AccreditFlow

The Challenge

Behavioral health and SUD treatment facilities face a fragmented path to state licensing and Joint Commission accreditation. Operators juggle DHCS Form 6002 packages, TJC BHCHS standards across 13 chapters, policy binders, mock surveys, and EMR quality checks—usually through email threads, shared drives, and expensive consultant hours. The consulting firm needed a single SaaS workspace where AI could draft and validate compliance work, while human consultants could jump into the same chat when judgment mattered.

Our Solution

Codextroop designed and built a multi-tenant AI healthcare consulting platform: access-code onboarding, isolated client files, RAG over DHCS and TJC source documents, five specialized GPT-4o agents, PDF-only document workflows, mock survey scheduling, subscription tiers, and hybrid AI-to-live-agent chat. Facility operators upload documents, answer guided questions, and receive applications, policies, and compliance reports—while the consulting team retains admin edit control and real-time support inside one interface.

• Multi-tenant SaaS with Super Admin, Client, and QA Reviewer roles and access-code registration
• Five specialized AI agents: orchestrator chatbot, DHCS licensing, Joint Commission, policy/handbook, and KIPU QA
• RAG pipeline with pgvector, text-embedding-3-small, and citation-backed answers from firm-owned regulatory content
• DHCS 6002 guided collection, tab completeness validation, and application package generation
• TJC BHCHS coverage across all 13 chapters with gap analysis and mock survey prep
• Automated policy and employee handbook generation customized to facility type and services
• Hybrid chat: GPT-4o first response with Socket.io live consultant handoff in the same thread
• KIPU QA slice for sync, patient-record visibility, corrections, and compliance views
• PDF-only uploads, admin-controlled client files, Stripe-ready pricing tiers, SendGrid + Google Calendar

The Business Problem

Healthcare facility operators—especially residential and outpatient SUD programs—must assemble licensing packages, prove accreditation readiness, keep policies current, and stay audit-ready inside their EMR. Traditional consulting scaled poorly: each client meant another spreadsheet of missing tabs, another binder of policies, and another inbox of “can you check this?” questions. The firm wanted software that encoded their expertise, accelerated first-pass work with AI, and kept consultants available for edge cases without leaving the product.

• DHCS Form 6002 (Rev. 06/16) spans Sections A–K with facility-type-specific tab requirements that are easy to miss
• Joint Commission BHCHS accreditation spans 13 chapters, from Leadership and Environment of Care to Medication Management and Patient Safety Goals
• Policy and handbook drafting was repetitive but high-risk if templates were not customized to services and population
• Clients needed answers grounded in the firm’s documents—not generic internet medical advice
• Human consultants still had to intervene for judgment calls, approvals, mock surveys, and document edits

Product Vision and Scope

Codextroop scoped a centralized multi-tenant SaaS: clients upload PDFs, complete guided workflows, receive generated applications and policies, view compliance status, request mock surveys and staffing support, and chat with AI or a live consultant. Admins approve access, manage pricing, edit all client files, and monitor QA. Phase 1 deliberately excluded direct government portal submission, mobile apps, Word/Excel uploads, client-side document editing, and real-time regulatory scraping.

• In scope: hybrid chatbot, DHCS automation, TJC guidance, policy/handbook generation, KIPU QA integration path, PDF storage, admin edit access, mock surveys, Calendar + email, subscriptions, staffing requests
• Out of Phase 1: direct DHCS portal filing, native mobile, third-party CRM, non-PDF uploads, client document editing, multi-admin role trees, state-by-state scraped databases
• Proven runtime slice includes pricing, surveys, KIPU views/actions, staffing requests, policies, compliance, accreditation views, and PDF-only upload enforcement

Roles and Access Model

Three canonical roles keep operations clear. Super Admins (the consulting firm) control access codes, pricing, client files, live chat takeover, mock survey approval, and cross-client KIPU monitoring. Clients (facility operators) register with an issued code, upload PDFs, run modules, view dashboards, and request surveys or staffing. QA Reviewers audit applications, policies, KIPU outputs, and compliance records without pricing or user-admin privileges.

• Access flow: client requests access → admin issues code → client registers → portal opens at the assigned tier
• Clients view final documents; only admins edit—change requests go through chat
• Every client-scoped table filters by authenticated client_id; admins bypass isolation intentionally with audit logging

AI Architecture: RAG, Not Guesswork

Regulatory answers cannot be improvised. The platform uses OpenAI GPT-4o as the primary model, gpt-4o-mini for routing and simple tasks, and text-embedding-3-small for embeddings. Questions and generation jobs retrieve top matching chunks from pgvector, inject them into the system prompt with facility profile context, and require citation of the source section. If context is missing, the model must say so rather than invent a regulation.

• Priority vectorization: DHCS 6002 (by section), all 13 TJC chapters, policy templates, employee handbook sections
• Later vectors: per-client uploaded PDFs, compliance history, completed application examples, county addendums
• Chunking: ~500–800 tokens, ~100-token overlap, metadata for source, section, doc type, and client_id (null = global)
• Cost control: route greetings and status checks to gpt-4o-mini; reserve GPT-4o for complex regulatory and generation work

Two-Layer Knowledge Base

Semantic search alone is not enough for form completion and checklists. Layer 1 stores regulation and template text in pgvector for retrieval. Layer 2 stores structured PostgreSQL rules: client facility profiles, DHCS field maps, TJC Elements of Performance pass/fail state, document inventory, chat history, appointments, and compliance check results. Agents query structured tables to decide what is required and what is missing, then use RAG to explain and draft.

Five Specialized Agents

Clients always see one assistant. Behind the scenes, Agent 1 (Consulting Chatbot) orchestrates the others via tool/function calling.

• Agent 1 — Orchestrator: general consulting Q&A, module routing, conversation memory, live-agent handoff
• Agent 2 — DHCS Licensing: structured intake for Form 6002 Sections A–K, tab completeness, CCR Title 9 checks, application PDF package
• Agent 3 — Joint Commission: gap analysis across LD, EC, EM, HR, IC, IM, MM, NPSG, CTS, PI, RC, RI, WT; readiness checklist; mock survey prep including ligature risk and suicide screening focus areas
• Agent 4 — Policy & Handbook: TJC/DHCS policies (EC plans, MM, IC, HIPAA/42 CFR Part 2, rights, controlled substances, HR) plus customized employee handbook
• Agent 5 — KIPU QA: scheduled/on-demand patient file audit, issue flags, correction writeback path, compliance PDF reports and alerts

Platform Modules in Depth

Each module maps to a real consulting workflow the firm already sold manually.

• DHCS: collect application, legal entity, facility, residential/SUD certification, schedules, org, and staff data; enforce tab rules (e.g., residential Tabs 19–21, outpatient Tabs 5–6, counselor certification ratios)
• TJC: chapter guidance plus critical detox focus areas—NPSG.15 suicide screening, ligature assessment, controlled substance counts, HR credential gaps, 42 CFR Part 2 confidentiality
• Mock surveys: client request → admin approve/reschedule → Google Calendar event → SendGrid confirmation
• Policies: generated into the admin-editable client file; clients consume PDFs only
• Hybrid chat: Socket.io rooms per client; AI streams first; “speak to someone” notifies admin who joins the same thread with full history
• KIPU: architecture for read/write API; current runtime already proves sync/history, record visibility, and correction actions

Technology Stack

The stack favors one Postgres database for transactional data and vectors, a modern Next.js portal, and a Node or Python API depending on the AI library preference of the delivery team.

• Frontend: Next.js, Tailwind CSS, shadcn/ui for client portal and admin dashboard
• Backend: Node.js/Express or FastAPI; JWT + bcrypt; role middleware on every route
• Data: PostgreSQL + pgvector + Redis for sessions and rate limits
• AI: GPT-4o, text-embedding-3-small, LangChain for chunking, RAG, and agent orchestration
• Realtime: Socket.io; files on Cloudflare R2 or AWS S3; email via SendGrid; Calendar via Google; billing via Stripe
• PDF generation with Puppeteer or PDFKit for applications, policies, and compliance reports

Delivery Phases

Codextroop sequenced delivery so each phase shipped something testable before the next layer of AI complexity.

• Phase 1 — Foundation: auth, access codes, admin/client shells, Postgres, pgvector, object storage
• Phase 2 — Knowledge base: chunk and embed DHCS, TJC, policies, handbook; validate semantic search
• Phase 3 — Core chatbot: Agent 1 RAG, Socket.io, live handoff, admin conversation dashboard, streaming
• Phase 4 — DHCS module: Agent 2, field map DB, PDF uploads, tab validation, application PDF, client files
• Phase 5 — TJC, policy generator, scheduling (partially proven): Agents 3–4, checklists, mock surveys, Calendar, SendGrid
• Phase 6 — KIPU, compliance reports, billing (partially proven): Agent 5, reports/alerts, Stripe tier enforcement

Security and Compliance Posture

Because the product handles healthcare-adjacent and SUD-related operational data, security was treated as a product requirement—not a launch checklist.

• Encryption at rest for database and object storage; TLS/WSS in transit
• HIPAA-minded hosting with BAA where applicable; stricter handling notes for 42 CFR Part 2 SUD records
• Short-lived JWT access tokens, refresh tokens, and role guards on every API
• Audit logs for admin file access and edits; SSNs encrypted and never written to logs
• Tenant isolation enforced in application queries sharing the same vector index

Business Impact and What’s Next

For the consulting firm, the platform turns expertise into software: faster first drafts, fewer missed tabs, consistent policy baselines, and consultants who intervene only when needed. For facility operators, it is a guided compliance workspace instead of a pile of forms. Remaining milestones include fuller DHCS package automation, production-hardened RAG/agent orchestration, deeper KIPU writeback/reporting proof, Stripe webhook enforcement, automated authz test coverage, and expanded audit/security validation.

Results

The platform consolidates licensing, accreditation, policy work, QA, and consulting chat into one product. Early runtime already validates pricing, surveys, staffing requests, policies, compliance and accreditation views, PDF upload restrictions, and KIPU operational flows—while the roadmap continues toward full DHCS automation and production-grade agent orchestration.

Technologies Used

Project Gallery