HIPAA isn't a checkbox. Five things it actually changed in our codebase.
Placeholder. Replace before this site goes live — see
.docs/decisions.md, D-014.
Compliance is usually described as a list of controls to satisfy. In practice it is a set of constraints that reshape ordinary design decisions, and the reshaping is where the interesting work is.
What this piece will cover
- PHI handling, and why “just don’t log it” is harder than it sounds
- Role-based access control that survives contact with real clinical workflows
- Encryption at rest, and the cost it adds to search
- Audit logging as a first-class feature rather than an afterthought
- What all of the above did to API design