Confidential records — isolation and audit

Clinical practice prototype

A working prototype of the isolation and audit design needed where confidentiality is contractual rather than optional.

Sheet
W-04
Title
Case study
Issued for
Information
Drawn by
Snilld

Sheet W-04 · Confidential records — isolation and audit · Healthcare

Prototype
A tenant isolation panel for an invented polyclinic: the session is marked isolated, with its workspace, tenant key and host, and no other workspace loaded.
01 / 05One session, one workspace
A read from another clinic’s workspace shown as SQL, returning zero rows, with a note on why the answer is zero rows rather than permission denied.
02 / 05Another clinic’s records: zero rows
Sealed session notes behind a PIN, with the ciphertext the database actually stores and a note on how production would harden the key.
03 / 05Sealed; the database holds only ciphertext
An unsealed session note for an invented client, with a symptom trajectory chart and a working formulation, visible only to the clinician.
04 / 05Unsealed for the clinician alone
An append-only audit trail of three rows: the notes decrypted, a session note encrypted and saved, and the sign-in, each with its time, actor and workspace.
05 / 05Who saw what, and when

Demo data. Every name and number is invented.

Goes in
A session note, in a practice that cannot treat records casually
What we built
Per-tenant scoping, encrypted notes, and an append-only audit trail
Comes out
A record whose history can be shown rather than asserted
The line it does not cross
A correction is a new entry. Nothing is overwritten.

Note 1 · The constraint

An independent practice carries a documentation burden but cannot accept a tool that treats patient records casually. The interesting question is not whether a model can draft a note. It is whether the surrounding system can prove who saw what, and when.

Note 2 · What we built

Per-tenant scoping so one practice can never read another, encrypted session notes, and an append-only audit trail where corrections are added rather than overwritten. This is a prototype: it demonstrates the design, and its stored state is simulated rather than a production database.

Note 3 · What transfers

The same design applies wherever confidentiality is a contractual obligation — legal files, HR records, financial casework, anything covered by a data processing agreement.

Stage
Prototype. Storage simulated.
Audit model
Append-only
Isolation
Per-tenant scoping
Not claimed
Production security
← All work

Start with a prototype

Two to four weeks working from your own files, and at the end you hold something real. It is the cheapest way to find out whether any of this applies to you.

Start with a prototype