When we build for care settings, the hardest questions are never about encryption. They are about who is allowed to see what, how you prove it afterwards, and how a clinician gets to the record they need at three in the morning without a workaround.
Access is a clinical decision, not a technical one
Roles get drawn with the people who do the work, not by an engineer guessing. Then the rules are enforced in the database itself, so nothing depends on remembering to check in the interface.
- —Every record belongs to an organisation, and the rule is enforced at the data layer.
- —Least privilege by default, with a written reason for every exception.
- —Every read and write of sensitive data leaves a record you can query.
- —Time limited links for documents, never a permanent public address.
- —A rehearsed answer for the day something is exposed.
Records, so you can prove it
If you cannot show who saw a record and when, you cannot answer a complaint or an audit. That means logging as a product feature, retained for as long as your obligations demand and no longer.
The worst day
Assume a device is lost, a password is reused and a supplier is compromised. Design so that each one is contained: short sessions, scoped keys, revocation you can perform in minutes, and backups you have actually restored from.
A safe system is one where the easy path is also the correct one.
How we judge a clinical build
None of this slows a product down if it is decided in the first week. Retrofitted, it costs several times as much and it never quite fits.