One reading, one automated loop.
A patient measures their blood pressure. The app runs the UC Way medication algorithm reviewed by UC Davis — every time, in under a second — and only surfaces the patients who need a human.
The loop
Step 1
Signed reading arrives
An FDA-cleared cuff (Omron VitalSight cellular hub or a paired Bluetooth device) POSTs the reading to a signed public endpoint. The signature is verified before anything else runs. Manual entry works too, for patients without a device yet.
Step 2
Protocol triage
The reading is classified into a band (normal / stage 1 / stage 2 / severe) using AHA thresholds. Severe readings trigger a mandatory 5-minute recheck and then go to the clinic's urgent queue, where staff have 60 minutes to acknowledge and call the patient. Patients are always told to call 911 for emergency symptoms. Program hours are not 24/7 by design — this is chronic management, not urgencies.
Step 3
Patient nudge
The patient sees a plain-language message tied to their own numbers and, when BP is elevated, a motivational-interviewing lever picker: one small, chosen change beats one prescribed change. All screens are bilingual (English/Spanish).
Step 4
Clinician queue
Only patients meeting the escalation rule surface in the clinician's triaged alerts queue. Every alert ships with a UC Way suggested next step and a copy-ready SOAP draft.
Step 5
Titration every 2 weeks
If the average is above target, the engine recommends the next rung of the UC Way ladder (losartan/HCTZ → +amlodipine 2.5 → 5 → 10 mg → +spironolactone → +metoprolol XL). Clinician approves in one click; a SOAP note writes itself.
Step 6
KDIGO safety carve-outs
Recent labs (K⁺, Cr, eGFR, UACR) block or steer the recommendation: high potassium blocks ACEi/ARB additions, low eGFR forces the CKD monotherapy track, and lab draws are scheduled from the KDIGO heat map.
What sits between the cuff and the clinician
Four layers, three trust boundaries. Everything crossing a boundary is either BAA-covered or cryptographically verified — never both bypassed.
Data source
Patient + device
- Omron Bluetooth BP cuff sends readings to North State Prevention via smartphone
- North State Prevention App sends notifications, education, support to patient's smartphone
Trust boundary · BAA
Vendor cloud + ingest
- Omron Partner API (OAuth, cloud-to-cloud)
- Bandwidth Messaging (HIPAA-eligible)
- HMAC-signed webhooks → /api/public/*
Protocol engine
North State Prevention platform
- Triage (AHA bands) + escalation rules
- UC Way titration + KDIGO carve-outs
- Postgres + RLS + append-only audit log
Human decisions
Clinical workflow
- Triaged clinician queue + SOAP draft
- Outreach queue (SMS + call scripts)
- Patient nudge in-app (MI-based)
BAA with every hop that touches PHI
Omron (device cloud), Bandwidth (SMS), and the hosting provider all sign BAAs. No PHI in vendor logs.
Signed device webhooks
Every reading arrives with an HMAC signature verified before storage — no anonymous writes.
Row-level security + audit log
Postgres RLS scopes every read to a single patient's care team. Append-only audit_events records every access.
Fixed-menu SMS, no PHI in body
Outbound texts never carry BP numbers or diagnoses. Replies use reply codes (1=well, 2=dizzy, 3=chest pain).
Why this shape
Cheap
Target patient pays $10–17/month. No RPM billing overhead. FDA-cleared devices at consumer price points.
Safe
Every recommendation is anchored in a reviewed protocol (UC Way, KDIGO). The engine won't advance past a lab contraindication.
Portable
Same architecture works standalone or embedded as a companion layer to a hospital's Epic instance via FHIR Observations.