PHI PROTECTION
HIPAA Coding Rules
Implement PHI access controls, purpose of use, minimum necessary, and audit evidence consistently.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
HIPAA Framework
HIPAA functionality should remain as isolated as possible under a dedicated src/hipaa framework with its own services, middleware, decorators, guards, interceptors, constants, types, configuration, database access layer, and tests.
Required Audit Context
| Topic | Standard |
|---|---|
| Provider ID | Identifies the tenant that owns the PHI. |
| Actor | Identifies the real user performing the action. |
| Target | Identifies the Individual, employee, user, or record affected. |
| Module and action | Describes the business workflow. |
| Purpose of use | Examples include Treatment, Payment, and Health Care Operations. |
| Access decision | Allowed, denied, or review required. |
| Minimum necessary | Compliant, potential excess, or review required. |
| Technical context | IP, device, browser, operating system, route, and request ID. |
Minimum Necessary
- Select only required database fields.
- Mask information in public documentation and non-production demonstrations.
- Restrict exports and printed output.
- Use role-specific views rather than universal PHI access.
- Do not include PHI in general application logs.