30
Live in 30 days, or we credit a month
We commit to a go-live date in your kickoff call. Miss it and we credit one month's fee, written into every contract.
Built for healthcare. Nothing else.
Occupational health records that hold the whole story
Employee health, immunizations, incidents, and OSHA reporting for hospitals and county health services. Built for the people who actually run the clinic.
Live in 30 days, guaranteed · Free data migration · No seat tax. Unlimited users.
carefoundry.app/dashboard
Recently shipped
87 fields that were free-text boxes are now managed lists, so one department stops arriving spelled four ways. A schedule that shows only the missed appointments. Reminder letters for the employees you cannot email. And somewhere to record the numbers a clinic actually measures: TB readings, titers, agreed leave totals.
See the full roadmap
The carefoundryESC promise
Three things every customer gets in writing
$0
Free data migration, every time
We move your employees, incidents, immunizations, and credentials from spreadsheets or any legacy system. Migration is included on every plan.
∞
No seat tax. Unlimited users
Every admin, manager, nurse, and employee-portal account is included in your plan. You never pay more as your team grows.
A modern alternative to legacy occupational-health systems
HIPAA-aligned
OSHA 300 / 300A / 301
Encrypted & secure
Full audit trail
Enterprise-ready
Everything in one place
The occupational health platform
The occupational health platform
your team actually needs
From first-day physicals to year-end OSHA filings, carefoundryESC handles the full lifecycle of employee health, without the paperwork.
Complete Health Records
Track every health touchpoint across 17 record modules (exams, immunizations, incidents, exposures, vitals, leaves, and more), all attached to a single employee record.
Scheduling & Reminders
Calendar view per organization with a full scheduled → complete / canceled / no-show lifecycle. Automated and manual email reminders reduce no-shows.
OSHA 300 / 300A / 301
Incidents auto-classify into the 300 Log. Form 300A summaries and per-incident 301s generate in their legally-mandated layout, ready to post by February 1.
E-Signature Documents
Upload policies and consent forms once. Assign to any employee or group. Collect typed e-signatures via secure token links. No login is required to sign.
Employee Self-Service
A dedicated portal lets employees view their own health records, upcoming appointments, and expiring credentials, which reduces admin load on your employee health team.
50+ Built-in Reports
Immunization compliance, incident summaries, exam history, roster demographics. Every report renders cleanly and exports to Excel, CSV and PDF on demand.
- Record modules
-
17Record modules
- Built-in report types
-
50+Built-in report types
- OSHA forms generated
-
3OSHA forms generated
- Role-based access levels
-
5Role-based access levels
30-day onboarding
Go live in 30 days, with a written timeline from day one
No open-ended implementation. No 6-month rollouts. Your kickoff call includes the exact dates for each milestone below. If we miss the go-live date, we credit one month's fee.
1
Day 0
Kickoff + success plan
A 45-minute call confirms your go-live date, champion, and data sources.
2
Day 1–7
Data migration
We export your employees, incidents, immunizations, and credentials from any source, included free.
3
Day 8–14
Admin training
Two 60-minute sessions cover daily workflows, reports, and the e-signature document flow.
4
Day 15–21
Portal rollout
Welcome emails go out. Employees log in, sign policies, and see their own records.
5
Day 22–30
Go-live + first OSHA run
Your first live 300, 300A and 301 are generated from real data. We follow up closely for 60 days, and support continues for the whole contract.
Not live on day 30? We credit one month's fee, guaranteed in writing.
Employee records
Every health event, on one employee record
Stop hunting across spreadsheets and paper files. carefoundryESC centralizes every health activity for each employee, with sensitive data masked by default and revealed only when a user explicitly asks.
- 17 record modules, all searchable and filterable
- Sensitive personal details stay hidden by default and appear only when needed
- Bulk Excel import and individual or batch portal provisioning
- Photo upload, department, manager, and employment details
- Audit log of every read, change and export
Health records and programs
Every clinical workflow, covered
From routine immunizations to complex incident investigations with root-cause analysis. Every module shares the same list → detail → edit pattern, so staff learn the system once.
Examinations
Medical exams with lab panels and clearance tracking
Immunizations
Vaccine tracking with consent and decline records
Incidents
Workplace injuries with OSHA classification, RCA, and costs
Exposures
Bloodborne pathogen and chemical exposures with follow-up
Treatments
Medical treatments log with provider and outcome notes
Health Conditions
Ongoing conditions with risk level and management notes
Leaves
Sick leave, FMLA, and LOA with start / end tracking
Vitals
BP, HR, temperature, height, and weight over time
Credentials
Certifications and licenses with expiration alerts
Work Restrictions
Post-injury job restrictions with duration and scope
Record Requests
Follow-up visit requests and employee-initiated inquiries
Attachments
Supporting documents, lab results, and imaging, per-record
Medical Surveillance
Standing programs whose membership follows the job, with a due and overdue queue
Hearing Conservation
Baseline and annual audiograms, with Standard Threshold Shift worked out on save
Return to Work
Light duty, the date they are expected back, and who will clear them
Clinical Notes
SOAP notes against any record, signed and optionally countersigned
Workers' Compensation
Claims against the incidents that caused them, with twelve months of incurred cost
29 CFR 1904 · OSHA Recordkeeping
Year-end reporting,
Year-end reporting,
without the year-end panic
carefoundryESC generates all three required OSHA recordkeeping forms directly from your incident data. No manual tallying, no reformatting. Just accurate forms, ready to post by February 1 and submit through the ITA portal.
300
Log of Work-Related Injuries and Illnesses
Running log of all recordable incidents throughout the year, automatically populated from incident records.
300A
Summary of Work-Related Injuries and Illnesses
Annual summary for posting February 1 through April 30, with hours-worked data and case totals.
301
Injury and Illness Incident Report
Per-case narrative form generated directly from each incident record, including privacy-case handling.
Where you operate changes what you file
Twenty-two State Plans write their own rules. We follow yours
Twenty-two OSHA State Plans cover private employers, and roughly twenty states now require a healthcare employer to keep a violent incident log. They disagree about what happens next. carefoundryESC carries these as layers that are included in every plan and switched on automatically for the clinics they apply to, so a clinic in Texas is never shown a California form it has no use for.
Any employer, any state
The OSHA compliance baseline
The obligations you carry wherever you operate, generated from the incident records you already keep.
- •The serious injury report, with a countdown that knows federal OSHA allows 24 hours for an inpatient admission and California allows 8
- •The sharps injury log
- •The redacted Form 301 an employee representative may be given, with the nine enumerated deletions
- •The electronic submission file for OSHA's Injury Tracking Application, with a pre-flight check that names what to fix before you upload
California
Cal/OSHA
The first state in the nation to adopt a healthcare workplace violence standard, and the most prescriptive about records.
- •The 8 CCR §3342 violent incident log, kept without personal identifying information, on its 24-hour and 72-hour reporting clocks
- •The §5199 aerosol transmissible diseases declination statements, transcribed from Appendix C1 and C2 rather than paraphrased
- •The §5199 exposure clocks: 72 hours to complete the analysis, 96 hours to notify
- •Cal/OSHA versions of the 300, 300A and 301
Washington
L&I (DOSH)
A different obligation from California's, and the application does not pretend they are the same.
- •The RCW 49.19 investigation of every violent incident
- •The recurring data summary to the safety committee
- •The state's own eight-hour reporting clock
- •No separate sharps injury log, because Washington does not require one
How jurisdiction compliance works
Included in every plan and switched on automatically where it applies. Operating somewhere else? Ask us.
Free tools, no account required
Is it recordable, and what is your rate? Two free OSHA tools
The recordability check walks one case through OSHA's general recording criteria, question by question. The incidence rate calculator turns your case counts and hours worked into TRIR and DART, in your browser, with nothing sent anywhere.
OSHA Form 300A, 2026
Ready
- Total cases
- 12
- Days away
- 186
- Days restricted
- 41
- Injuries
- 9
- Skin disorders
- 1
- All other illnesses
- 2
Incident rate
4.32 per 100 FTE
Never miss a deadline
Your compliance year, in one view
Every OSHA, CMS, and Joint Commission deadline that matters to occupational health. Each one is a single click inside carefoundryESC.
Feb 1
OSHA 300A posted
Annual summary posted in the workplace through April 30. Generated from your incident data in one click.
Mar 2
ITA electronic submission
Establishments with 20+ employees in certain industries submit 300A data through the OSHA Injury Tracking Application.
Annually
TB screening cycles
New-hire baseline and annual retesting per CDC guidance. Auto-enroll employees by job role.
Annually
Respirator fit testing
OSHA 1910.134 requires annual fit tests for every respirator user. Due dates tracked per employee.
Sep–Oct
Flu season preparation
Consent forms loaded, reminders scheduled, decline workflow ready, all before peak vaccination weeks.
Ongoing
Post-exposure follow-up
Follow-up draws are scheduled automatically from the exposure date when a bloodborne pathogen exposure is logged, on a schedule you can configure.
Ongoing
Credential expiration
Licenses and certifications tracked per employee with advance-notice alerts.
Survey window
Joint Commission / CMS survey ready
Audit log exports, immunization rosters, and OSHA filings ready on demand for any surveyor.
Employee portal
Give employees visibility into their own health records
A dedicated, permission-scoped portal reduces the volume of records requests your occupational-health team fields each week. Employees log in and see exactly what they need, and nothing more.
- View their own health records, organized by category
- See upcoming appointments and full visit history
- Sign assigned policy documents and consent forms online
- Update their own contact information, with an audit trail
- Receive automated reminders before required activities
Built for every role
One platform, five user types
Role-based access, scoped per organization, ensures every user sees exactly what they need, and nothing they shouldn't.
Super Admin
Provisions organizations, impersonates users for support
Organization Administrator
Full access within their organization; manages staff and settings
Employee health nurse or manager
Creates and edits records, schedules exams, runs reports
Clinic Staff
Logs health activities and views assigned employee data
Employee
Portal-only access to their own records and documents
Focus is a feature
Built for healthcare.
Built for healthcare.
Nothing else
Most occupational-health platforms are sprawling EHS suites built for oil & gas, manufacturing, and mining, with healthcare bolted on. Their breadth is their weakness: slow rollouts, bloated interfaces, and price tags that reflect features your team will never touch.
carefoundryESC exists to do one thing well: run employee health for hospitals, clinics, and long-term care. Every module, every report, every workflow was designed with your employee health nurse at the keyboard.
- Every module maps to a real occupational-health workflow, not an industrial-safety checklist.
- The codebase is shared across every customer, so improvements ship to everyone at once.
- Your staff learn the system in hours, not weeks, because every screen follows the same pattern.
What we deliberately don't do
These belong in other tools. Keeping them out of carefoundryESC is what makes it fast, simple, and affordable.
- Environmental sustainability and carbon-emission tracking
- Quality management systems and ISO-9001 workflows
- Chemical inventory and safety-data-sheet management
- Industrial hygiene air-sampling and exposure registries
- Full learning-management systems
- Ergonomics motion-capture and job-safety-analysis tooling
If your next vendor needs to do all of the above, you're not our customer, and we'd rather tell you than sell you something you don't need.
Who builds it
carefoundry has been building this since 2015
We are a small company in Round Rock, Texas, and employee health software for healthcare organizations is the only thing we make. Our pricing is published, our roadmap is public, and we list the things we deliberately do not build, so you can tell before a demo whether we are the wrong fit.
Security & privacy
The posture your IT reviewer will ask about
We answer security questionnaires within two business days, not three weeks. Here's what goes on them.
Encryption
AES-256 at rest. TLS 1.2+ in transit. Names, Social Security numbers, dates of birth and contact details are encrypted at the field level.
HIPAA posture
Built for HIPAA-sensitive data. PHI access is gated by role, audited per request, and masked by default across every screen.
Audit trail
Every read, change and export of a health record is logged with the user, the time and the IP address. Exportable as a CSV with a SHA-256 manifest an auditor can verify, for Joint Commission and CMS surveys.
Access controls
Five role levels with granular per-action permissions. Per-organization data isolation enforced at the database query layer, not the UI.
US hosting
All data in the United States
Audit logging
Every record read and write
Encryption at rest
AES-256
Encryption in transit
TLS 1.2+
What we commit to
Two commitments, in writing
- Migration
-
14 dMigrationWe move you from a spreadsheet or a legacy system to production data inside 14 days.
- Security questionnaire
-
48 hSecurity questionnaireWe return your IT reviewer's questionnaire within two business days.
Two ways to start
Try it, or switch. We'll meet you where you are
30-day paid pilot
Prove it with a pilot
$1,500
one-time · credited to your annual plan
- One department or facility, up to 50 employees
- Full feature access, no crippled-trial asterisks
- Free data migration from whatever you use today
- Go-live inside 30 days or the pilot is refunded in full
- 100% of the pilot fee credited when you sign an annual contract
Switch from your current system
Already paying for something else?
We complete a full data migration before your current contract ends, run in parallel through cutover, and your staff won't lose a single record, at the same published price every buyer pays.
- Three published plans, $5,000 to $25,000 a year by headcount, and Enterprise+ above 4,000 employees
- Full migration of employees, incidents, immunizations, credentials, documents
- Parallel run for 30 days, alongside your current system before cutover
- No migration fee and no implementation fee
- If we miss the cutover date, we credit one month's fee, written into the contract
Switching?
Coming from another system? Your data comes with you
Every major competitor except MediTrax is quote-only. As far as we can tell, carefoundryESC is the only cloud-based, healthcare-first employee health platform with published pricing. And migration off your current system, including legacy installs like RESPOND! (ICPA) / BD Protect, is included: employees, incidents, immunizations, exams, credentials, and documents, typically within 14 days.
Leaving ReadySet?
How carefoundryESC compares to ReadySet by Cority for hospital employee health.
See the comparisonLeaving Net Health?
How carefoundryESC compares to Net Health Employee Health (formerly Agility).
See the comparisonLeaving Cority?
How carefoundryESC compares to Cority's occupational health suite for hospitals.
See the comparisonLeaving Enterprise Health?
How carefoundryESC compares to Enterprise Health by MIE for employee health teams.
See the comparison
Straight answers
Frequently asked questions
Everything your procurement, IT, and compliance teams will ask, answered up front so you don't have to.
Every contract commits to a go-live date inside 30 days of kickoff. We migrate your data, train your admins, roll out the employee portal, and generate your first live OSHA report inside that window. If we miss the date, we credit one month's fee.
Built for HIPAA-sensitive data. Names, Social Security numbers, dates of birth and contact details are encrypted at the field level, and searched through blind indexes rather than decrypted. Every organization's data is isolated from every other. Every read, change and export of a health record is logged with the user, the time and the IP address.
Yes, included at every size. We handle employees, incidents, immunizations, exams, credentials, and documents from CSV exports, spreadsheets, or direct exports from any prior system, including legacy installs like RESPOND! (ICPA) and BD Protect. Migration typically completes within 14 days. An import can be undone in full until anyone records anything against an imported employee.
Roster imports from a spreadsheet or CSV export work on day one, whatever your HRIS is. Every import run is recorded, and rows that failed are kept and readable so you can correct and re-run them. Direct HRIS sync is not something we offer today.
It depends on the request. Tell us what you need, such as a report, a field your state requires, or a change to a workflow. If we can build it, we send a quote before any work starts. The quote states the one-time development fee, if one applies. When the work also benefits other customers, it also states what share of that fee we cover. What we build becomes part of the platform every customer uses, so it is maintained with every release. Custom work is available on the Professional, Enterprise, and Enterprise+ plans. It is not available on Essentials.
No seat tax. Every admin, manager, nurse, and employee-portal account is included. Pricing is three published plans sized by headcount, plus Enterprise+: Essentials up to 500 employees at $5,000/year, Professional up to 1,500 at $12,000, Enterprise up to 4,000 at $25,000, and Enterprise+ above that, scoped with you. Every plan includes all 17 record modules, all reports, unlimited facilities and users, and data migration.
Your data is yours and there is no exit fee. Every report exports to Excel, CSV, and PDF, and health records print to PDF per employee or by category. A full extract at contract end is prepared for you through support rather than left to a self-serve download. A roster leaving the system unlogged is exactly what the audit trail exists to prevent. We retain 60 days of encrypted off-site backups after contract end, then issue a signed certificate of deletion.
Five role levels with granular per-action permissions, with each organization's data isolated from every other at the query layer rather than in the interface. Every read, change and export of a health record is logged with the user, the time and the IP address. Staff accounts can use two-step verification with an authenticator app, and idle sessions sign out automatically. Single sign-on is not available today.
We answer security questionnaires within two business days, not three weeks. A full security and compliance one-pager is ready to hand to your reviewer before our first call, and we have pre-filled responses to the most common procurement questionnaires in healthcare.
Question not answered here? Ask it on your demo call. 20 minutes, no slides.
From the blog
Guides your employee health team will actually use
OSHA recordkeeping for healthcare: The complete guide to Forms 300, 300A, and 301
How to complete OSHA Form 300A: A step-by-step guide for healthcare facilities
TB screening for healthcare workers: Baseline, annual testing, and IGRA vs. TST
CDC post-exposure follow-up windows: The current testing schedule for HIV, HBV, and HCV
How to choose occupational health software: A buyer's guide for healthcare
All 54 guides
See your first OSHA 300A generated
in a 20-minute demo
No slides, no 90-minute overview. We'll use your real data shape, walk through an incident-to-300A flow, and answer every IT and compliance question on the same call.
Live in 30 days · Free data migration · No seat tax · Encrypted at rest