PhantomBill — EVV Verification System
Complete system overview — shift verification, onboarding, edge cases, hardware, and build decisions.
Encore Care · CEO & Development Team · 2025 · Confidential
01 — What is PhantomBill
System purpose
PhantomBill is Encore Care's Electronic Visit Verification (EVV) system. It proves, with biometric certainty, that a caregiver was physically present with a patient for the duration of a scheduled shift — preventing fraudulent Medicaid claims and protecting both patients and caregivers.
The core principle
One branded Encore Care tablet. Two face scans. One verified shift. The caregiver scans their face, then hands the tablet to the patient who looks at the camera. Both physically present = shift confirmed. Same flow at check-out. Simple enough to train in under 5 minutes.
Full shift flow
Shift assigned
Care plan loaded
→
→
During shift
Passive monitoring
→
→
Verification
Auto or review
→
Claim filed
Medicaid / payer
02 — The Encore Care tablet
On the tablet — APK only
Intentionally minimal
Front camera for biometric scan
Success / failure confirmation screen
Offline mode — queues and syncs when back online
Kiosk mode — no other apps, no settings access
Not on the tablet
Kept off deliberately
No shift history or patient records
No scheduling or care plan details
No internet browsing or other apps
No ability to edit or dispute shifts
Tablet is a verification terminal only. All management lives in the caregiver app or coordinator portal.
Battery + charging
Recommended
Portable charging pack
10,000mAh power bank travels with the caregiver. ~$15–20. Eliminates battery anxiety between patients. Primary solution.
Backup
USB cable in tablet case
Plug in at patient's home if needed. Good fallback but depends on outlet access. Not primary.
Policy
Charge every night
Caregivers plug in tablet nightly. Make it a written policy, not an assumption.
Note on 64GB storage vs reliability
64GB means the tablet can store many offline shift records locally — useful. But storage does not prevent crashes, camera failures, or battery drain. What keeps it reliable: offline-first app design, kiosk mode, a charging policy, a spare tablet pool at the office, and an MDM tool (ManageEngine or Jamf) that monitors device health and pushes updates overnight — never during a shift.
03 — Check-in flow
Same device, two faces. Caregiver scans first, then hands to patient.
CaregiverOpens the Encore Care tablet APK
Single screen — two buttons only: Check In and Check Out. Nothing else visible.
CaregiverScans their face
Front camera captures biometric. GPS captures location simultaneously. Identity verified + at correct patient address.
Biometric matchGPS verifiedTimestamp logged
CaregiverHands tablet to patient — face side
Screen flips automatically to patient mode. Large prompt: "Please look at the camera." One instruction, nothing to tap. Designed for elderly users.
PatientLooks at the camera
Biometric captured passively. Matched against patient profile. No tapping, no buttons, no account needed.
Patient identity verifiedCo-presence confirmed
SystemCheck-in confirmed
Green checkmark, both names, timestamp. Tablet returns to idle. Data syncs to caregiver's phone app in background.
Shift record openedSyncs to caregiver app
Check-out flow
Identical sequence — caregiver scans → hands to patient → patient looks → confirmed. One flow to learn, not two. System calculates shift duration, seals the record, claim is ready to file.
Caregiver biometricGPS at checkoutPatient biometricDuration calculatedShift record sealed
04 — Two verification tracks
Either track passing confirms the shift. Both must fail simultaneously to trigger a flag.
Primary track
Tablet — biometric co-presence
Caregiver face + patient face on the same device at check-in and check-out. Both physically present = verified. Location is secondary when both faces confirm.
Secondary track
Caregiver phone — GPS trail
Passive GPS ping every 15–30 min throughout the shift. Creates a breadcrumb trail. Syncs to the caregiver app. Used to fill gaps if tablet has issues.
05 — Checkout decision logic
Three gates run at checkout. System passes on the first gate that clears.
Gate 1
At patient address?
GPS matches the registered home address. Auto-approved immediately.
Gate 2
Pre-approved location?
Location matches care plan approved list — clinic, park, family home, day program.
Gate 3
Patient biometric confirmed?
Patient face scan at checkout confirms co-presence regardless of GPS location. Strongest gate.
Any gate passes
Shift auto-approved. Claim proceeds.
All gates fail — GPS clean
Coordinator reviews GPS evidence and can approve.
Everything fails
Flagged. Supervisor review + evidence package.
06 — Edge cases + solutions
PROBLEM
Phone dies mid-shift
GPS trail cuts off. No caregiver-side phone data after battery out.
→
SOLUTION
Tablet biometric covers it
Both biometric scans on the tablet are the primary record. Phone GPS is supporting evidence only.
Tablet = source of truth
PROBLEM
Checkout at the park
Caregiver takes patient on outing. GPS doesn't match home address.
→
SOLUTION
Patient biometric at checkout = proof
Patient face scan confirms co-presence regardless of location. Pre-approved location list is an additional fallback.
Biometric overrides GPSApproved list backup
PROBLEM
Caregiver forgets to check out
Shift has no end timestamp. Claim can't be processed.
→
SOLUTION
Two automatic fallbacks
1. Auto-checkout triggers when GPS exits the patient geofence. 2. Coordinator manually closes the shift with a noted reason.
Geofence auto-checkoutCoordinator override
PROBLEM
GPS gap mid-shift 30+ min
Caregiver loses signal or turns off phone. Trail has unexplained gap.
→
SOLUTION
Flag + explanation — not auto-reject
System flags the gap but does not reject the shift. Tablet biometric record reviewed. Caregiver submits a brief note via their app.
Not auto-rejectedExplanation logged
PROBLEM
Patient can't face the camera
Bedridden, unconscious, or physically unable to look at screen.
→
SOLUTION
Biometric exempt flag
Coordinator pre-flags patient as exempt in care plan. Shift verified by caregiver scan only + supervisor spot-check protocol.
Exemption in care planSupervisor spot-check
PROBLEM
Patient refuses to scan
Patient declines or is uncooperative. Caregiver can't complete flow.
→
SOLUTION
3-attempt limit → log → proceed
3 attempts allowed. If all fail, logs "patient scan incomplete" with timestamp. Caregiver adds a note. Shift is not blocked — flagged for coordinator review.
Shift never blockedReason loggedCoordinator reviews
PROBLEM
Tablet lost or damaged
Caregiver loses tablet or it breaks mid-shift.
→
SOLUTION
Remote wipe + replacement
Tablet remotely locked and wiped via MDM. Replacement assigned same day from spare pool. Shift marked "device incident" — supervisor reviews.
Remote wipeSpare poolManual review
PROBLEM
No internet on tablet
Rural area, dead zone, or wifi outage at patient home.
→
SOLUTION
Offline-first design
Tablet works fully without internet. Biometrics and GPS stored locally, encrypted. Auto-syncs when connectivity returns. Timestamp captured at scan, not at sync.
Offline-firstEncrypted local storage
PROBLEM
Caregiver colludes with family
Family falsely confirms caregiver presence to cover an absence.
→
SOLUTION
Permission controls + audit trail
Approved locations locked to coordinator only. All data immutable once logged. GPS trail and biometric cross-checked for conflicts automatically.
Coordinator controls locationsImmutable audit trail
07 — Caregiver onboarding
Done on their own phone — tablet not needed until first shift.
Encore CareInvite sent to caregiver
Text or email with direct download link to the caregiver app. No manual app store search.
CaregiverDownloads app + creates account
Name, employee ID, contact info. Pre-filled from HR system where possible. Under 3 minutes.
CaregiverBiometric enrollment — face scan
App walks caregiver through a face capture on their phone camera. 3–4 angles. Identity baseline for all future tablet check-ins. Done once, never repeated.
On their own phoneOne time onlyStored securely
SystemProfile verified by coordinator
Coordinator reviews and activates the account. Caregiver gets a confirmation. Now ready to use the tablet.
CaregiverTablet assigned + 5-min walkthrough
Coordinator hands over tablet and power bank. Demonstrates the two-button flow. That is the full training.
Tablet assignedPower bank included
08 — Patient onboarding
Part of standard intake — no extra appointment needed. Family assists throughout.
Encore CareDigital intake form sent to family
Link sent to family member's phone or email. Standard patient fields — name, DOB, address, care plan, emergency contacts. Completed at home, in their own time. No office visit required.
Mobile-friendly linkNo app download needed
FamilyPatient photo submitted
At the end of the intake form, family takes a clear photo of the patient's face on their phone and uploads it. Simple as taking a selfie for someone. This becomes the patient's starter biometric baseline.
On family's phoneUploaded in the form~2 minutes
Encore CareCoordinator reviews photo quality
Is the face clear, well-lit, unobstructed? If poor quality, coordinator sends a re-submission request with simple guidance. Once approved, patient biometric is active.
SystemFirst shift — live biometric upgrade
On the first check-in, the tablet captures a live face scan automatically. Photo = provisional baseline. Live scan = full baseline. No extra step for anyone.
Photo = starterLive scan = full baseline
FamilyFamily portal access — optional
Family gets a login to view shift history and receive arrival/departure notifications. Optional — system works without it.
OptionalReal-time visibility
09 — Build decisions + recommendations
Decision 1 — Patient biometric enrollment
Who registers the patient face and at what point?
RECOMMENDATION
Photo at intake (family submits) + live upgrade on first shift
Family submits a face photo as part of the digital intake form — no office visit, no special equipment. Coordinator approves quality. On the first shift, the tablet captures a live scan to strengthen the profile. System is ready from day one without adding friction.
No extra appointmentFamily does it in 2 minStrengthens on first visit
Decision 2 — Patient refusal protocol
What happens when a patient won't or can't scan?
RECOMMENDATION
3-attempt limit → log event → caregiver note → coordinator reviews
Tablet allows 3 scan attempts. If all fail, logs a "patient scan incomplete" with timestamp and GPS, prompts caregiver to add a brief note (refused, asleep, unresponsive). Shift is not blocked — proceeds and is flagged. Repeated refusals trigger a biometric-exempt flag in the care plan. Caregiver is never stranded.
Shift never blockedReason loggedExempt flag for repeat cases
Decision 3 — Tablet ownership model
Does the tablet travel with the caregiver or stay at the patient's home?
RECOMMENDATION
Caregiver carries the tablet
Most caregivers serve multiple patients. One tablet per caregiver — not one per patient — is far cheaper to scale. Caregiver is accountable for the device. For high-risk patients, coordinator can place a dedicated tablet in the home as an exception, not the rule.
1 tablet per caregiverLower hardware costCaregiver accountableHome tablet for exceptions
10 — Caregiver phone app
Tablet captures
Check-in biometrics — caregiver + patient
GPS at check-in and check-out
Check-out biometrics — caregiver + patient
Any scan failures or incomplete events
Caregiver app shows
Verified vs not verified status per shift
Hours logged this week and month
Flagged shifts with reason
Option to add notes on flagged shifts
Sync status — online or queued offline
11 — Permissions + fraud prevention
| Role | Can do | Cannot do |
|---|
| Care coordinator | Add/edit approved locations, activate accounts, review flags, override decisions, close shifts manually | Approve their own shifts |
| Caregiver | Check in/out on tablet, view own shift history, add notes on flagged shifts | Edit location list, approve shifts, view other caregivers |
| Family | View shift history, receive arrival/departure notifications | Add approved locations, edit care plan, approve or reject shifts |
| Supervisor | Full audit trail, evidence packages, final approval on flagged shifts, remote tablet management | Edit biometric profiles |
Built-in fraud guards
Family cannot add approved locations — coordinator only, preventing caregiver/family collusion.
All confirmations immutable once logged — no record can be edited after capture.
GPS and biometric cross-checked automatically — conflicts flagged without manual review needed.
Evidence package auto-generated for every flagged shift — downloadable for any disputed claim.
Remote tablet wipe and lock — any device disabled instantly if lost or compromised.
12 — Auto-approve vs flag rules
Auto-approved when
Both biometric scans complete at check-in and check-out
Checkout GPS matches patient address
Checkout location is on the pre-approved list
Patient biometric confirmed at checkout — any location
Auto-checkout triggered by geofence exit with clean trail
Flagged for review when
Patient biometric fails at check-in or check-out
All 3 checkout gates fail
GPS gap exceeds 30 min with no explanation
Check-in and check-out don't match patient address or approved list
Shift duration falls significantly outside scheduled hours — warning only
Tablet device incident logged during shift — warning only
Dev team — next steps
Select a biometric SDK — face recognition that works offline on Android and meets HIPAA standards
Build the tablet APK in kiosk mode — single-purpose locked Android environment
Design the patient intake form — web-based, mobile-friendly, photo upload included
Set up MDM tool — ManageEngine or Jamf for remote monitoring, lock, wipe, and overnight update pushes
Build offline sync logic — local encrypted storage, auto-sync on connectivity restore, timestamp at capture not sync
Build caregiver app — visit history, verified/unverified status, flagged shift notes, GPS trail view