Skip to main content

Security & Compliance

Ready Practice handles PHI for tens of thousands of patients across hundreds of clinics. This is the section a healthcare buyer scrutinizes hardest — and one with real gaps.

HIPAA — the operating rules (from CLAUDE.md)​

All health data is PHI. The enforced rules:

  • PHI is never logged to console / Cloud Logging.
  • Permission checks before accessing patient data.
  • No PHI in error messages.
  • AI/LLM: user opt-in required (preferences.llmOptIn), HIPAA-aware prompts, no training on patient data.
  • Audit trail for significant operations via the transactions collection.

Multi-tenant isolation​

Data lives under clinicsv2/{clinicId}/.... Every access is scoped to a clinic; the permission model (Admin / Manager / Medical / Customer Service / Coach) gates health-data access — Customer Service explicitly has no health-data permission. Full model: CLAUDE.md (Permission Model section) and firestore-schema.

Config-drift monitoring (SOC2 CC6)​

configdrift_watch detects Cloud Run public-exposure (run.invoker) flips and alerts. Firebase redeploys can silently drop allUsers/run.invoker — a known operational hazard we monitor for.

PHI and the future knowledge base​

The per-clinic knowledge base (Knowledge Base Vision) is gated on a PHI-isolation design: per-tenant embeddings, zero cross-clinic retrieval, opt-in, no training. The retrieval is easy; the isolation is the real work, and it is not yet designed.

Gaps — significant

The customer-facing security page (security-and-compliance) is a brief checklist. Missing, and needed for a healthcare platform:

  • A HIPAA control mapping (which control → which enforcement in code/config).
  • BAA handling and a subprocessor list (a Trust Center rebrand exists — reconcile it here).
  • Data retention / deletion policy + runbook (right-to-be-forgotten).
  • Incident-response playbook (breach notification SLAs, escalation).

These are the highest-priority documentation gaps in the whole handbook.