Why this matters
HIPAA requires access control and disclosure tracking to limit ePHI to authorized use.
Handlers must verify the requester’s role and a valid consent/relationship (e.g., care team assignment) before disclosing ePHI; include Purpose-Of-Use in the decision and audit the outcome.
HIPAA requires access control and disclosure tracking to limit ePHI to authorized use.
Side-by-side examples engineers can pattern-match during review.
get("/patients/{id}") { call.respond(repo.find(call.parameters["id"])) }get("/patients/{id}") { val id = call.parameters["id"]!!; require(authz.canView(user, id, call.request.headers["Purpose-Of-Use"])) ; audit.write(ReadPhi(user.id,id)); call.respond(repo.findView(id)) }respond(patient) // no authzif (authz.canView(user,id,pou)) respond(view)From the same buckets as this rule.
Before persisting ePHI, encrypt using a data key protected by a Key Management Service (KMS). Use authenticated encryption (AES-256-GCM or equivalent), rotate keys, and store the key id and algorithm with the record.
Never write Protected Health Information (PHI/ePHI) to logs. Redact fields like name, SSN, MRN, DOB, address, diagnoses, and lab results; store only non-identifying metadata and a stable request trace id. If logging is required for troubleshooting, replace values with consistent tokens and record access separately in the audit log.