What problem does it solve?
Prevents accidental and systemic exposure of patient and clinician personal data by providing classification, access control, and audit patterns that align with regulatory requirements like HIPAA, DISHA, and GDPR. It reduces risk of data leaks, improper logging, and incorrect client-side usage of sensitive keys.
Core Features & Use Cases
- Data Classification: Clear guidance for marking PHI vs PII fields at the schema level to drive enforcement and minimization.
- Access Control & RLS: Row-Level Security patterns and SQL policy examples to enforce facility- and role-based data access.
- Audit Trails & Logging: Schemas and best practices for insert-only audit logs, sanitized logging, and session-based access records.
- Deployment Checklist: Pre-deploy safeguards (no PHI in errors, no client-side service_role keys, session timeouts) to validate production readiness.
- Use Case: Securely design an API that returns patient summaries while ensuring only authorized personnel at the correct facility can read PHI and every access is auditable.
Quick Start
Use the healthcare-phi-compliance guidance to review an endpoint that returns patient data, identify PHI fields, and produce Row-Level Security policies plus an audit checklist.
