Orca Dental AI — Implementation Playbook (DSO)

Orca Dental AI Implementation Playbook

Diagnostic Imaging AI for Dental Service Organizations

---

1. Executive Summary

What Orca Dental AI Does

Orca Dental AI is a diagnostic imaging platform that uses artificial intelligence to analyze dental radiographs—including bitewings, periapicals, and panoramic images—to detect pathology including caries, bone loss, periapical lesions, calculus, and other clinical findings. The system integrates with existing imaging workflows to provide real-time diagnostic support, generating annotated overlays and detailed findings reports that assist providers in treatment planning and patient communication.

Why DSOs Benefit from Diagnostic Imaging AI

Scale Advantages: Diagnostic AI delivers consistent analytical standards across every operatory in every location, regardless of individual provider experience or fatigue. A 30-location DSO performing 500,000+ radiographic analyses annually gains exponentially more value from a single implementation than a solo practice.

Standardization: AI eliminates diagnostic variability between providers—a critical concern for DSOs managing associate turnover and multi-location quality assurance. Every patient receives the same detection sensitivity whether they're seen by a veteran dentist or a recent graduate.

Data Aggregation: Enterprise deployment unlocks population-level insights impossible in fragmented systems. You can benchmark detection rates across locations, identify regional disease patterns, correlate diagnostic accuracy with case acceptance, and demonstrate clinical quality to payers, regulators, and acquirers.

Operational Leverage: One implementation, one training program, one vendor relationship—deployed across your entire portfolio. The marginal cost of adding location #50 is minimal compared to location #1.

Expected Timeline

Phase	Duration	Milestone
Decision to Contract Execution	2–4 weeks	BAA signed, SOW finalized
Pre-Implementation & Pilot Prep	2–3 weeks	Wave 1 locations ready
Wave 1 Pilot (2–3 locations)	4–6 weeks	Go/no-go validation
Wave 2 Expansion (5–8 locations)	4–6 weeks	Playbook refinement
Wave 3+ Full Deployment	8–16 weeks	Portfolio-wide coverage
Total: Decision to Full Deployment	20–31 weeks	Varies by portfolio size

For a 25-location DSO, expect approximately 6 months from contract to full deployment. For 50+ locations, plan for 8–10 months.

---

2. Pre-Implementation Checklist (Weeks 1–2)

Technical Requirements

Hardware Requirements (Per Location)

☐ Workstations: Minimum specs for AI processing

• CPU: Intel i5 (8th gen+) or AMD Ryzen 5 equivalent
• RAM: 16GB minimum
• GPU: Dedicated graphics with 4GB VRAM (if using local processing)
• Display: 1920x1080 minimum resolution; medical-grade monitors recommended for diagnostic review

☐ Imaging Equipment Compatibility

• Verify sensor/phosphor plate compatibility (Dexis, Schick, Planmeca, Carestream, etc.)
• Confirm panoramic unit DICOM output capability
• Document current imaging software versions at each location

☐ Network Infrastructure

• Minimum 100 Mbps symmetric bandwidth for cloud processing
• Latency under 50ms to cloud endpoints
• Verify firewall allows HTTPS traffic to Orca endpoints

Software Requirements

☐ Operating System: Windows 10/11 Pro (64-bit) or macOS 12+ depending on deployment model ☐ Browser: Chrome 90+ or Edge 90+ for web-based interface ☐ Imaging Software: Current version of existing imaging platform with TWAIN/DICOM export capability ☐ PMS: Compatible version (see integration section)

Enterprise-Level Requirements 🟣

☐ Network Standards Across Locations

• Document network topology for each location (static IP, VPN, direct internet)
• Standardize bandwidth requirements across portfolio
• Establish network monitoring protocol

☐ Centralized vs. Location-Level Hosting Decision 🟣

• Centralized Cloud (Recommended): Single tenant environment, unified data lake, consistent version control
• Location-Level: Consider only if regulatory or connectivity constraints exist
• Document decision and rationale for board records

☐ Single Sign-On (SSO) Integration

• Confirm SSO provider (Okta, Azure AD, Google Workspace)
• Gather SAML/OIDC configuration requirements from Orca
• Plan role-based access control (RBAC) structure

☐ Centralized Credentialing

• Map provider credentials to Orca user provisioning
• Establish automated onboarding/offboarding workflow
• Define access levels: Provider, Hygienist, Admin, Regional, Corporate

---

Vendor Onboarding Steps 🔵

Step	Owner	Timeline	Deliverable
☐ Kick-off call with Orca implementation team	VP Operations + IT Lead	Day 1	Mutual understanding of timeline and scope
☐ Assign dedicated Orca Customer Success Manager	Orca	Day 1–3	Named contact with direct line
☐ Execute Business Associate Agreement	Legal + Orca	Week 1	Signed BAA
☐ Complete Orca security questionnaire	IT/InfoSec	Week 1	Documented security posture
☐ Establish technical support escalation path	IT Lead + Orca	Week 1	Documented tiers and SLAs
☐ Schedule weekly implementation syncs	Project Manager	Week 1	Recurring calendar invite

Key Contacts to Establish

☐ Internal Contacts Matrix

Role	Name	Phone	Email	Decision Authority
Executive Sponsor				Final go/no-go
Project Manager				Day-to-day coordination
IT Lead				Technical decisions
Clinical Champion (CDO)				Clinical workflow approval
Regional Managers (list)				Location-level escalation

☐ Orca Contacts Matrix 🔵

Role	Name	Phone	Email	Response SLA
Customer Success Manager				24 hours
Technical Implementation Lead				4 hours (business)
Tier 2 Support				2 hours (critical)
Executive Sponsor (Orca)				As needed

---

Data/Access Prerequisites

☐ System Access Inventory

System	Access Type Needed	Credentials Obtained	Verified Working
PMS (Dentrix Enterprise, etc.)	API/Database read	☐	☐
Imaging Software	TWAIN/DICOM export	☐	☐
SSO Provider Admin	User provisioning	☐	☐
Network/Firewall Admin	Port/URL whitelisting	☐	☐
Imaging Archive (PACS/Server)	Historical image access	☐	☐

☐ API Keys and Credentials 🔵

• Request API documentation from Orca (typically delivered Week 1)
• Generate API keys for test and production environments
• Document key rotation schedule and ownership

☐ Historical Image Migration Assessment

• Determine if historical images will be analyzed (adds significant value for trend analysis)
• Inventory storage locations and formats
• Estimate migration timeline and cost

---

Stakeholder Alignment Map 🟣

Board/Investor Level

Stakeholder	Communication Need	Format	Frequency	Owner
Board of Directors	Strategic rationale, ROI projection, timeline	Executive summary + deck	Pre-decision, then quarterly	CEO/CFO
Investors/PE Sponsors	Value creation narrative, risk mitigation	Brief + metrics dashboard	Quarterly or per ask	CFO

Key Messages for This Level:

• AI diagnostic capability is becoming table stakes for competitive DSOs
• Implementation de-risks clinical quality variability during rapid growth
• Data assets created enable future value (predictive analytics, payer negotiations, exit valuation)

C-Suite Level

Stakeholder	Communication Need	Format	Frequency	Owner
CEO	Overall progress, strategic alignment	1:1 verbal + written summary	Bi-weekly	VP Operations
CFO	Budget tracking, ROI milestone progress	Financial dashboard	Monthly	Project Manager
CDO/Clinical Leadership	Clinical workflow validation, provider adoption	Clinical review meeting	Weekly during rollout	Clinical Champion
CTO/IT Leadership	Technical integration, security compliance	Technical status report	Weekly	IT Lead

Regional Manager Level

Stakeholder	Communication Need	Format	Frequency	Owner
Regional Managers	Location-specific rollout plans, champion coordination	Regional briefing call	Weekly during wave prep	Project Manager

Location Level

Stakeholder	Communication Need	Format	Frequency	Owner
Office Managers	Operational changes, timeline, training schedule	Email + office visit	Pre-wave kickoff	Regional Manager
Providers	Clinical workflow changes, tool capabilities	CDO-led webinar or on-site	Pre-training	CDO/Clinical Champion
All Staff	General awareness, excitement	Internal newsletter/video	Monthly	Marketing/HR

---

Baseline Metrics Collection ⚠️

Critical: Capture these metrics BEFORE go-live to enable ROI measurement. Inconsistent baseline data is the most common reason DSOs cannot demonstrate AI ROI.

Standardized Metrics Across All Locations

☐ Establish uniform measurement methodology for:

Metric Category	Specific Metric	Measurement Method	Collection Tool	Collection Deadline
Case Acceptance	Treatment plan acceptance rate	Accepted $ / Presented $	PMS report	2 weeks pre-wave
Case Acceptance	Same-day case acceptance rate	Cases accepted same visit / Cases presented	PMS report	2 weeks pre-wave
Diagnostic Efficiency	Average time from imaging to treatment presentation	Timestamp analysis	Manual audit (20 cases/location)	2 weeks pre-wave
Diagnostic Accuracy	Provider-to-provider variance in pathology detection	Audit of identical image sets	Manual review by CDO	2 weeks pre-wave
Patient Communication	Time spent on radiograph explanation	Staff survey/time study	Survey tool	2 weeks pre-wave
Claims Performance	Claim denial rate for diagnostic imaging codes	Denied claims / Total claims	PMS/billing report	2 weeks pre-wave
Claims Performance	Average reimbursement per imaging procedure	Total imaging reimbursement / Procedure count	Billing system	2 weeks pre-wave
Volume Metrics	Radiographs per day per location	Image count	Imaging software report	2 weeks pre-wave

☐ Create Standardized Baseline Report Template

• Distribute identical data collection template to all locations
• Designate single point of accountability per location (Office Manager)
• Set hard deadline for submission (2 weeks before Wave 1 go-live)

☐ Validate Data Quality ⚠️

• Cross-check submitted data against PMS reports
• Flag and investigate outliers (±2 standard deviations from mean)
• Document any locations with incomplete data and recovery plan

☐ Establish Centralized Baseline Database

• Store all baseline metrics in unified format
• Enable cross-location comparison
• Archive for post-deployment ROI analysis

---

3. Location Readiness Assessment

Scoring Framework

Rate each location 1–5 on the following factors:

Factor 1: IT Infrastructure Maturity

Score	Criteria
5	Fiber internet (500+ Mbps), all workstations under 3 years old, current PMS/imaging versions, dedicated IT support
4	High-speed internet (100+ Mbps), most workstations under 4 years old, current software versions
3	Adequate internet (50+ Mbps), mixed workstation ages, software 1 version behind current
2	Basic internet (25–50 Mbps), some workstations 5+ years old, software 2+ versions behind
1	Unreliable internet (<25 Mbps), outdated hardware, legacy software requiring upgrade

Factor 2: Staff Tenure and Adaptability

Score	Criteria
5	Low turnover (<10% annual), history of successful tech adoption, documented training culture
4	Moderate turnover (10–20%), generally positive tech adoption history
3	Average turnover (20–30%), mixed results with past tech changes
2	High turnover (30–40%), some resistance to previous tech changes
1	Very high turnover (>40%), significant resistance to change documented

Factor 3: Patient Volume

Score	Criteria	Risk/Impact Note
5	Top quartile volume (50+ patients/day)	Highest impact but also highest risk if issues occur
4	Above average (40–50 patients/day)	Strong impact, manageable risk
3	Average (30–40 patients/day)	Moderate impact, moderate risk—often ideal for pilot
2	Below average (20–30 patients/day)	Lower impact but good for cautious testing
1	Low volume (<20 patients/day)	Minimal disruption but slower learning

Note: For Wave 1 pilots, moderate volume (Score 3) is often preferable to very high volume (Score 5) to balance learning speed with risk exposure.

Factor 4: Existing Tech Stack Compatibility

Score	Criteria
5	Standardized PMS and imaging (Dentrix Enterprise + Dexis), verified Orca integration, API-ready
4	Supported PMS and imaging combo, integration pathway confirmed
3	Supported PMS, imaging may require middleware or manual workflow
2	Non-standard PMS or imaging requiring custom integration work
1	Legacy systems, major upgrade required before Orca deployment

Factor 5: Local Champion Availability

Score	Criteria
5	Tech-forward lead provider + enthusiastic office manager, both committed to champion role
4	One strong champion (provider OR office manager) fully committed
3	Potential champion identified but needs development/convincing
2	No obvious champion, may need to assign from regional level
1	Active resistance from key staff, significant change management required

---

Scoring Worksheet

Location	IT Infrastructure (1–5)	Staff Adaptability (1–5)	Patient Volume (1–5)	Tech Compatibility (1–5)	Local Champion (1–5)	Composite Score	Rollout Priority
Location 1						/25
Location 2						/25
Location 3						/25
...

---

Recommended Rollout Sequence

Wave 1: Pilot Locations (Select 2–3)

Selection Criteria:

• Composite score 18–22 (strong but not your highest-performing locations)
• Tech Compatibility score ≥4 (minimize integration variables)
• Local Champion score ≥4 (essential for pilot success)
• Patient Volume score 2–4 (manageable volume, not highest risk)
• Geographic diversity if organization is regional

Rationale: Pilots should be set up for success while still being representative. Avoid both your best locations (no room to demonstrate improvement) and struggling locations (too many variables).

Wave 2: Early Expansion (5–8 locations)

Selection Criteria:

• Composite score 16–23
• At least one Wave 1 location in same region (leverage regional learning)
• Mix of volume levels to stress-test scaled operations

Wave 3+: Full Portfolio

Selection Criteria:

• All remaining locations
• Sequence by composite score (highest first within wave)
• May run multiple concurrent waves if Wave 2 demonstrates process maturity

---

Sample Rollout Sequence (25 Locations)

Wave	Locations	Count	Timeline	Learning Objective
Wave 1	Springfield, Oak Park, Riverdale	3	Weeks 4–9	Validate integration, training model, metrics tracking
Wave 2	Naperville, Schaumburg, Evanston, Downers Grove, Orland Park	5	Weeks 10–15	Scale training, test regional support model
Wave 3	8 locations (list)	8	Weeks 16–21	Rapid deployment, efficiency optimization
Wave 4	Remaining 9 locations	9	Weeks 22–27	Full portfolio coverage

---

4. Rollout Strategy

Wave Structure Overview

Week 1–3: Pre-Implementation (All)
    │
Week 4–9: Wave 1 (2–3 Pilot Locations)
    │
    ├─→ Learning Capture (1 week buffer)
    │
Week 10–15: Wave 2 (5–8 Locations)
    │
    ├─→ Learning Capture (1 week buffer)
    │
Week 16+: Wave 3+ (Remaining Locations)
    │
    └─→ Full Deployment Complete

---

Wave 1: Pilot Deployment (Weeks 4–9)

Week 4: Pilot Preparation

☐ Final location confirmation 🟣

• Executive sponsor approves pilot location selection
• Regional managers notified and briefed
• Office managers contacted directly

☐ Technical environment setup 🔵

• Orca provisions pilot location accounts
• Test environment configured per location
• Integration connections established

☐ Champion onboarding

• Champions from all pilot locations attend centralized training (virtual or in-person)
• Champions receive implementation toolkit
• Champions conduct local readiness walkthrough

Weeks 5–6: Pilot Go-Live and Stabilization

☐ Go-live execution (See Section 8 for detailed runbook)

• Day 1: Monitored go-live at each pilot location
• Days 2–5: Intensive support period
• Days 6–10: Transition to standard support

☐ Daily check-ins

• 15-minute stand-up with each location champion
• Aggregate daily report to project manager
• Issue tracking and resolution documentation

☐ Real-time adjustment

• Workflow modifications documented
• Training gaps identified and addressed
• Technical issues escalated per SLA

Weeks 7–9: Pilot Validation

☐ Metrics collection

• Compare pilot metrics to baseline (same location)
• Document qualitative feedback from staff and patients
• Calculate preliminary ROI indicators

☐ Pilot review meeting 🟣

• Present findings to executive sponsor and C-suite
• Document lessons learned
• Refine playbook for Wave 2

---

Go/No-Go Criteria for Wave Advancement 🟣

Go Criteria (ALL must be met):

Criterion	Threshold	Evidence Required
Technical stability	<2 critical issues unresolved	Issue log review
User adoption	>80% of staff using tool consistently	Usage analytics
Workflow integration	Clinical workflow disruption "minor" or "none"	Champion survey
Data integrity	Zero patient data errors	Audit report
Support scalability	Support volume manageable by current team	Ticket analysis

No-Go Triggers (ANY triggers pause):

Trigger	Action
Unresolved critical technical issue affecting patient care	Halt all expansion until resolved
Provider adoption <50%	Root cause analysis required before proceeding
Major workflow disruption at >1 pilot location	Process redesign required
Security or compliance incident	Full investigation and remediation
Support capacity overwhelmed	Scale support resources before continuing

---

Wave 2: Early Expansion (Weeks 10–15)

Timeline per Wave 2 Location

Week	Activity	Duration
Week 10	Location prep, champion training	1 week
Week 11	Technical setup, testing	1 week
Week 12	Go-live	1 week
Weeks 13–14	Stabilization	2 weeks
Week 15	Validation and handoff to BAU	1 week

Wave 2 Refinements

☐ Apply lessons from Wave 1

• Updated training materials based on pilot feedback
• Modified integration steps if needed
• Refined support protocols

☐ Train-the-trainer cascade

• Wave 1 champions assist with Wave 2 champion training
• Regional managers take larger coordination role
• Central team shifts to oversight and exception handling

☐ Parallel location deployment

• Wave 2 locations may go live in sub-waves (e.g., 3 locations in Week 12, 2–3 in Week 14)
• Stagger to avoid overwhelming support capacity

---

Wave 3+: Full Deployment (Weeks 16+)

Scaling Principles

☐ Increase velocity

• Target 6–10 locations per wave
• Reduce per-location oversight as playbook matures
• Regional managers own go-live execution with central oversight

☐ Standardize ruthlessly

• No location-specific customizations without documented business case
• Same training, same configuration, same metrics

☐ Exception handling

• Document any location requiring non-standard approach
• Escalate to project manager for approval

---

Rollback Plan ⚠️

Rollback Triggers

Trigger	Rollback Level
Critical system failure affecting >3 locations simultaneously	Full wave pause
Security/compliance incident	Immediate all-location pause
Major vendor-side outage (>4 hours)	Wave pause + vendor escalation
Single-location critical failure	Single-location rollback only

Rollback Procedure

Single Location Rollback:

1. Disable Orca integration at that location (IT Lead, <30 minutes)
2. Revert to pre-Orca imaging workflow
3. Notify regional manager and project manager
4. Document root cause
5. Develop remediation plan before re-enabling

Wave-Level Pause:

1. Executive sponsor or designee authorizes pause 🟣
2. Central IT disables integration for affected locations
3. Communicate to all affected staff within 2 hours
4. Vendor escalation to executive sponsor level 🔵
5. Root cause analysis within 48 hours
6. Go/no-go for resumption within 1 week

Key Principle: Rollback at one location or wave does NOT affect other locations already stable. Portfolio-wide rollback only in case of security/compliance incident.

---

5. Configuration & Integration (Weeks 2–3)

Practice Management System Integration

Dentrix Enterprise Integration 🔵

Estimated Time: 4–6 hours per location (after initial template setup)

Step-by-Step:

☐ Step 1: Verify Dentrix Enterprise version (minimum 7.0 recommended)

• Navigate to Help > About Dentrix
• Document version number
• If below minimum, schedule upgrade (add 1–2 weeks to timeline) ⚠️

☐ Step 2: Enable Dentrix API access 🔵

• Contact Henry Schein for API credentials (if not already enabled)
• Work with Orca implementation team to configure connection
• Orca typically handles this setup; provide credentials securely

☐ Step 3: Configure patient data mapping

• Map Dentrix patient ID to Orca patient record
• Verify provider ID mapping
• Test patient lookup with 5 sample records

☐ Step 4: Configure appointment integration (optional)

• Link Orca alerts to Dentrix appointment screen
• Configure timing of AI analysis relative to appointment

☐ Step 5: Test and validate

• Run 10 complete workflows (image capture → analysis → treatment plan)
• Verify data round-trip accuracy
• Document any mapping errors

Eaglesoft Integration 🔵

Estimated Time: 4–6 hours per location

Step-by-Step:

☐ Step 1: Verify Eaglesoft version (minimum 21.0 recommended)

• Navigate to Help > About Eaglesoft
• Document version number

☐ Step 2: Enable eCentral connectivity

• Ensure eCentral is configured for location
• Verify API access is enabled in Patterson portal

☐ Step 3: Configure Orca connection 🔵

• Orca team configures eCentral bridge
• Provide location-specific credentials

☐ Step 4: Map patient and provider data

• Verify Eaglesoft patient ID mapping
• Test provider routing for multi-provider locations

☐ Step 5: Validate integration

• Complete 10 test workflows
• Verify analysis results populate correctly

Open Dental Integration 🔵

Estimated Time: 3–5 hours per location

Step-by-Step:

☐ Step 1: Verify Open Dental version (current stable recommended)

• Setup > About Open Dental
• Document version

☐ Step 2: Enable API module

• Setup > Program Links > API
• Generate API key with appropriate permissions
• Provide key to Orca implementation team securely

☐ Step 3: Configure FHIR/API endpoint 🔵

• Orca configures connection to Open Dental API
• Test connectivity

☐ Step 4: Bridge module installation

• Install Orca bridge if required
• Configure bridge settings per Orca documentation

☐ Step 5: Validate complete workflow

---

Imaging System Integration 🔵

Dexis Integration

☐ Step 1: Verify Dexis Imaging Suite version

• Current versions: Dexis 9/10/11, Dexis IS
• Document version and sensor model

☐ Step 2: Configure TWAIN connection

• Enable TWAIN output in Dexis settings
• Configure export path for Orca processing

☐ Step 3: Test image capture to analysis workflow

• Capture test images (use test phantom if available)
• Verify Orca receives and processes images
• Confirm annotated results return to Dexis

DICOM-Compatible Systems (Planmeca, Carestream, etc.)

☐ Step 1: Verify DICOM export capability

• Check system settings for DICOM output
• Document DICOM AE title and port

☐ Step 2: Configure DICOM routing 🔵

• Orca provides DICOM destination configuration
• Route images to Orca processing endpoint

☐ Step 3: Test complete workflow

• Export test images
• Verify analysis results
• Confirm viewing workflow

---

Standardized Configuration Template

Enterprise Settings (Identical Across All Locations)

Setting	Standard Value	Rationale
Detection sensitivity	Default (Medium)	Balanced false positive/negative rate
Pathology categories enabled	All (caries, bone loss, periapical lesions, calculus, other)	Comprehensive detection
Report format	Annotated image + findings list	Standardized provider experience
Alert threshold	All findings	Provider makes clinical judgment
Data retention	Per BAA (typically 7+ years)	Compliance
User authentication	SSO via [your provider]	Security standardization
Audit logging	Enabled, full	Compliance

Location-Specific Configuration (May Vary)

Setting	Default	Allowed Variation	Approval Required
Specialty-specific algorithms	General dentistry	Perio, pedo, oral surgery modules if applicable	Regional Manager
Provider notification preferences	In-app alert	Email, SMS additions	None
Report language preferences	English	Spanish if applicable	None
Local printer configuration	Location default	N/A	None

---

Test Environment Approach 🔵

Recommended: Centralized Test Environment

☐ Central Test Tenant

• Orca provisions single test environment for DSO
• All locations tested against same environment
• Synthetic patient data used (never real PHI in test)
• Central IT owns test environment

Per-Location Testing Within Central Environment:

• Location-specific configuration tested in isolation
• 10-workflow validation checklist per location
• Signoff required before production promotion

Validation Checklist (Per Location)

☐ Image capture triggers Orca analysis ☐ Analysis completes within expected timeframe (<30 seconds) ☐ Annotated results display correctly ☐ Findings populate in PMS (if integrated) ☐ Provider can accept/modify AI findings ☐ Patient-facing report generates correctly (if applicable) ☐ Audit log captures all interactions ☐ User permissions function as expected ☐ Logout/timeout functions properly ☐ Support ticket from location reaches Orca ⚠️

---

Data Migration and Historical Analysis

Historical Image Analysis (Optional but Valuable)

☐ Assess historical image inventory

• Estimate image count per location (last 3 years typical)
• Document storage location and format

☐ Define analysis scope

• All patients or subset (e.g., active patients, recall-overdue)?
• Full history or rolling window?

☐ Execute migration 🔵

• Orca provides bulk import process
• Typically runs over several days/weeks depending on volume
• Schedule during low-usage hours

☐ Validate historical analysis

• Spot-check sample of historical analyses
• Verify integration with current patient records

---

Security and HIPAA Compliance Checklist

Enterprise-Level HIPAA Checklist

☐ Business Associate Agreement (BAA) 🔵

• BAA executed with Orca covering all locations
• BAA reviewed by legal counsel
• BAA stored in compliance repository

☐ Data Governance

• Document what PHI is shared with Orca
• Confirm data residency (US-based servers)
• Verify encryption at rest and in transit (AES-256, TLS 1.2+)

☐ Access Controls

• Role-based access defined (see Section 2)
• User provisioning tied to SSO
• Offboarding process includes Orca deprovisioning

☐ Audit Capabilities

• Verify Orca provides access logs
• Confirm logs retained per policy (minimum 6 years)
• Test log export capability

☐ Incident Response

• Confirm Orca's incident notification commitment (typically 24 hours)
• Integrate Orca into your incident response plan
• Document escalation path for security events

☐ Penetration Testing / SOC 2

• Request Orca's SOC 2 Type II report 🔵
• Review for any noted exceptions
• Document review in vendor file

☐ Data Disposal

• Confirm process for data deletion upon contract termination
• Include in BAA if not already specified

---

6. Team Training Plan

Train-the-Trainer Model

Champion Selection Criteria

Select 1 champion per location who meets these criteria:

Criterion	Minimum Requirement
Role	Provider (preferred) or Office Manager
Tenure	Minimum 1 year at location
Tech comfort	Above average (prior tech adoption success)
Influence	Respected by peers, positive attitude
Availability	Can dedicate 8–12 hours to champion training
Willingness	Voluntarily commits (not assigned unwillingly)

Champion Responsibilities