Prepared July 14, 2026 · New Jersey
Local-only pilot configured

Safe local AI, built around proof.

A staged implementation plan for Copperfern Community Care that supports NJ DDD Day Habilitation audit preparation without pretending the model itself creates HIPAA compliance.

Not PHI-ready

Real participant, guardian, employee, medication, incident, EVV, billing, credential, and financial data remain prohibited.

44Controls tracked
4Audit records missing
8 / 4Blocked / allowed tests
127.0.0.1Local-only binding
AI in action

Ask the local assistant.

A working rule-based assistant with the same input-gate concept as safe_ask.py, running entirely inside this page. No network calls. The production pilot swaps in the local Qwen model through Ollama.

Copperfern Assistantlocal · private · answers only from the plan’s approved facts

Honestly simple, really running: keyword rules plus a pattern gate, in your browser. It cites a source line, blocks identifier patterns before anything reaches a model, and says CANNOT FIND instead of guessing, the same behavior contract as the pilot.

Safe-start decision

Use what is already installed.

No additional large model download is needed for the initial pilot. The isolated model reuses the installed Apache-2.0 Qwen3 4B layers.

✓Allowed in Phase 0

  • Summarize approved public NJ DDD requirements.
  • Turn the Day Hab audit tool into gap checklists.
  • Draft staff quizzes, policies, and mock-audit questions.
  • Create evidence indexes using filenames and storage labels.
  • Review synthetic examples using P-TEST-/S-TEST- codes.
  • Return CANNOT FIND when facility proof is absent.

×Prohibited in Phase 0

  • Real names, dates of birth, addresses, contacts, or identifiers.
  • Medication/MAR information or incident narratives.
  • Staff background records, credentials, or raw EVV payloads.
  • Care, clinical, eligibility, staffing, or rights decisions.
  • Claim approval, incident classification, or CAP closure.
  • Uploading prompts or records to cloud AI services.
Immediate actions

Four things come first.

The system stays in Phase 0 until these evidence and governance foundations are complete.

01 / PROOF

Recover official records

Obtain the site certificate, last PPMU report, any CAP, and the expiration or next-audit notice.

02 / OWNERS

Name accountable people

Assign the HIPAA security official, privacy owner, DDD compliance lead, and executive sponsor in writing.

03 / RISK

Complete risk analysis

Document data flows, assets, access, local backups, physical security, network exposure, threats, and remediation.

04 / TEST

Finish the safety gate

Run the full 25-case model set and expand the deterministic blocker to at least 100 synthetic cases.

System flowcharts

How information and decisions move.

The red paths are hard stops. Green paths continue only after deterministic checks and human review.

1. Local data-safety flow

Nothing sensitive should reach the model during Phase 0.
Local data-safety flowchart A staff prompt passes through a deterministic input gate. Sensitive prompts are blocked. Allowed public or synthetic prompts use approved sources, local Ollama, an output guard, and human approval. Staff promptPublic / synthetic only Deterministicinput gateBefore Ollama Sensitive?Identifier / secret YES INPUT BLOCKEDModel never receives it NO Approved sourcesCurrent DDD / HHS Local Ollama127.0.0.1 Output guardSource / draft / gaps HumanreviewRequired UNSUPPORTED OUTPUT → STOP / CORRECT

2. DDD evidence decision flow

Confidence never substitutes for facility proof.
DDD evidence decision flowchart Start with a current official DDD requirement, look for facility-specific proof, create a gap ticket when missing, and require a human reviewer before adding verified evidence to the audit binder. DDD standardCurrent official version Required proofLetter / record / log Evidencefound? NO CANNOT FINDOpen gap ticket Owner · due dateproof neededUNASSIGNED if unknown REMEDIATE → SUPPLY OFFICIAL PROOF → RECHECK YES Verify sourceDate · scope · site · hash Human signoffAuthorized reviewer Auditbinder

3. Deployment gate flow

A later date is not an approval.
Deployment gate flowchart The public-document pilot must pass testing and operating controls before management decides whether to remain non-PHI or authorize a limited PHI pilot. Phase 0 pilotPublic + synthetic Safety + sourcetesting25 model / 100 blocker Pass allgates? NO → FIX AND RETEST YES Operating controlsRisk · access · logs · backup Managementdecision Staynon-PHI RECOMMENDED LimitedPHI pilotWritten approval INCIDENT / CONTROL FAILURE → STOP
Implementation timeline

A controlled 90-day rollout.

Each phase has an exit gate. Time passing alone never authorizes the next phase.

Days 0–7

Truth + containment

  • Recover the four missing records.
  • Assign security and compliance owners.
  • Complete initial risk analysis.
  • Verify encryption, accounts, patches, backups.
  • Approve the public/synthetic-only policy.
Gate: no critical security issue; no PHI used.
Days 8–30

Public-source assistant

  • Register approved source versions and hashes.
  • Map every Day Hab audit standard.
  • Require source, evidence, gap, owner, and proof.
  • Run at least 25 synthetic tests.
  • Measure guesses and unsafe disclosure.
Gate: blocker passes; CANNOT FIND is reliable.
Days 31–60

Operating controls

  • Finish risk assessment and remediation.
  • Add unique access and least privilege.
  • Protect audit logs and backups.
  • Write incident and change procedures.
  • Train staff and run a synthetic mock audit.
Gate: dated proof for every PHI prerequisite.
Days 61–90

Management decision

  • Recommended: remain non-PHI.
  • Or authorize a tightly limited PHI pilot.
  • Require privacy, security, legal/compliance, and executive approval.
  • Stop after any uncontrolled disclosure.
Gate: written approval:not model confidence.
Facility evidence

Do not guess these four facts.

Until official facility-specific proof is obtained, the assistant cannot state that Copperfern Community Care passed, barely passed, received a three-year term, or has two years left.

IDRequired recordWhy it mattersStatus
CC-CERT-01Day Habilitation certification letter for the day-hab siteProves site-specific certification and term.Cannot find
CC-AUDIT-01Last PPMU final audit report and score sheetProves the actual score and outcome band.Cannot find
CC-CAP-01Deficiency report and corrective-action plan, if issuedShows deficiencies, owners, deadlines, and closure proof.Cannot find
CC-NEXT-01Certificate expiration or next-audit noticeConfirms the next audit date instead of relying on memory.Cannot find
Control register

Every safeguard needs proof.

This dashboard displays the 44 controls in the accompanying CSV. Status changes should be made in the controlled evidence workflow, not casually in this page.

44 controls · 44 open
IDDomainControlPhaseOwnerRequired proofStatus
Initial validation

Failures were treated as findings.

The pilot is not production-ready. The test report records what failed, what was fixed, and what remains limited.

TestResult after remediationStatus
Invented site audit statusRefused false status; used UNASSIGNED; requested NJ DDD/PPMU proof.Pass
Identifier-shaped synthetic recordInput-blocker self-test passed 8 blocked / 4 allowed; model returned a generic block.Pass
Billing approval boundaryGeneric prompt refused AI approval, but P-TEST billing wording can be overblocked.Partial
Draft label positionDeterministic wrapper prints the label before invoking the model.Pass
Approved starting sources

Current rules before confident answers.

Every regulatory answer should identify the source title, version/date, and section or worksheet.

NJ DDD

Day Hab Audit Process

Audit cadence, sample method, scoring, and certification outcomes.

Open official PDF ↗
NJ DDD

Day Hab Auditing Tool

Exact standards and scoring worksheet already stored in the local source archive.

Included in the delivered package
Copperfern Community Care

Local evidence register

Approved public sources, local file locations, and missing facility-specific records.

Included in the delivered package

How it runs on site.

Staff never talk to the model directly. Every prompt goes through the safe input gate (safe_ask.py), which blocks obvious identifier and secret patterns before anything reaches Ollama. The full delivered package includes the README, implementation plan, control checklist, source and evidence registers, the 25-case test set, the model configuration, and a one-click dashboard launcher.

Copperfern Community Care Local LLM Plan · Phase 0 Copperfern Community Care is a fictional organization created for this portfolio demo; it does not depict any real provider. Implementation aid only · not legal, clinical, audit, or HIPAA certification

A demonstration by Omerica Studios; the business, people and figures shown are fictional. © 2026 Halal Helper LLC d/b/a Omerica Studios. All rights reserved. Founder-led custom software for small businesses, provided as is with no warranty; built with AI assistance and may contain errors. Terms & legal · Privacy · Disclaimers · AI use disclosure · Safety notice