Senior living: two stacks, one bill.

Senior living technology is two stacks with different vendors, different regulators, and different renewal cycles. The bundled contract that discounts them together locks the operator into a five-year term the clinical roadmap will outrun in two.

Senior living technology procurement is two stacks, not one

The RFP asks for “the senior living technology package.” The vendors who show up look like they can deliver it. They cannot. There is no single vendor whose center of gravity is both the resident TV and the EHR, and pretending otherwise is how five-year contracts get signed against a two-year clinical roadmap. Two things to hold in your head. Resident-facing is hospitality-plus-connectivity — guest WiFi, TV and streaming, tablets, family video, engagement and activity apps, some wearable pendants. Buyer inside the community is often the Executive Director or Life Enrichment lead. Renewal cycle is 3-5 years and tracks the property's guest experience refresh. Operator-facing is healthcare-adjacent — EHR, eMAR, care coordination, staff scheduling and secure messaging, dining POS, HVAC/BMS, physical security, cameras. Buyer is the VP Ops or IT Director. Renewal cycle tracks the clinical roadmap (CMS Requirements of Participation changes, medication management upgrades, care-level acuity mix shifts) and is slower to change but harder to unwind. When one vendor sells both — usually via a bundled MSO/telecom deal that starts with “we'll handle your bandwidth and nurse call together” — the operator gets a discount and a lock. The discount is real. The lock costs more.

Resident-facing tech is a hospitality-plus-connectivity problem

Buy the resident-facing stack the way a select-service hotel group buys theirs, with a senior-living overlay for accessibility and engagement. Managed AV/TV/engagement: Uniguest (owns Touchtown, Sagely, and Eversound after a run of tuck-ins), iN2L (interactive engagement), K4Connect (K4Community engagement plus smart home), LifeShare, Caremerge. Resident wearables on the resident side of the line: CarePredict Tempo (ADL tracking, wander, fall detection). Guest WiFi and bandwidth: Single Digits, Spectrum Enterprise, Comcast Business. Contract these the way hospitality does — separate the connectivity contract from the content and engagement contract. Bandwidth is a commodity you can re-bid every 24-36 months. Engagement platforms carry data (activity logs, family contact info, sometimes photos) but are usually not PHI custodians in the HIPAA sense — unless the platform is also handling clinical documentation, in which case it has crossed into the operator stack and needs a BAA. Ask the vendor which side they think they're on. Their answer tells you where the contract belongs.

Operator-facing tech is a healthcare-adjacent HIPAA problem

Different center of gravity, different buying motion. Every vendor here needs a Business Associate Agreement, and the BAA scope has to match what they actually touch. EHR and clinical: PointClickCare (dominant in SNF and assisted living), MatrixCare (ResMed-owned as of publish date; a July 2026 announcement points to a pending sale to Frazier Healthcare Partners — confirm ownership at signing), Eldermark, AL Advantage, Aline, Yardi Senior Living. Care coordination: Netsmart CareThreads, Reveleer. Medication management: FrameworkLTC, QS/1. Staff comms: TigerConnect (secure messaging, BAA-covered), Vocera (Stryker-owned), OnShift (scheduling). HVAC/BMS: Johnson Controls, Trane, Siemens; Alarm.com Smart Multi-Family for smart-thermostat retrofits. Dining POS: FoodDay, MicrosSelect, and general Toast/Square deployments for cafés and bistros. The operator stack is where CMS lives — the Requirements of Participation at 42 CFR §483 shape what your EHR has to produce, which is why bundling an EHR contract with a nurse-call contract with a TV contract creates a bad co-dependence: the EHR has to move on CMS's clock, and it drags whatever is tied to it.

Buyer-side. Supplier-paid. Buyers pay zero. Compensation has zero weight in the Cardinal Index scoring. We scope the two stacks separately under the Cardinal Method, then evaluate vendor fit against the acuity mix, the acquisition pipeline, and the CMS reporting posture at each community.

Where the two stacks intersect — nurse call, wearable monitoring, and the network

Three real intersections, and they're where the sourcing decisions actually matter. Nurse call. Rauland (Ametek), Vocera (Stryker), Vigil Health Solutions, Direct Supply Nurse Call, Ascom. Nurse call sits half in the resident experience (pendant in the apartment, pull-cord in the bathroom) and half in the clinical workflow (alerts route to staff comms, response times get logged, sometimes feed into the EHR). It is the single most-bundled category in a “senior living tech in a box” pitch, and the one you most want to keep contractually separable. Wearable monitoring. CarePredict, some K4Connect deployments. When the wearable feeds ADL data into a care plan, it's PHI and needs a BAA. When it only feeds an engagement dashboard, it usually isn't. Vendors will describe it whichever way makes the sale easier. Read the data flow diagram, not the sales deck. The network. Everything above rides on the property's IP network. If it's not segmented — VLANs at minimum, VRFs or physically separate circuits at properties handling higher-acuity residents — a resident-side breach reaches the clinical side. The OCR breach portal shows LTC and senior living organizations appearing regularly; flat networks are a recurring theme.

Five questions before signing a bundled contract

Print this. Tape it to the RFP.

1. Which stack is this vendor's center of gravity — resident-facing or operator-facing? If they say “both,” ask which one their engineering team ships against.
2. Does the contract mix hospitality tech (guest WiFi, TV, engagement) with clinical tech (nurse call, EHR-adjacent, staff comms)? If yes, can the two halves be renewed, re-priced, or terminated separately?
3. What's the BAA scope for the operator-facing piece? Get the data-flow diagram. Confirm every system that touches PHI is named in the BAA — including subprocessors.
4. Who owns the network both stacks ride on, and is it segmented? VLAN separation between resident traffic and clinical traffic is table stakes. Ask for the network diagram before you ask for the price.
5. When we acquire a new community, what is the integration lead time to fold it into the existing tenant — including EHR migration, nurse-call cutover, and network handoff from the seller's MSO? If the answer is “case-by-case,” assume six months and price accordingly.

What breaks — two failure modes

The “senior living tech in a box” contract. One MSO/telecom vendor delivers bandwidth, resident TV, nurse call, sometimes even a starter EHR module, on a five- or seven-year term with an aggressive early-termination clause. Two years in, the clinical stack needs to move — new medication management vendor, new acuity-based staffing tool, new CMS reporting requirement — and the operator discovers the nurse call is welded to the TV contract and neither will move without breaking the bandwidth deal. Discount at signing, tax at renewal.

The flat network. Resident-facing internet gets breached — a family member's laptop, a phishing link on a tablet, a compromised smart TV — and because the property never segmented, the intruder reaches the EHR terminals and the nurse-call server. This has appeared in OCR breach reports involving LTC and senior living organizations. The root cause is almost never a clinical-side failure; it's the guest network sharing a VLAN with the clinical network because the original installer bundled it that way.

What to do this week

Pull the last five vendor contracts across every community. Separate them into the two stacks. Wherever a single contract spans both, flag it for the next renewal cycle — that is where the cost of the bundle actually lands. Then get the network diagram out. If the resident and clinical networks share VLANs, the fix is architectural and not urgent, but it does not solve itself. This Field Note nests under Healthcare. Sibling reads: the BAA vendor-side audit, behavioral health HIPAA, and multi-location healthcare connectivity.

Sources

• CMS, “Long-Term Care Requirements of Participation,” 42 CFR §483 Subpart B. cms.gov · eCFR text
• HHS OCR, sample Business Associate Agreement provisions and Business Associate direct-liability fact sheet. hhs.gov · factsheet
• HHS OCR Breach Portal. ocrportal.hhs.gov
• LeadingAge CAST (Center for Aging Services Technologies). leadingage.org
• Argentum, “The State of Technology Adoption in Senior Living.” argentum.org

All linked sources were live at time of publish (July 2026). Verify before quoting in a procurement document.