A Long-Term Care Administrator’s Review of Stratosphere’s PACT

Written by Elizabeth Schueler, a Nursing Home / Assisted Living Administrator responsible for CMS and state survey readiness

Why I Went Looking for Something Like This

Anyone who has sat across the table from a state surveyor knows the drill. They don’t ask “do you have a policy?” They ask “show me the record.” And they don’t want a summary — they want the original entry, the timestamp, and proof that nothing was changed after the fact.

In long-term care, that burden sits on top of an already dense regulatory stack: 42 CFR Part 483 survey requirements, the OIG’s seven elements of an effective compliance and ethics program, HIPAA’s audit control requirements for any system touching ePHI, PBJ staffing submissions, and whatever your state’s health department layers on top. Every one of those regimes eventually comes down to the same question: can you prove your records are exactly what they claim to be, from the moment they were created?

That’s the problem PACT (Stratosphere’s Compliance Toolkit) is built to solve. It doesn’t replace your EHR, your eMAR, your incident reporting system, or your staffing software. It sits underneath them, cryptographically fingerprinting records as they’re created and giving you a way to prove — mathematically, not just on your word — that they haven’t been altered since.

What PACT Actually Does

Stripped of the marketing language, PACT’s core function is straightforward:

• Hash — Every record (a progress note, a medication administration entry, an incident report, a staffing log) gets run through a cryptographic hash function the moment it’s finalized. The output is a unique fingerprint of that exact record, at that exact moment.
• Anchor — That fingerprint gets anchored to a tamper-evident, timestamped ledger external to your own systems. This is the piece that matters most to an administrator: the proof of integrity doesn’t live inside the same system that produced the record, which means nobody on staff — including me — can quietly edit history after an incident.
• Verify — At any point afterward, anyone with the right access (an internal QA reviewer, a state surveyor, corporate compliance, outside legal counsel) can re-hash the current version of the record and compare it against the anchored fingerprint. If they match, the record is provably unaltered. If they don’t, that’s flagged immediately.

It’s delivered as an API, which means it’s meant to be wired into whatever documentation systems a facility already runs, rather than replacing them.

Why This Matters When Evidence Is Sitting Across the Table From an Auditor

1. It converts “trust us” into “verify it yourself”

The single biggest shift PACT makes in an audit conversation is that it takes the facility’s credibility out of the equation. Surveyors and OIG investigators are trained to be skeptical of self-reported documentation — and they should be, because paper trails and even standard EHR audit logs can theoretically be edited by anyone with admin rights. With PACT, the administrator isn’t asking the surveyor to take the record’s integrity on faith. The surveyor (or their IT designee) can independently recompute the hash and confirm it against the anchor. That’s a categorically stronger position than “our system logs edits,” because the verification doesn’t depend on trusting the same organization that’s being audited.

2. It directly answers the falsification question

Nearly every serious deficiency citation involving documentation eventually raises the same suspicion: was this entry made when it says it was made, or was it backfilled after something went wrong? A late incident report, a medication administration record completed after a survey was already announced, a care plan revision dated suspiciously close to a fall — these are the scenarios that turn a routine survey into an Immediate Jeopardy finding or a referral to the state’s Medicaid Fraud Control Unit.

Because PACT anchors the hash at the moment of creation, it establishes a defensible answer to “when was this really written?” that doesn’t rely on internal system clocks or staff testimony. For an administrator, that’s not just a compliance nicety — it’s protection against the worst-case outcome of a survey: an allegation that the facility manipulated records to cover up a care failure.

3. It supports the OIG’s seven-element compliance program, not just individual records

The OIG’s guidance for nursing facility compliance programs expects ongoing monitoring and auditing as one of its core elements, not just point-in-time documentation. Because PACT operates through an API layer, it can be applied continuously and automatically across whatever record types a facility routes through it — rather than compliance staff manually pulling samples and hoping nothing was touched in the meantime. That turns “we audit our records periodically” into “our records have been continuously provable since creation,” which is a meaningfully stronger statement to make to a compliance monitor or corporate integrity agreement overseer.

4. It reduces the burden of ePHI audit control requirements

HIPAA’s Security Rule (45 CFR §164.312(b)) requires mechanisms to record and examine activity on any system holding ePHI. Most EHR platforms provide some activity logging, but that logging typically lives in the same system it’s auditing — which is exactly the weakness a sophisticated auditor or plaintiff’s attorney will probe. PACT’s external anchoring gives a facility a second, independent layer of proof that the underlying activity logs themselves haven’t been altered, which is a meaningfully higher bar than most EHR audit trails clear on their own.

5. It shortens the audit itself

Practically speaking, surveys and audits move faster when evidence doesn’t have to be argued over. Instead of pulling records, printing them, and having a conversation about chain of custody, I can hand a surveyor or reviewer a record along with its verification status. That’s fewer follow-up document requests, fewer “we’ll need to get back to you on that,” and — in my experience — a noticeably shorter and less adversarial survey exit conference.

Where I’d Push Back or Ask More Questions

I don’t think any administrator should walk into a compliance tool assuming it solves everything, and I’d be doing a disservice to write this as pure praise.

• It proves integrity, not accuracy. PACT can prove a record hasn’t been altered since it was created — it cannot prove the record was true or clinically appropriate at the time it was written. A wrong entry, hashed and anchored, is still a provably unaltered wrong entry. This is a tool for chain-of-custody, not clinical judgment.
• Integration effort is real. Because it’s delivered as an API rather than a turnkey LTC product, it needs to be wired into your eMAR, EHR, or incident system by IT or a vendor — this isn’t a plug-and-play purchase for a facility without technical support, and the vendor’s public materials don’t spell out pre-built connectors for common LTC platforms.
• Staff behavior still matters most. No cryptographic system fixes late documentation habits, undertrained CNAs, or a culture where staff wait until end-of-shift to chart. PACT makes the record’s history provable — it doesn’t make staff document promptly or completely.
• Cost and vendor maturity. Stratosphere’s public materials position PACT generally across HIPAA and SOC 2 regulated industries rather than LTC specifically, so I’d want a direct conversation about pricing, support responsiveness, and any existing skilled nursing references before rolling this out beyond a pilot unit.

Bottom Line

For an administrator, the value of PACT isn’t a new dashboard or a prettier report — it’s a change in the kind of evidence you can put in front of a surveyor. Moving from “our system logs changes” to “here’s independent cryptographic proof this record hasn’t been touched since it was written” is the difference between an audit conversation built on trust and one built on verification. In an industry where a single falsification allegation can trigger an Immediate Jeopardy finding, a corporate integrity agreement, or worse, that shift is worth taking seriously — with the clear understanding that it strengthens your evidentiary position, but it doesn’t replace good documentation habits or a well-run compliance program.