Residual Risk & Boundary of Liability

Effective June 9, 2026

Epithel Care (operated by Epithel Care, LLC) is engineered to make HIPAA violations, cross-facility PHI leakage, and inappropriate clinical reliance architecturally difficult. No software eliminates risk entirely. This page enumerates the residual risks that remain after Epithel Care's controls and identifies where responsibility sits.

1. Customer / facility misuse

Epithel Care cannot prevent a properly authenticated clinician or administrator from misusing their granted access — for example, looking up a resident for non-treatment reasons, sharing a screen with an unauthorized party, or exporting a report and mishandling it outside the application. Facility-side workforce training, sanctions, and prompt account de-provisioning under the executed Business Associate Agreement are the customer's responsibility.

2. Subprocessor incidents

Epithel Care relies on the subprocessors listed on the Subprocessors page. A security incident at a subprocessor — while covered by an executed BAA and flow-down obligations — is outside Epithel Care's direct operational control. Epithel Care commits to timely notification and cooperation as required by 45 CFR § 164.410 and the executed BAA.

3. Clinical judgment

Epithel Care functions as a Clinical Decision Support tool within the 21st Century Cures Act safe harbor. Every calculated value (Braden score, wound area/volume, healing percentage) is displayed alongside its raw inputs so the licensed clinician can independently review the basis of any recommendation and is not required to rely primarily on Epithel Care's output. Diagnostic and treatment decisions remain the responsibility of the licensed clinician; Epithel Care does not practice medicine.

4. Novel legal or regulatory theories

New federal or state guidance, novel plaintiff theories, or changes in surveyor interpretation may create obligations that current controls do not anticipate. Epithel Care monitors HHS/OCR, CMS, FDA, and state surveyor guidance and will update controls, notices, and this page as needed. Nothing on this page constitutes legal advice or a guarantee of any specific outcome in litigation or a survey.

5. Boundary of liability

Epithel Care's liability is defined by the executed Business Associate Agreement, Terms of Service, and any Master Services Agreement between Epithel Care, LLC and the customer facility. Liability for facility workforce misuse, for subprocessor incidents beyond Epithel Care's operational control, and for clinical decisions made by a licensed clinician using the tool is allocated as set forth in those agreements.

See also: Security & Encryption · Subprocessors · BAA Notice.