# HIPAA-aligned engineering checklist

A practical engineering checklist for PHI boundaries, access, audit trails, logging, integrations, recovery, and operational ownership.

This is an engineering readiness aid, not legal certification. It makes technical controls and evidence visible so the right compliance specialist can evaluate them.

## PHI inventory and boundaries

Know where sensitive data exists.

- [ ] PHI fields, stores, queues, logs, and exports are inventoried
- [ ] Data minimization and retention are explicit
- [ ] Non-production data is de-identified or synthetic

## Access control

Enforce least privilege.

- [ ] Workforce and patient identities are separated where needed
- [ ] Every PHI access path is authorized server-side
- [ ] Emergency and administrative access is reviewed

## Auditability and logging

Record access without copying PHI.

- [ ] Access and high-risk changes create durable audit events
- [ ] Application logs exclude PHI by default
- [ ] Alerts identify unusual access without exposing records

## Encryption and integrations

Protect every handoff.

- [ ] Encryption is defined in transit and at rest
- [ ] Vendors and integration scopes are inventoried
- [ ] Tokens, webhooks, and file transfers have rotation and retry plans

## Recovery and operations

Prove the product can be operated safely.

- [ ] Backups and restore procedures are tested
- [ ] Incident roles and notification paths are documented
- [ ] Production access is time-bound and reviewable

## Evidence to keep

- PHI data-flow diagram
- Access-control and audit-log samples
- Vendor and integration inventory
- Backup, restore, and incident test results