Clinic records app security checklist

• Every PHI read passes three checks: org RLS, role-to-column permission, and treating relationship (care_team_members) or an active break-glass session; denied attempts are logged. No endpoint accepts a patient id without all three.
• Sessions idle out after 15 minutes, MFA is required for clinical roles, step-up auth is required for exports and break-glass, and a shared workstation mode clears cached data on logout.

• Every access to PHI (view, search, export, print, sign) writes a hash-chained phi_access_log row in the same transaction; PHI values never appear in logs, error messages, analytics events or URLs.
• Every vendor that can store or process PHI (hosting, email, SMS, storage, error tracking) requires a signed BAA before it is enabled; vendors without one are excluded from PHI paths and receive only de-identified data.

• Direct identifiers and note bodies are encrypted at column level with per-organisation data keys (key id stored with the row), TLS 1.2+ in transit, encrypted volumes and backups; search over identifiers uses HMAC blind indexes.
• Minimum necessary: list views return only name, MRN and age band; full demographics and notes require opening the chart; the patient portal shows only results released by a clinician.

• Clinical documents are type- and size-validated, scanned before they are visible, stored under non-guessable keys, and served only via short-lived signed URLs that are themselves logged.

• Detect and alert on snooping patterns: celebrity or colleague charts, many charts per hour, access outside shift, after-hours exports; repeated denied attempts lock the account for review.

• HIPAA Privacy, Security and Breach Notification Rules (applies to US patients): Generated software supports the technical safeguards (access control, audit controls, integrity, transmission security) but compliance is an organisational duty of the covered entity or business associate: risk analysis, workforce training, policies, BAAs and a breach process are required. Breach of unsecured PHI has notification deadlines (60 days in the US).
• Business associate agreements (applies to always): Hosting, storage, email, SMS and monitoring subprocessors that can touch PHI need a signed BAA; do not send PHI to a vendor without one. Prefer designs where PHI never leaves the tenant database and bucket.
• Record retention: Medical records are retained for years (commonly 6-10, longer for minors) which overrides erasure requests for those records; pseudonymise where law allows, otherwise restrict processing.
• GDPR special-category data (applies to EU patients): Health data needs an Article 9 basis, a DPIA and data-subject access/portability; the consent and disclosure tables support these.
• Medical device and clinical decision support (applies to any AI or alerting feature): Features that diagnose or recommend treatment can make the software a regulated medical device; phase 1 records and displays information and does not give clinical advice.
• Telehealth and licensing (applies to telehealth): Video visits must use a BAA-covered provider and respect provider licensing across jurisdictions.

• reminder messages per day: hard in-code ceiling per organisation per day; reminders refuse at 100% and alert at 90%.
• record exports per patient month: capped exports per patient per month; further requests need approval.
• document storage gb per org: per-organisation storage quota; uploads refused at the quota.
• ai summarisation budget: if any AI summarisation is added it runs only on de-identified text under a per-organisation monthly token cap that fails closed.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a clinic records app?

Every PHI read passes three checks: org RLS, role-to-column permission, and treating relationship (care_team_members) or an active break-glass session; denied attempts are logged. No endpoint accepts a patient id without all three.

Does a clinic records app have compliance obligations?

HIPAA Privacy, Security and Breach Notification Rules, if you have US patients: Generated software supports the technical safeguards (access control, audit controls, integrity, transmission security) but compliance is an organisational duty of the covered entity or business associate: risk analysis, workforce training, policies, BAAs and a breach process are required. Breach of unsecured PHI has notification deadlines (60 days in the US). This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a clinic records app
• Clinic records app architecture
• Example prompt for a clinic records app
• Clinic records app scaling checklist
• Often combined: booking system
• Often combined: SaaS dashboard
• All app types