Security
Security-focused architecture, not a certified production system
The demo models privacy-by-design engineering patterns for a multi-tenant practice platform. It is not HIPAA certified and does not implement production OAuth.
Not HIPAA certified. Not production identity.
The demo models security-focused, privacy-by-design patterns. Sign-in uses a mock identity provider. It is not production OAuth 2.0 or OIDC with PKCE, and it is not a certified production healthcare system.
Implemented controls
Mock identity
Demo sessions via the existing mock IdP, with opaque bearer sessions. Not production OAuth or OIDC.
Refresh-token rotation and idle expiry are in the demo session model.
Implemented pattern
RBAC and resource authorization
Role and permission checks in the API. Frontend checks are UX only; Nest is authoritative.
Identity, then tenant, then role, then permission, then resource.
Implemented pattern
Tenant isolation
Practice-owned records are scoped server-side. Browser-supplied tenant IDs are not trusted.
Tenant scoping in services plus PostgreSQL RLS on business tables.
Implemented pattern
Audit events
Sensitive operations emit audit events. Administration includes an audit viewer. Synthetic data only.
Auth, patient, document, appointment, telehealth, and billing actions.
Implemented pattern
PostgreSQL RLS
Row-level security on tenant-owned tables, with a least-privilege application database role.
Runtime uses medconnect_app, not the table-owner role.
Implemented pattern
Document ACL
Authorized list and download of patient documents, with access audited. Local store; not S3/KMS.
PDF, PNG, and JPEG up to 5 MiB after type checks.
Implemented pattern
Authorization model
Frontend checks are UX only. Nest authorization is authoritative.
Identity
Mock IdP session
Practice / tenant
Server-resolved boundary
Role
Practice and platform roles
Permission
Grant catalog in the API
Resource
Ownership or assignment
What is not in this demo
Production OAuth
OAuth 2.0 / OIDC with Authorization Code + PKCE is the target identity model, not this demo.
Do not describe mock identity as production OAuth.
Not shipped
Production MFA
Live /login completes a labeled mock MFA challenge. Production TOTP or WebAuthn is not implemented.
Do not describe mock MFA as production MFA.
Not shipped
Hosted production
Encryption at rest, edge TLS, and cloud deploy are later infrastructure.
Do not claim a hosted production or AWS deployment.
Not shipped
HIPAA certification
This demonstration is not HIPAA certified or suitable for real patient data.
Use qualified language: security-focused architecture, synthetic demo data.
Must not claim
Explore with mock identity
Sign in at /login. Synthetic data only. No hosted production and no HIPAA certification claim.