PHI inventory and boundaries
Know where sensitive data exists.
- PHI fields, stores, queues, logs, and exports are inventoried
- Data minimization and retention are explicit
- Non-production data is de-identified or synthetic
Resource 12 · Healthcare checklist
HIPAA-aligned engineering checklist
A practical engineering checklist for PHI boundaries, access, audit trails, logging, integrations, recovery, and operational ownership.
The working guide
Follow the evidence across the whole system.
This is an engineering readiness aid, not legal certification. It makes technical controls and evidence visible so the right compliance specialist can evaluate them.
Access control
Enforce least privilege.
- Workforce and patient identities are separated where needed
- Every PHI access path is authorized server-side
- Emergency and administrative access is reviewed
Auditability and logging
Record access without copying PHI.
- Access and high-risk changes create durable audit events
- Application logs exclude PHI by default
- Alerts identify unusual access without exposing records
Encryption and integrations
Protect every handoff.
- Encryption is defined in transit and at rest
- Vendors and integration scopes are inventoried
- Tokens, webhooks, and file transfers have rotation and retry plans
Recovery and operations
Prove the product can be operated safely.
- Backups and restore procedures are tested
- Incident roles and notification paths are documented
- Production access is time-bound and reviewable
Evidence to keep
Leave a record another person can verify.
- 01PHI data-flow diagram
- 02Access-control and audit-log samples
- 03Vendor and integration inventory
- 04Backup, restore, and incident test results
Choose the next useful step
Use the guide to define the first accountable decision.
We can review the evidence with your team and turn the gaps into a scoped plan without taking ownership away from you.