Security and privacy

HIPAA Readiness

A practical review checklist for teams evaluating this application before any production use involving protected health information.

Important: this is not a compliance certification

CareBridge has not been independently assessed or certified as HIPAA compliant. A software project alone cannot demonstrate HIPAA compliance: compliance depends on the covered entity's and business associates' policies, workforce, contracts, operating environment, and implemented safeguards. This page is a planning aid, not legal advice or an attestation.

Do not enter real patient information or other PHI into this demonstration application.

What this repository currently demonstrates

  • The patient sign-in screen uses demonstration behavior: submitting the form sets a client-side cookie rather than authenticating a verified user.
  • The project includes local SQLite development configuration and fictional seed data; this does not establish production hosting or data protection.
  • This repository does not provide evidence of an organization-approved risk analysis, workforce policies and training, vendor agreements, or an operational incident-response program.
  • Production identity management, authorization reviews, encryption and key management, security monitoring, backup recovery, and independent assessment must be designed and verified for the actual deployment.

Readiness checklist

These are review prompts, not claims that the controls are implemented. Document the owner, evidence, and review date for each item.

Administrative safeguards

  • Complete and maintain an organization-wide security risk analysis and risk-management plan.
  • Assign security and privacy responsibilities; train workforce members and review access when roles change.
  • Document incident response, contingency operations, and periodic backup restoration tests.

Physical safeguards

  • Define facility, workstation, and device access controls for every environment containing ePHI.
  • Control the movement, reuse, and secure disposal of devices and electronic media.

Technical safeguards

  • Require verified individual identities and appropriate authentication before access is granted.
  • Enforce role-based least-privilege access and review permissions regularly.
  • Protect ePHI in transit and at rest, including secure key management and production database configuration.
  • Record and review access and security events; protect audit records from unauthorized changes.
  • Use integrity protections, alerting, and tested recovery procedures for systems and data.

Privacy, vendors, and individual rights

  • Establish privacy policies for permitted uses, disclosures, authorizations, and minimum-necessary access.
  • Provide processes for applicable access, amendment, and accounting requests.
  • Identify vendors that handle ePHI, complete appropriate risk reviews, and execute required business associate agreements before sharing data.
  • Set and enforce retention, archival, and secure-destruction rules.

Breach response and ongoing assurance

  • Maintain a documented process to investigate suspected incidents, preserve evidence, assess impact, and meet applicable notification duties.
  • Perform independent security and privacy assessments, remediate findings, and repeat assessments when systems or risks change.
  • Keep evidence of approvals, training, access reviews, incident exercises, vendor agreements, and recovery tests.

Official guidance

Do not include patient information in support requests or issue reports.