"Enough to Reconstruct, Never Enough to Leak": The HIPAA Audit Log Design Problem
Enough to reconstruct, never enough to leak. The audit event schema problem under §164.312(b), and how to solve it without conflating the audit sink with the PHI sink.
#HIPAA
Posts about hipaa. ← All posts
PostgreSQL Row-Level Security Is HIPAA Defense in Depth
PostgreSQL row-level security as HIPAA defence in depth. Why fail-open application filtering isn't enough, and how 'append-only at DB GRANTs' carries more of the §164.312(b) burden than people realise.
Building a HIPAA-Aware Medical AI Platform in Go: An Architecture & Compliance Deep Dive
What HIPAA looks like when you express it as Go interfaces — governance policies, append-only audit at DB GRANTs, PHI redaction at the logger seam, and HITL as the §3060 CDS carve-out criterion 4.