Triage Nurse MVP — the Epic-hybrid workflow

The MVP constraint set: no integrations. Patients call and message the local health system, not Sevaro — so the inbound channels, the In Basket, the orders, and the filed note all live in the client's Epic. Our system runs beside it. This page is the operating model that keeps the two paths sane.

The reframe

Epic = system of record and system of contact. Our system = system of tracking and intelligence. We don't compete with Epic for anything in its lane — we make the triage nurse faster beside it. And for MVP, copy/paste is the integration — deliberately. It's the same muscle the scribe already proved: author in our system, paste into the EHR.

Anti-drift rules

Every artifact has exactly one owner

The failure mode of hybrid systems is double documentation — two half-true versions of the truth. One owner per artifact, one-way flows:

ArtifactOur systemEpic
Triage / visit noteAuthored + archived here OURSPasted in — Epic copy is final EPIC FINAL
Orders, results, patient messagesOnly what she pastes in for assistLives here, period EPIC
Worklist / status / next-actionLives here, period OURSDoesn't exist there
SchedulePaste-parsed snapshotSource EPIC

Our worklist is operational tracking, never a shadow chart.

The MVP

Five pieces, all buildable without integration

1
This-week worklist. Patients seen / to-see per site with statuses (to prep · seen · awaiting orders · follow-up due). Populated by pasting the Epic schedule — AI parses it into rows.
2
Per-site quick-launch. A tile per covered site: login links, contacts, site protocols, coverage notes — same pattern as the current inpatient site launching.
3
Paste-based triage assist. Paste the message or call text (plus a chart snippet if useful) → the existing engine returns tier + pathway + a drafted response → paste back into Epic. The nurse disposes; nothing fires on its own.
4
Our-notes lookup. Instant access to everything we authored on a patient — prior notes, plans, triage history — so she isn't digging through Epic for context we already have.
5
Follow-up tickler. "Call back Thursday" / "check if the MRI resulted" — lightweight, ours only.

Communication topology

Who can reach whom — and the one gap that shapes everything

The triage nurse is virtual. Patients sit at their home clinics. There is no integration and no Sevaro patient portal, so the message lanes are asymmetric — and the asymmetry is the design constraint, not a temporary annoyance.

LaneDirectionHow it works in MVP
Site MA → triage RN→Message in Synapse OURS
Physician / nurse ↔ triage RN↔Message in Synapse, both directions OURS
Patient → triage RN✕ nonePatient calls the local organization. The local org relays to her, or she reads the local portal with her site login.
Triage RN → patient→She calls the patient and/or writes a message in the local portal; our system logs that contact. LOCAL FILED
Consequence

Patients cannot reach us directly, so every inbound path runs through the local organization — which means the per-site portal logins aren't a convenience feature, they're load-bearing infrastructure. And the local-portal message is the filed copy; ours records only that we sent it. Same one-owner rule as the note.

During the call she should be able to run the triage pathway live — or pull it up fast enough to answer in the moment — and the call is recorded with the same ambient AI the scribe already uses.

What we keep, and for how long

Derive and discard, on one uniform clock

The principle: keep the clinical conclusion, discard the raw material on a schedule. The note is the record; everything upstream of it is working material.

ArtifactRetentionWhy
Triage note — disposition + what she knewFull medical-record retention, matched to the local org's policyClinical documentation, and the defense if an outcome is questioned
Call recording + transcriptOne short fixed window (~30–90 days), then automatic purgeQA and dispute window. A recording that outlives its purpose is discoverable and can contradict the note.
Pasted chart contextPurge at encounter closeIt's a copy of Epic's data — Epic is the record
Worklist status, ticklersShort — operational onlyUnless a status encodes a clinical decision, in which case it belongs in the note
Two traps

Backups silently extend real retention. If PITR or snapshots hold 35 days, a 30-day purge policy is fiction unless it covers them.
Selective retention is worse than either extreme. Keeping some calls and not others reads as spoliation. One automatic clock, applied uniformly, no human deletion.

Out of MVP

What the concept demo showed that this cut removes

The demo's queue becomes a worklist — fed by the nurse, not by patients.

Hard gate before real use

The moment the worklist holds real names or MRNs, PHI enters this system — and the deferred security audit findings (systemic API-auth gap) become a blocking prerequisite, not a someday. The real-build kickoff starts with a security-remediation phase, before any live patient tracking.

Risk register — status as of 7/24

Seven risks raised; five now have answers. Ordered by how early each could stop the program.

RiskStatus
Cross-state licensure✓ Resolved — the RN will be licensed across the covered states
BAA coverage per site✓ Resolved — coverage will be in place
Physician standing orders✕ OPEN — do not exist yet. Must be authored, with a policy document around them. Gates live use.
Loop-closure escalation✓ Adopted — ticklers escalate, not just remind
Emergency at distance✓ Adopted — ED script is now location-first (see below)
Call consent✓ Decided — transcribe, don't record; disclose at call open
Return path for the patient✓ Decided — script always routes back to the local org
The one that gates going live

Standing orders don't exist yet. A nurse issuing dispositions practices under physician-approved protocol — and our pathways are that protocol. They need to be authored, signed by a named physician owner, given a review cadence, and wrapped in a policy document. This is now a tracked work item in its own right, not a checkbox on the build.

Transcribe — don't record

Audio is captured only long enough to produce the AI transcript, then discarded. The transcript and the note are what persist. That materially shrinks the retention and discoverability surface versus keeping call recordings.

But disclose anyway

Not retaining audio does not cleanly remove the consent duty — many state statutes turn on intercepting a conversation, not on storing it. So the disclosure is read at the top of every outbound call regardless.

Wording matters: "quality review and care improvement" sits inside HIPAA health-care operations. "Data analytics" is broader, and using patient transcripts to train models is a separate authorization question — worth deciding deliberately rather than inheriting from the disclosure sentence.

Emergency at distance — who dials

911 routes to the caller's location. A virtual nurse cannot dispatch to a patient. So the ED script now establishes location before anything else, then names who dials: the person with the patient, or the local site, or the patient themselves — and if the patient is alone and can't dial, the nurse calls that jurisdiction's 10-digit emergency dispatch, because dialing 911 herself reaches her own area, not theirs.

The return path

Recommendation adopted: the script always routes the patient back to the local organization. A dedicated Sevaro return number is only worth adding if it will actually be answered — an unanswered return line is worse than none, because an urgent patient leaves a voicemail nobody hears in time.

Still open

1
Cross-state licensure. She advises patients in the patient's state. If covered sites span states she needs licensure in each — the Nurse Licensure Compact covers many states but not all. This can stop the program before any technical question matters.
2
Standing orders. A nurse issuing dispositions practices under physician-approved protocol. The pathways are that protocol — so they need a named physician owner, a signature, and a review cadence as a policy document, not only a code gate.
3
Loop closure. The classic triage-malpractice pattern isn't a wrong disposition — it's an urgent callback that never got returned. Ticklers must escalate (N attempts → notify local site + covering physician), not merely remind.
4
Emergency at distance. 911 is location-routed and she is remote — she cannot dispatch to the patient. The ED script must confirm patient location first and state explicitly who dials.
5
Recording consent. Two-party-consent states, governed by where the patient is. Needs a verbal consent line at call open, captured inside the recording itself.
6
No inbound path back. If she calls from a number that won't accept inbound and the patient misses it, that's a dead end — patients don't answer unknown numbers. Either an inbound-capable number, or the script always routes them back to the local org.
7
BAA + identity. Confirm BAA coverage per site for triage activity specifically, and verify patient identity before discussing PHI on an outbound call the patient never initiated.
Captured 2026-07-21 from the MVP working discussion (Steve). Companion pages: working demo · concept overview. Trial-and-error concept material — not product.