Security, data handling, and service details.

02 · Plan references

What each plan status means

Federal and selected accreditor references are built in. The New York pilot also adds state fire-drill items when the saved location and occupancy details match the reviewed rule. New York City, local additions, and other state rules stay in the review list until you add the applicable requirement.

Matched requirement

Added from the saved facility type, location, and oversight answers.

Suggested practice

Added from the services selected during setup.

Needs a local answer

Waiting for a facility detail or local requirement.

Drill on record

A matching finished record is attached and ready for review.

03 · Security controls

Current safeguards

Use this list for an initial security review.

Hosting and identity

The web application runs on Vercel. Supabase provides managed Postgres and authentication.

Workspace isolation

Signed-in users see data for their facility. Participants can open only an active drill with its code.

Record integrity

Each scheduled drill keeps its scenario version, and each completed drill keeps its final report unchanged.

Data scope

Use fictional details for training activity. Do not enter patient information or connect the workflow to an EHR.

Exports

Authorized users can print completed reports and records packets and export drill-history and attendance CSV files.

Web protections

Web traffic uses HTTPS. Responses block framing and restrict content, referrers, and browser permissions.

Provider security details: Vercel and Supabase.

04 · Procurement facts

Vendor review details

Primary providers

Vercel delivers the application. Supabase provides authentication and a managed Postgres database in the eastern United States.

Data ownership and export

The facility retains its entered records. Authorized users can print reports and records packets and export drill-history and attendance files.

Retention and deletion

Records remain available with the facility account. Access, correction, export, and deletion requests are handled through privacy@rehearsecare.com after verification.

Support

Pilot support is handled by email at amit@rehearsecare.com. There is no public response-time or uptime SLA.

Billing

Single Drill is a one-time facility purchase. Founding Facility covers one facility for one year. Activation follows payment confirmation.

Patient information

The pilot is not offered with a BAA and must not receive patient identifiers or other protected health information.

05 · Pilot limits

Current pilot limits

The pilot does not accept protected health information and does not include a BAA or enterprise security features.

• No Business Associate Agreement is available for the current pilot. Do not enter patient information.
• There is no published uptime commitment, disaster-recovery target, or backup schedule.
• Deletion requests are handled by email; self-service deletion and organization audit logs are not yet available.
• The pilot does not include SSO, role-based facility administration, or a public penetration-test report.
• Complete your vendor, privacy, and contract review before organizational use.

06 · Facility review

Review the scenario before the drill

Check the scenario against current protocols, medical direction, staffing, equipment, and the applicable exercise type. After the drill, check the finished record before counting it toward a requirement.

Readiness-profile answers stay with the account that entered them. Choose one plan owner because other staff accounts do not inherit those answers automatically.