Security, Consent, Audit & Governance
RBAC, treatment-relationship access, consent and audit-trail design.
Access to a patient record is governed by two independent layers, and both must pass: RBAC decides what a role is allowed to do (register a patient, record an encounter, resolve an MPI candidate); consent + treatment relationship decides whether a specific organisation may see a specific patient's record right now. A doctor role doesn't unlock every patient — it unlocks the doctor actions, gated per-patient by the second layer. This distinction is demonstrated live on the cross-organisation access screen.
Layer 1 — RBAC matrix
Layer 2 — Consent & treatment-relationship access
AuditEvent catalogue
Every entry in this catalogue is a real, filterable action type on the live audit trail — nothing here is aspirational.
Encryption & transport
TLS in transit; encryption at rest on the database and any object storage. Standard for a pen-test-ready deployment.
Penetration testing
An external pen-test, arranged by the client, is supported by this design. Remediation of findings outside Phase-1 scope is handled as a separate request (SOW §9.7).