No de-identified data is sold downstream and no patient record is used to train any model. Vertex AI runs under the existing Google Cloud BAA with no-training settings enforced at the project level. The patient-facing app is one-hundred-percent white-label so that the patient relationship belongs to the clinic, not to the vendor. If the relationship ends, the patient record leaves with the clinic in a portable, structured format on a documented timeline.

What happens to existing workflows?

Existing workflows survive. The FHIR R4 ServiceRequest replaces the outbound fax for community referrals and replaces the open-ended phone call for status checks — coordinators still own the clinical judgment and still own the patient relationship, but the artifact they generate is now machine-readable and trackable to closure. Structured PHQ-9 / C-SSRS / SDOH forms replace the narrative version captured in the EHR; the structured score writes back to the EHR through the FHIR R4 connection so the chart of record stays in the EHR. Care-coordination notes and treatment planning continue in the EHR. HealthcareCheck is the navigation layer on top, not the chart of record.

Mutual BAA executed on day one. The subprocessor chain is published: Google Cloud (Vertex AI) under the Google Cloud BAA with no-training enforced at the project level; AWS (compute, RDS PostgreSQL with pgcrypto encryption at rest, SES for transactional email) under the existing AWS BAA; CloudWatch and S3 for log retention under that same BAA. The 45 CFR 164.312 technical safeguards (access control, audit controls, integrity, person-or-entity authentication, transmission security) map one-to-one to platform controls and are re-verified on the weekly HIPAA gate every Wednesday. No subprocessor is added without a signed BAA in place. The BAA list is publicly maintained on the compliance page so the clinic's own audit team can verify the chain without an email thread.

CCBHC patient navigation that actually closes the loop — and proves it on the quality measure.

Closed-loop referral measurement, C-SSRS / PHQ-9 / SDOH workflow, executed BAA chain, white-label tenant in 48 hours. Built by a clinician who spent fourteen years watching the loop never close.

Configure your tenant — 30-min discovery, 48-hour deploy See the 48-hour deploy walkthrough →

Where the pathway breaks — and how we close it

CCBHCs make outbound referrals every day. Almost none of them close. Behavioral-health and social-needs referrals routed through community-based organizations rarely produce a recorded outcome back to the originating clinic — the loop stays open in everyone's chart.

0.6%documented closed-loop completion at baseline (community-based-organization referrals)^cite

Cost when unaddressed: Quality-measure denominators count only what is documented. An open loop is an undocumented loop and undocumented outcomes do not earn the measure.

Every outbound referral generates a FHIR R4 ServiceRequest with a destination, an electronic acknowledgment, a scheduled appointment write-back, and a status update closed within 30 days — or a documented patient-outreach attempt if the destination cannot confirm.

14.0%documented closed-loop completion in the same care-coordination intervention pattern (Baker 2021 RE-AIM)^cite

Before0.6%loop closure (manual fax + phone, no electronic acknowledgment)^cite

After14.0%loop closure with electronic referral + scheduled-appointment write-back (+13.4 pts; Baker 2021)^cite

Impact on closed-loop referral completionMethodology →

The Columbia Suicide Severity Rating Scale is the FDA-recommended standard and is required as a core CCBHC quality measure. In most clinics it is captured on paper at intake, scored inconsistently, and never re-served — a positive answer rarely triggers a documented same-day safety plan.

FDA standard / SAMHSA coreC-SSRS as the cross-setting suicide-risk instrument; CCBHC certification expects structured capture^cite

Cost when unaddressed: An unstructured C-SSRS workflow is an audit risk and a clinical risk simultaneously: there is no signal to act on and no record to defend.

The C-SSRS is delivered through the patient app (or staff-facing form), scored automatically, and routed by severity. A positive ideation-with-method or behavior answer triggers a same-shift safety-plan task with documented 24–72 hour and 7–14 day follow-up callbacks — the Stanley/Brown safety-plan cadence shown to reduce suicidal behavior.

−45%reduction in suicidal behavior at 6 months among emergency-department patients receiving safety-planning intervention vs usual care (Stanley & Brown 2018, JAMA Psychiatry)^cite

BeforePaper / unstructuredC-SSRS captured but rarely actionable; safety-plan completion not measurable per coordinator^cite

AfterStructured + cadencedPositive C-SSRS triggers safety-plan + 24–72hr + 7–14d follow-up callbacks (Stanley 2018 cadence)^cite

Impact on c-ssrs suicide-risk captureMethodology →

The Patient Health Questionnaire-9 is psychometrically the strongest single-instrument depression screener available and is a CMS-aligned CCBHC quality measure for depression remission and response. Most CCBHCs capture PHQ-9 once at intake, never re-serve it on a measurement-based-care cadence, and have no longitudinal trend visible to the treating clinician.

88% / 88%PHQ-9 sensitivity / specificity for major depression at score ≥10 (Kroenke 2001 validation)^cite

Cost when unaddressed: PHQ-9 captured once is intake theater. The CMS quality measure for depression remission requires a follow-up measurement — without it the denominator is empty.

PHQ-9 re-served on a measurement-based-care cadence. The dashboard flags remission (score < 5 at 6 / 12 months) and response (≥ 50% reduction from baseline) per patient and per cohort, exportable in CMS quality-measure format.

SMD −0.34depression-symptom standardized mean difference at short and long term across 79 RCTs / 24,308 participants — collaborative-care vs usual-care meta-analysis (Archer 2012 Cochrane)^cite

BeforeIntake-onlyPHQ-9 scored once, never re-served; depression-remission denominator unreportable^cite

AfterCadenced + reportablePHQ-9 dashboard with remission + response flags exportable in CMS quality-measure format (collaborative-care SMD −0.34, Archer 2012)^cite

Impact on phq-9 trend invisibilityMethodology →

Healthy People 2030 organizes the social determinants of health into five federally recognized domains: economic stability, education access and quality, health care access and quality, neighborhood and built environment, and social and community context. CCBHC certification expects structured capture against this framework. Free-text screening cannot be aggregated and cannot be matched to a referral pathway.

5 federal SDOH domainsHealthy People 2030 SDOH framework (ODPHP, U.S. Department of Health and Human Services)^cite

Cost when unaddressed: Free-text SDOH is a checkbox. Structured SDOH is a referral list. The two are not the same.

PRAPARE-derived items are delivered through the patient app and mapped 1:1 to the five Healthy People 2030 domains. A positive answer in any domain triggers a referral to a vetted community resource and reports back into the SDOH dashboard at the cohort level.

Cluster-actionablestructured SDOH capture is the prerequisite for any closed-loop SDOH referral measurement; documented in the integrated-behavioral-health and community-resource-network literature

BeforeFree-text / unstructuredSDOH captured as narrative; not exportable, not referable^cite

AfterStructured + 5-domainPRAPARE-derived items mapped to the five Healthy People 2030 domains; positive answer triggers referral + closure tracking^cite

Impact on sdoh capture across the five federal domainsMethodology →

Build-it-yourself patient navigation runs nine to eighteen months — a year of CCBHC payroll burned on integration, branding, and HIPAA review before the first patient is screened. Off-the-shelf vendors deploy faster but ship lock-in and surrender the referral data.

9–18 monthsindustry norm for custom-build CCBHC patient-navigation deployments end-to-end^cite

Cost when unaddressed: Every month of pre-launch is a month the closed-loop measure stays unreportable.

Tenant subdomain configured against an existing FHIR R4 + Vertex AI + AWS pgcrypto stack. Branding, instrument set, SDOH item set, and resource catalog provisioned through tenant config — not net-new code.

48 hourstenant subdomain live; first referrals trackable; first PHQ-9 cohort reportable

Before9–18 monthscustom-build patient-navigation timeline^cite

After48 hourstenant subdomain live + first referral measurable

Impact on time-to-deploy for new patient-navigation softwareMethodology →

Patient-navigation vendors typically ship a vendor-branded app. The patient relationship is mediated through a logo the clinic does not own; the data the patient generates is held in a system the clinic cannot export from on exit.

Vendor-brandedincumbent CCBHC patient-engagement tools default to vendor brand on the patient surface^cite

The patient-facing app, every email, every SMS, and every PDF export carry the clinic's logo, color, copy, and domain. HealthcareCheck does not appear on the patient surface. Data is portable on day one — FHIR R4 export of the entire tenant on exit is contractual.

100%white-label coverage on patient surface; FHIR R4 portability on exit

BeforeVendor-brandedpatient sees the vendor's name first^cite

AfterClinic-brandedpatient sees the clinic's name only; data portable in FHIR R4

Impact on vendor branding lock-in

Under the 2013 HIPAA Omnibus Rule, business associates and their subcontractors are directly liable to the federal government — not just to the covered entity. A CCBHC inherits the chain. If a downstream subprocessor cannot show a signed BAA, the clinic owns the gap at audit.

$137 – $2.067MHHS Office for Civil Rights tier-4 willful-neglect civil-monetary-penalty range per identical violation per year (2024 inflation-adjusted)^cite

Cost when unaddressed: An undocumented BAA chain is a tier-4 willful-neglect exposure waiting for a complaint to land.

Mutual BAA executed on day one. Subprocessor chain (Vertex AI under Google Cloud BAA, AWS under existing BAA, RDS pgcrypto encryption at rest, AWS SES under AWS BAA) published and version-tracked. 45 CFR 164.312 technical safeguards mapped 1:1 to platform controls and re-verified on the weekly HIPAA gate (Wednesday cadence).

Audit-readyexecuted BAA list + subprocessor chain published; 45 CFR 164.312 mapping verified weekly

BeforeVerbal / opaquesubprocessor BAAs not centrally documented; chain liability latent^cite

AfterPublished + weekly-verifiedexecuted BAA list + 45 CFR 164.312 mapping + weekly HIPAA gate^cite

Impact on baa chain defensibilityMethodology →

Methodology

How we measure

A "completed loop" is the unit of work. HealthcareCheck counts a referral as closed when all four of the following are recorded against a single FHIR R4 ServiceRequest within thirty days of issue: (a) the ServiceRequest is generated with a named destination organization or practitioner; (b) an electronic acknowledgment is received from that destination, or — when the destination cannot confirm electronically — a documented patient-outreach attempt is recorded by the originating coordinator; (c) a scheduled appointment is written back to the originating record, or a documented disposition is recorded (declined, no-contact, alternative-route); (d) the ServiceRequest status is set to completed, revoked, or entered-in-error within the thirty-day window. Loops that exceed thirty days without disposition are reported as open and excluded from the closed-loop numerator. PHQ-9 remission is defined per the Kroenke / CMS quality-measure convention as a score below five at six and twelve months; response is defined as a fifty-percent or greater reduction from baseline. C-SSRS positive answers (ideation with method or any behavior) trigger a same-shift safety-plan task with documented twenty-four-to-seventy-two-hour and seven-to-fourteen-day follow-up callbacks per the Stanley / Brown safety-planning intervention. SDOH is captured against the five federally recognized Healthy People 2030 domains using PRAPARE-derived items and is referable from the same workflow.

What counts

FHIR R4 ServiceRequest with named destination organization or practitioner
Electronic acknowledgment from destination or documented patient-outreach attempt
Scheduled appointment write-back or documented disposition
Status set within 30 days (completed | revoked | entered-in-error)
PHQ-9 remission flag at < 5 at 6 / 12 months and response flag at ≥ 50% reduction
C-SSRS positive answer triggers same-shift safety-plan task with cadenced callbacks

What doesn't count

Verbal-only referrals without a FHIR R4 ServiceRequest record
Loops without an acknowledgment or a documented outreach attempt
Loops exceeding 30 days without disposition (reported as open, not closed)
PHQ-9 captured at intake only with no follow-up measurement
C-SSRS captured without structured score and severity routing

Sources:baker-2021-closed-loop-tobacco, kroenke-2001-phq9-validation, archer-2012-cochrane-collaborative-care-meta, posner-2011-cssrs-validation, stanley-2018-safety-planning-ed-cohort, odphp-2030-sdoh-framework, hl7-fhir-r4-2019, hhs-2013-omnibus-rule-baa-requirements, hhs-45-cfr-164-312-technical-safeguards

How we compare

Sourced from primary citations — not vendor marketing claims.

	UsHealthcareCheck	vsUnite Us	vsFindhelp	vsCustom build
Time-to-deploy	48 hours (tenant config against live FHIR R4 stack)	Months (vendor onboarding cycle)	Weeks (network configuration)	9–18 months (build + HIPAA review)
White-label depth	100% — patient surface, email, SMS, PDF	Co-branded / vendor-prominent	Vendor-branded (Findhelp surfaces directly to patient)	Custom — but rebuilt from zero
CCBHC quality measure capture (PHQ-9 / C-SSRS)^cite	Native (cadenced + remission flags + safety-plan trigger)	Not the product (referral routing focus)	Not the product (resource directory focus)	Possible — but you build it
Closed-loop referral measurement^cite	FHIR R4 ServiceRequest + 30-day closure window	Network-mediated; depends on partner integration depth	Search + connect; closure depends on partner reporting	Possible — but you build it
FHIR R4 native^cite	Yes — every artifact is FHIR R4	Partial / network-dependent	Partial / network-dependent	Possible — but you build it
Executed BAA list (subprocessor chain)^cite	Published + weekly-verified	Vendor BAA available; subprocessor chain less commonly documented	Vendor BAA available; subprocessor chain less commonly documented	Your responsibility to assemble
Patient data ownership / portability	Clinic owns; FHIR R4 export on exit; no training	Network-mediated	Directory-mediated	Clinic owns (you built it)
Built by	LCSW with 14 years across 13 clinical settings — not a tech founder	Tech founder + healthcare advisors	Tech founder + healthcare advisors	Your in-house team

Frequently asked questions

How fast can we deploy?: Forty-eight hours to a live tenant subdomain in the standard configuration. The platform is FHIR R4 native against an already-running Vertex AI + AWS + pgcrypto stack, so a tenant deployment is a configuration job — branding, instrument set, SDOH item set, resource catalog, BAA execution — not a code-build job. Custom EHR integrations beyond the FHIR R4 baseline (athenahealth lives today; Epic, eClinicalWorks, and others are reachable through standard FHIR R4 connections) are scoped separately and measured in weeks, not months. The forty-eight-hour clock assumes the BAA is executed day one and a designated clinic admin is available for the configuration call.
Cited:hl7-fhir-r4-2019
Does this fit CMS CCBHC quality measure reporting?: Yes. PHQ-9 is captured on a measurement-based-care cadence with remission and response thresholds flagged per CMS quality-measure convention (remission below five at six and twelve months; response at a fifty-percent reduction from baseline). C-SSRS positive answers route to a same-shift safety-plan task with documented twenty-four-to-seventy-two-hour and seven-to-fourteen-day follow-up callbacks per the Stanley / Brown safety-planning intervention cadence. Closed-loop referral status is recorded against a thirty-day window with documented disposition. The collaborative-care evidence base sits underneath the CMS measure design — Archer 2012 Cochrane across seventy-nine RCTs and twenty-four-thousand-three-hundred-and-eight participants reports a short-term and long-term standardized mean difference of negative-zero-point-three-four for depression symptoms versus usual care, and Unützer 2002 IMPACT is the foundational randomized trial cited throughout the CCBHC quality-measure technical specifications.
Cited:kroenke-2001-phq9-validation, posner-2011-cssrs-validation, stanley-2018-safety-planning-ed-cohort, archer-2012-cochrane-collaborative-care-meta, unutzer-2002-impact-collaborative-care-trial
Who owns the patient data?: The clinic owns the patient data. HealthcareCheck is a processor under the BAA, not a data owner. A tenant can export every record in FHIR R4 on exit — that is contractual and is part of the mutual BAA. No de-identified data is sold downstream and no patient record is used to train any model. Vertex AI runs under the existing Google Cloud BAA with no-training settings enforced at the project level. The patient-facing app is one-hundred-percent white-label so that the patient relationship belongs to the clinic, not to the vendor. If the relationship ends, the patient record leaves with the clinic in a portable, structured format on a documented timeline.
Cited:hhs-2013-omnibus-rule-baa-requirements, hl7-fhir-r4-2019
What happens to existing workflows?: Existing workflows survive. The FHIR R4 ServiceRequest replaces the outbound fax for community referrals and replaces the open-ended phone call for status checks — coordinators still own the clinical judgment and still own the patient relationship, but the artifact they generate is now machine-readable and trackable to closure. Structured PHQ-9 / C-SSRS / SDOH forms replace the narrative version captured in the EHR; the structured score writes back to the EHR through the FHIR R4 connection so the chart of record stays in the EHR. Care-coordination notes and treatment planning continue in the EHR. HealthcareCheck is the navigation layer on top, not the chart of record.
Cited:hl7-fhir-r4-2019
BAA execution path?: Mutual BAA executed on day one. The subprocessor chain is published: Google Cloud (Vertex AI) under the Google Cloud BAA with no-training enforced at the project level; AWS (compute, RDS PostgreSQL with pgcrypto encryption at rest, SES for transactional email) under the existing AWS BAA; CloudWatch and S3 for log retention under that same BAA. The 45 CFR 164.312 technical safeguards (access control, audit controls, integrity, person-or-entity authentication, transmission security) map one-to-one to platform controls and are re-verified on the weekly HIPAA gate every Wednesday. No subprocessor is added without a signed BAA in place. The BAA list is publicly maintained on the compliance page so the clinic's own audit team can verify the chain without an email thread.
Cited:hhs-2013-omnibus-rule-baa-requirements, hhs-45-cfr-164-312-technical-safeguards

Patient navigation should be infrastructure a clinic owns — not a vendor relationship that holds the clinic's referral data hostage.
— Matthew Sexton, LCSW

I am a Licensed Clinical Social Worker. Fourteen years across thirteen clinical settings — community mental health, forensic ACT, substance-abuse treatment, dialysis social work, private practice. I have been the coordinator on the receiving end of the broken referral and the clinician on the sending end. I have written the safety plan at 4:47 PM on a Friday and I have watched the chart sit untouched for thirty-five days.

I built HealthcareCheck because every CCBHC I have walked through tries to solve patient navigation the same two ways and both lose. Build it yourself: nine to eighteen months and a payroll line I cannot defend to my board. Buy a directory tool: thirty days later your referral data is somebody else's product and your patient is staring at somebody else's logo.

The closed loop is the unit of work. The quality measure is the unit of accountability. The BAA chain is the unit of trust. We measure all three and we publish all three. Patient navigation should be infrastructure a clinic owns — not a vendor relationship that holds the clinic's referral data hostage. That is the entire pitch.

Matthew Sexton, LCSWFounder · Mental Wealth Solutions Inc.

Citations

baker-2021-closed-loop-tobaccoSee citations/baker-2021-closed-loop-tobacco.mdx for primary source, DOI/PMID, and key statistics.
kroenke-2001-phq9-validationSee citations/kroenke-2001-phq9-validation.mdx for primary source, DOI/PMID, and key statistics.
archer-2012-cochrane-collaborative-care-metaSee citations/archer-2012-cochrane-collaborative-care-meta.mdx for primary source, DOI/PMID, and key statistics.
posner-2011-cssrs-validationSee citations/posner-2011-cssrs-validation.mdx for primary source, DOI/PMID, and key statistics.
stanley-2018-safety-planning-ed-cohortSee citations/stanley-2018-safety-planning-ed-cohort.mdx for primary source, DOI/PMID, and key statistics.
unutzer-2002-impact-collaborative-care-trialSee citations/unutzer-2002-impact-collaborative-care-trial.mdx for primary source, DOI/PMID, and key statistics.
odphp-2030-sdoh-frameworkSee citations/odphp-2030-sdoh-framework.mdx for primary source, DOI/PMID, and key statistics.
hrsa-2023-uds-national-rollupSee citations/hrsa-2023-uds-national-rollup.mdx for primary source, DOI/PMID, and key statistics.
hl7-fhir-r4-2019See citations/hl7-fhir-r4-2019.mdx for primary source, DOI/PMID, and key statistics.
hhs-2013-omnibus-rule-baa-requirementsSee citations/hhs-2013-omnibus-rule-baa-requirements.mdx for primary source, DOI/PMID, and key statistics.
hhs-45-cfr-164-312-technical-safeguardsSee citations/hhs-45-cfr-164-312-technical-safeguards.mdx for primary source, DOI/PMID, and key statistics.
ocr-2024-hipaa-enforcement-statisticsSee citations/ocr-2024-hipaa-enforcement-statistics.mdx for primary source, DOI/PMID, and key statistics.
irani-2020-closed-loop-radiologySee citations/irani-2020-closed-loop-radiology.mdx for primary source, DOI/PMID, and key statistics.
katon-2010-team-care-diabetes-depression-nejmSee citations/katon-2010-team-care-diabetes-depression-nejm.mdx for primary source, DOI/PMID, and key statistics.
madras-2009-sbirt-multi-site-samhsaSee citations/madras-2009-sbirt-multi-site-samhsa.mdx for primary source, DOI/PMID, and key statistics.
betz-2020-lock-to-live-lethal-means-rctSee citations/betz-2020-lock-to-live-lethal-means-rct.mdx for primary source, DOI/PMID, and key statistics.
costantini-2021-phq9-systematic-reviewSee citations/costantini-2021-phq9-systematic-review.mdx for primary source, DOI/PMID, and key statistics.

Ready to close the gap?

Configure your tenant — 30-min discovery, 48-hour deploy See the 48-hour deploy walkthrough →

CCBHC patient navigation that actually closes the loop — and proves it on the quality measure.

Where the pathway breaks — and how we close it

Closed-loop referral completion

FHIR R4 ServiceRequest with 30-day closure tracking

C-SSRS suicide-risk capture

Structured C-SSRS workflow with safety-plan trigger

PHQ-9 trend invisibility

Longitudinal PHQ-9 dashboard with remission and response flags

SDOH capture across the five federal domains

PRAPARE-derived items mapped to the five federal domains

Time-to-deploy for new patient-navigation software

FHIR R4 native white-label tenant in 48 hours

Vendor branding lock-in

100% white-label tenant

BAA chain defensibility

Executed BAA list published; subprocessor chain documented