What North State Prevention costs when identity never leaves the clinic.
North State Prevention stores no name, no date of birth, no phone number, and no device serial — only a coded alias and blood-pressure readings. The alias-to-patient crosswalk lives in the clinic's EMR, inside the covered entity. Under 45 CFR §164.514(b)(2) that makes the data we hold de-identified, so the HIPAA compliance stack that used to dominate this budget is out of scope.
All figures are list-price, USD, and assume one clinical admin, one clinician, and up to 200 enrolled patients by month 24.
24-month total, at a glance
One-time ramp (Year 0)
$8K – $16K
Attorney de-identification opinion and clinic data agreement, crosswalk SOP and staff training, security review, insurance binding.
Recurring per month
$525 – $625
Omron Partner API floor ($200 + ~$1/patient over 200), Supabase platform ($20), insurance and legal (~$3K/yr), monitoring, backups. Development and routine IT are in-kind during the pilot.
2-year total (worst-realistic)
~$31K
$16K one-time + $625/mo × 24. Mid-point lands near $22K — against ~$122K under the full HIPAA business-associate build.
What this changes about the ask: the platform is no longer the expensive part of the program. A CalRHT request is now dominated by cuffs and people — device inventory, CHW and MA time, translation, and medication or lab subsidies — rather than by compliance vendors.
One-time / Year 0 setup
The de-identified posture is a legal position, not a technical one, so the money moves from auditors to counsel. The written determination and the clinic data agreement are exactly what a grant reviewer or hospital counsel will ask to see — this is not the line to trim.
| Item | Realistic | Notes |
|---|---|---|
| Attorney de-identification opinion + agreements | $4,000 – $7,000 | The load-bearing line item. Written §164.514(b)(2) Safe Harbor determination, the clinic-facing data agreement, terms of use, and privacy policy review. 10–18 hrs at $350–$450/hr. |
| Clinic crosswalk protocol + staff training materials | $1,000 – $2,000 | Written SOP for how the MA or CHW assigns an alias, records it in the EMR, provisions the patient's phone, and never types a name into North State Prevention. Bilingual patient consent sheet. |
| Application security review + vulnerability scan | $1,500 – $3,000 | Not a HIPAA-grade pentest — a scoped review of row-level security policies, auth flows, and the Omron token store. Right-sized to de-identified data. |
| Cyber-liability + tech E&O (first-year binding) | $1,200 – $2,500 | Materially cheaper without PHI in scope. Still worth carrying: a breach of coded clinical data is reputational even when it is not reportable. |
| Domain, SSL, edge protection | ~$200 | Domain renewal plus Cloudflare. No BAA add-on needed. |
| Contingency (15%) | ~$1,200 | Second attorney pass if the clinic's counsel wants changes to the data agreement. |
| One-time subtotal | $8,000 – $16,000 |
Recurring — steady-state monthly
Roughly a third of this table is Omron, and the rest is ordinary small-application infrastructure. The 201st patient adds about $1/mo, so the technology cost per patient falls steadily as enrollment grows — the Omron floor and the development effort are fixed, not per-head.
| Item | Realistic | Notes |
|---|---|---|
| Omron Partner API (device data pipe) | $200 base + ~$1 / patient / mo | The single largest recurring line. The $200/mo program floor covers 0–200 connected patients, then scales at ~$1/patient/mo. Unchanged by the de-identified design — it is a cloud-to-cloud OAuth pipe keyed to a coded subject id. |
| Application platform + managed Postgres (Supabase) | $20 / mo | Standard paid tier. No HIPAA-eligible tier and no BAA required — this is what removes the $599/mo line from the old model. |
| Insurance and legal (cyber-liability, tech E&O, light retainer) | ~$250 / mo | About $3,000/yr or less, based on preliminary discussions with an insurance broker, spread monthly. Covers the annual re-review that matters most: confirming no new field has crept in that could re-identify a patient. |
| Software development and routine IT support | $0 during the pilot | Provided by Dr. Garrison during the pilot and early implementation. As enrollment grows, program revenue funds dedicated IT assistance. AI-assisted code generation is used as a developer tool only — no AI participates in clinical decision-making. |
| Error tracking, uptime, log retention | ~$40 / mo | Standard tiers; no BAA-covered logging vendor needed. Clinical-action audit rows still live in-database. |
| Encrypted backups | ~$15 / mo | Object storage with versioning. |
| Sundries (staff MFA seats, secret rotation, edge) | ~$50 / mo | Small fixed lines. |
| Recurring subtotal | $525 – $625 / mo |
How the program pays for itself
Sustainability is a core objective of the pilot, not an afterthought. These are the anticipated numbers the pilot is designed to test — the point of measuring exact per-participant cost is to find out whether they hold.
Insured track
~$5 / enrolled patient / mo
North State Prevention stays free to patients. Participating clinics pay roughly $5 per enrolled patient per month for the application and RPM infrastructure. For patients who meet applicable Medicare RPM requirements, clinics may receive about $52.11/month in 2026 reimbursement based on two required readings per month — a financial pathway that supports the technology fee while integrating remote monitoring into routine care. Because the app automates routine triage, education, and titration reminders, the $5 fee is designed to be offset by staff time saved on between-visit BP follow-up. The pilot determines whether $5 is the right number.
Uninsured track (safety net)
~$15 – $20 / mo all-in
After the grant, patients purchase their own ~$60 blood-pressure monitor. TCCAP continues to facilitate discounted medications, laboratory services, and telehealth. For a stable patient on a single combination medication the anticipated ongoing cost is about $15–20/month, including medication, annual labs, and roughly $5/month equivalent for an annual $60 telehealth visit. Patients needing more medication or more clinical support cost more.
Staffing follows the same logic. Existing clinic medical assistants and TCCAP community health workers handle enrollment, forms, and protocol-driven tasks; licensed clinicians are reserved strictly for clinical decisions. CHW effort is heaviest at enrollment, device setup, education, and periods of instability, and drops substantially once a patient is stable — concentrating limited resources on the patients who need them.
On AI: AI-assisted code generation is used as a software engineering tool to keep development cost low. No AI participates in clinical decision-making — every escalation and titration rule is an explicit, reviewable protocol step confirmed by a clinician.
What the de-identified design removed
Side-by-side with the HIPAA business-associate model previously scoped for this program. Nothing here was cut to save money for its own sake — each line disappeared because the app no longer holds an identifier that would require it.
| Line item | HIPAA model | De-identified model |
|---|---|---|
| Managed Postgres with BAA | $599 / mo | $25 – $60 / mo |
| Sprinto / Vanta continuous monitoring | $650 – $1,000 / mo | $0 |
| HIPAA-eligible logging vendor | $150 – $300 / mo | ~$40 / mo |
| Annual pentest (amortized) | ~$800 / mo | one-time review only |
| SMS: 10DLC registration, BAA, consent logging, traffic | ~$35 / mo + $150 setup | $0 — removed |
| Security Risk Analysis + 18-policy pack | $8K – $16K one-time | $1K – $2K SOP + training |
The trade we accepted: North State Prevention cannot contact a patient. No texts, no push notifications, no reminder emails — each of those requires storing an identifier. When a patient goes quiet, the clinician outreach queue flags the alias, and clinic staff look the person up in the EMR and call from clinic systems. That is a real cost, paid in staff minutes instead of vendor dollars.
Where the freed grant dollars should go
Cuffs first
~$50 / patient
Omron BLE units for 200 patients ≈ $10K. The premise of the program is that an uninsured patient never pays for the device — see /tiers.
Staff time
The real constraint
Outreach is now human. Budget CHW and MA hours for enrollment, phone setup, and calling the aliases the outreach queue flags — the work the compliance stack used to crowd out.
Runway, not overhead
~$600 / mo to keep alive
At ~$5 per enrolled patient per month, roughly 120 clinic-enrolled patients cover the whole platform — and every patient after that lowers the cost per head.
What would blow this budget back up
- • Adding any patient contact channel. A phone number, email address, or push subscription is a Safe Harbor identifier. One field re-opens the entire ~$3,000/mo HIPAA table.
- • Free-text notes that name people. The admin console forbids PHI in notes; if that discipline slips, the de-identification opinion no longer holds.
- • Storing device serial numbers. Serials tie back to a purchase record. They belong in the EMR chart, not here.
- • Billing insurance directly. Submitting claims would make North State Prevention a covered entity outright. The clinic bills; we supply coded readings and the attestation text.
- • A future EMR write-back. Pushing data into Community Connect means handling PHI in transit — a deliberate, funded phase change, not an incremental feature.
What this budget does not include
- • Clinical staff salaries — clinician, CHW, and care-coordinator time, now including manual outreach calls. On the /pilot operational budget.
- • BP-cuff inventory — Omron units. See /tiers.
- • Medication and lab subsidies for uninsured patients.
- • Marketing, outreach printing, and translation beyond the app itself.
- • The clinic's internal cost of maintaining the crosswalk and making outreach calls.
References
- • 45 CFR §164.514(b)(2) — Safe Harbor de-identification and the 18 identifiers.
- • 45 CFR §164.514(c) — no actual knowledge that the remaining data could identify an individual.
- • HHS OCR guidance on methods for de-identification of PHI (Nov 2012).
- • Omron Partner API program pricing (US BD, Nov 2026): $200/mo floor, ~$1/patient/mo above 200.