Pure date arithmetic, gated money, and a chart that cannot be rewritten.

It holds no database session on purpose, and the module docstring says why: the certification worklist, the episode router and claim gating all need the same answers, and a module with a session would have tempted each of them to compute its own. Periods are contiguous — each starts the day after the last ends — and the bounds are inclusive at both ends, which is the detail that quietly produces off-by-one disputes when three screens each implement it.

The constants are named rather than inlined: the two initial ninety-day periods, the sixty-day subsequent length, the fifteen-day recertification window and the period from which a Face-to-Face is required. When CMS changes one of those, the change is one line in one file and every caller moves with it.

The order the guard reports failures in is a deliberate operational choice, and the code says so: the Face-to-Face is raised first because it is the long-lead item, needing a scheduled encounter with a nurse practitioner or physician, while a missing signature is a phone call. A guard that reported the easy failure first would have agencies discover the hard one a week later. The exception carries a message naming the specific missing item and the regulation behind it, rather than a status code the front end has to interpret.

Episodes deliberately have no ORM relationship to the shared patient row. Read models fetch the handful of names and record numbers a page displays in one query and stitch them on in place, leaving an unknown identifier as null rather than guessing. That keeps the hospice product a consumer of the platform's patient table rather than a second owner of it.

The severity vocabulary is two words and both are defined in the module: critical means money or a Condition of Participation is actively being lost, and warning means a deadline is approaching or an open window still needs work. The messages are written for the person who must act — an unaccepted notice past its deadline names the date from which days are provider-liable and cites the regulation, and a period that started without a signed certification says that no day of it is billable until it is signed, appending the Face-to-Face when that is outstanding too.

The nightly scan runs on the platform's leader-elected scheduler and raises the same findings as ordinary platform notifications, deduplicated so a standing problem does not notify every night, with a heartbeat written on success and on failure. That last detail is what makes a silent compliance page trustworthy: the health check can distinguish nothing wrong from nothing running.

Plan-of-care versions are monotonic, and the interdisciplinary meeting that approved a version is stamped onto it, so the question of which plan was in force in a given month has an answer that does not rely on anyone's recollection. The interdisciplinary review cycle is fifteen days, held as a named constant beside the HOPE window boundaries — the admission record within five days of admission, and update visits in the day six-to-fifteen and day sixteen-to-thirty windows.

Five of the chart's tabs read platform tables directly rather than hospice copies: medications, family contacts and documents come from the same rows the EMR writes. That is the practical form of the shared-record decision — a hospice patient who was already a patient of a clinic in the network does not acquire a second medication list.

Two gates sit before submission and both are enforced in the service rather than the router. No monthly claim is built until the Notice of Election has been accepted, and Medicare's sequential-billing rule holds a month until the prior month has been remitted. A rate that has not been configured causes a refusal rather than a claim priced at zero, which is the failure mode that matters — a zero-dollar claim looks like a submission and behaves like a loss.

The aggregate-cap module computes a running position: payments against an allowance derived from the beneficiary count and the configured cap amount, with headroom and utilisation. It uses the simplified whole-beneficiary method today and says so in its own docstring, with the proportional election method flagged for when multi-agency elections appear. The point of it, in the module's own words, is a continuously tracked ceiling instead of a year-end surprise.

That last rule is the interesting one. A quarter with no deaths has no last-days-of-life rate, and rendering it as nought percent would be a quality finding the data does not support. Returning nothing lets the caller print 'no data', which is the truth. Targets come from configuration per indicator rather than being fixed in the engine, because a target is an agency's commitment, not a property of the measurement.

CAHPS measures are not computed here at all — they come from a certified survey vendor, and the module says plainly that they stay unavailable until that vendor's credentials are configured rather than being estimated from anything the agency holds. Improvement projects are recorded as plan-do-study-act cycles alongside the indicators.

The volunteer condition requires volunteer hours to reach five percent of total patient-care hours. The module computes volunteer minutes over total care minutes — volunteer plus paid — and its docstring names that as the conservative reading surveyors use, in preference to the more flattering denominator. Negative inputs raise rather than being clamped, because a negative minute count is a bug upstream, not a value to absorb.

Staff credentials classify as current, expiring or expired against a named warning window, and a credential with no expiry date is current rather than a permanent alarm — a degree does not expire. The roster shows a worst-state roll-up per person so one lapsed licence is visible without opening the row, and monthly timesheets are assembled from visits that have already been signed rather than from a separate time entry.

This is the platform's standing contract for optional integrations, and applying it uniformly here has a commercial consequence worth stating: an agency can run the clinical, compliance and quality halves of the product from the first day and enable the revenue cycle when its vendor accounts land, without a second implementation. The settings page reads back which rates and which credential pairs are configured, so the implementation checklist is visible from inside the product.

Inbound fax is the useful exception. The provider posts to the webhook route, so intake begins working the moment the vendor account is pointed at it, independent of whether outbound sending has been configured.

The module is candid about a constraint it cannot engineer around. CMS distributes the authoritative HOPE submission layout through the iQIES onboarding kit, which is account-gated, so there is no public machine-readable specification to code against. The serializer therefore emits a self-describing file stamped with an explicit format version, so an agency can review and pre-validate batch content today, and the change to the certified wire layout is confined to that one function.

Stamping the format version in the file itself is the part worth copying. A file that names its own version can be told apart from a certified one by anything that reads it later, including a person, which is a better guarantee than a note in a runbook.