healthcare-phi-compliance

Enable RLS on the patients table and create policies scoping access by facility through a staff_assignments lookup. The policy checks that the authenticated user's facility_id matches the patient's facility, restricting reads to authorized roles like doctor, nurse, or admin.

PHI is any data that identifies a patient and relates to their health: name, date of birth, address, phone, national ID numbers, medical record numbers, diagnoses, medications, lab results, insurance details, and appointment records, or any combination of these.

Create an insert-only policy on the audit_log table tied to the authenticated user, then add UPDATE and DELETE policies that always evaluate to false. This ensures audit entries can be written but never modified or removed.

No, PHI must never be stored in browser storage. Keep patient data in memory only and fetch it on demand, since localStorage and sessionStorage persist data that can be exposed through scripts or browser inspection.

Service role keys bypass Row-Level Security entirely, exposing all patient records to anyone who extracts the key from client code. Always use the anon or publishable key so RLS policies enforce per-user access control.

RLS enforces database-level isolation but does not protect against leaks in application layers like error messages, logs, or URL parameters. It must be combined with safe logging practices, opaque UUIDs, and server-side error sanitization.