Review current Community Acquired Finance capabilities, scoped-review items, services not offered, privacy boundaries, and procurement questions.
| Area | Available now | Requires scoped review | Not offered |
|---|---|---|---|
| Product access | Public responsive web experience; no participant account required. | Dedicated campaign path, custom branding, or organization-specific materials. | Eligibility files, HRIS/payroll connections, EHR access, or claims ingestion. |
| Data handling | Fixed-choice answers stay in the browser tab; consent-gated analytics use fixed identifiers. | A written data-flow review for any requested customization or measurement change. | PHI, member IDs, employee files, plan documents, diagnoses, unrestricted notes, or uploaded records. |
| Professional scope | General financial and healthcare-cost education, preparation, and official-source handoffs. | Organization-specific legal, compliance, clinical, benefits, and communications approval. | Medical, legal, tax, investment, fiduciary, brokerage, coverage, enrollment, or eligibility decisions. |
| Security and privacy | Data-minimized public product, documented privacy terms, correction channel, and bounded analytics. | Security questionnaire, incident contacts, retention terms, subprocessors, and business-associate analysis. | A HIPAA, SOC 2, HITRUST, or other certification claim unless independently completed and documented. |
| Accessibility and content | Keyboard, mobile, automated accessibility, source, freshness, and route checks are part of release gates. | Organization accessibility criteria, VPAT request, translation, reading-level, and participant testing needs. | A blanket conformance guarantee for every assistive technology, language, or future page. |
| Support and service | Public correction and contact channels; scoped launch orientation and findings review. | Named owners, service hours, response targets, escalation path, and change-control terms. | 24/7 clinical concierge, benefits administration, case management, or emergency support. |
Responsive public education, live calculators and guided tools, fixed-choice program planning, local-only participant workflows where stated, source and freshness controls, consent-gated fixed-ID analytics, and public correction and contact routes.
CAF does not represent HIPAA, SOC 2, HITRUST, BAA, SSO, account provisioning, participant reporting, 24/7 support, or integration readiness unless separately completed, reviewed, and documented.
Reviews are informed by organizational health literacy, plain language, accessibility, privacy risk management, and the actual HIPAA covered-entity or business-associate relationship. These references guide review and do not create a conformance or certification claim.