Residual Risk & Boundary of Liability

Effective June 9, 2026

Epithel (operated by Epithel Care, LLC) is engineered to make HIPAA violations, cross-facility PHI leakage, and inappropriate clinical reliance architecturally difficult. No software eliminates risk entirely. This page enumerates the residual risks that remain after Epithel's controls and identifies where responsibility sits.

1. Customer / facility misuse

Epithel cannot prevent a properly authenticated clinician or administrator from misusing their granted access — for example, looking up a resident for non-treatment reasons, sharing a screen with an unauthorized party, or exporting a report and mishandling it outside the application. Facility-side workforce training, sanctions, and prompt account de-provisioning under the executed Business Associate Agreement are the customer's responsibility.

2. Subprocessor incidents

Epithel relies on the subprocessors listed on the Subprocessors page. A security incident at a subprocessor — while covered by an executed BAA and flow-down obligations — is outside Epithel's direct operational control. Epithel commits to timely notification and cooperation as required by 45 CFR § 164.410 and the executed BAA.

3. Clinical judgment

Epithel functions as a Clinical Decision Support tool within the 21st Century Cures Act safe harbor. Every calculated value (Braden score, wound area/volume, healing percentage) is displayed alongside its raw inputs so the licensed clinician can independently review the basis of any recommendation and is not required to rely primarily on Epithel's output. Diagnostic and treatment decisions remain the responsibility of the licensed clinician; Epithel does not practice medicine.

4. Novel legal or regulatory theories

New federal or state guidance, novel plaintiff theories, or changes in surveyor interpretation may create obligations that current controls do not anticipate. Epithel monitors HHS/OCR, CMS, FDA, and state surveyor guidance and will update controls, notices, and this page as needed. Nothing on this page constitutes legal advice or a guarantee of any specific outcome in litigation or a survey.

5. Boundary of liability

Epithel's liability is defined by the executed Business Associate Agreement, Terms of Service, and any Master Services Agreement between Epithel Care, LLC and the customer facility. Liability for facility workforce misuse, for subprocessor incidents beyond Epithel's operational control, and for clinical decisions made by a licensed clinician using the tool is allocated as set forth in those agreements.

See also: Security & Encryption · Subprocessors · BAA Notice.