HIPAA isn't a checkbox. Five things it actually changed in our codebase.
PHI handling, role-based access, encryption at rest, audit logging — and the API design decisions each one forced.
Notes from production.
Mostly what broke, what it cost, and what I'd do differently — from healthcare platforms under compliance, multi-tenant systems at scale, and building with AI agents.
All writing
3 piecesWe replaced a WhatsApp group with software. The group was doing more than anyone realised.
An apparently chaotic manual process encoded real business logic. Finding it before deleting it.
I write a nine-file .docs/ folder before I write any code.
Persistent context for AI agents across sessions — what goes in each file, and what it stops going wrong.