Tech Lead · Healthcare · Regulated
Catching a HIPAA risk before it shipped
I found a HIPAA compliance gap on a platform that handled health data for more than 200 medical practices, and led the work to re-architect around it.
200+ medical practices servedHIPAA compliance safeguarded1 risk caught & re-architected
Problem
The platform handled protected health information (PHI) for over 200 practices, and one of our architecture decisions meant we were handling that data in a way HIPAA doesn't allow. Nobody had caught it yet.
Constraints
There was no room for error with PHI, the system was already live with real practices depending on it, and the rest of the team was still shipping features. The fix couldn't slow everyone down.
What I did
- Followed the data to find exactly where PHI was ending up where it shouldn't
- Designed a focused re-architecture instead of a risky full rewrite
- Planned the migration so live practices wouldn't feel it
- Got product, engineering, and compliance on the same page about the trade-offs
Outcome
We closed the gap, and the approach we used became how the team handled PHI from then on.
What I took from it
The hard part wasn't really the code. It was noticing a risk no one else had flagged, then fixing it without stopping the roadmap or worrying 200+ customers. That kind of judgment is the part of security work I care about most.
