PHI handling
What patient information HealthyRides collects, where it is kept, and where it never goes.
What is collected
A facility records the patient a ride is for: name, sex, date of birth, preferred language, home address, the medical record number its own records use, height, weight, phone, medical notes and mobility needs (platform/packages/domain/src/patients/entities.ts).
A ride adds what the trip needs: the pickup and drop-off, the transport requirements, the diagnosis list for the trip, and the payer with its member ID (docs/prd/healthyrides-mvp-prd.md).
Patients belong to one facility organization. A patient record is never shared with another facility organization (docs/prd/healthyrides-mvp-prd.md; see Tenant isolation).
Where it is stored
PHI is stored in one PostgreSQL database per environment, on Google Cloud SQL in the production project, reachable on a private network address only (infrastructure/modules/cloud-sql/main.tf).
Production runs in Google Cloud's us-central1 region (infrastructure/environments/prod/terraform.tfvars).
Development and production are separate Google Cloud projects, with separate networks, service accounts, secrets and databases (docs/decisions/0002-three-project-topology.md). Environments other than production use synthetic data only (README.md).
Who at HealthyRides can read it
A HealthyRides staff member signed in to the app reads no patient field: the platform screens show disputes, credentials, onboarding and deletion requests by organization and reference only (docs/decisions/0025-platform-admin-through-a-platform-organization.md).
An engineer reaches the production database only through one command that keeps the database password out of every log and transcript. A read runs as a database role that can only select, and every production run needs its own approval (docs/decisions/0029-ad-hoc-sql-runner.md). Production PHI leaves production only as the output of such an approved run (README.md).
Where it never goes
PHI never appears in logs: no names, dates of birth, phone numbers, addresses, medical notes or tokens (README.md). The logger masks those fields by name before a line is written, at any depth (platform/packages/observability/src/redaction.ts).
PHI is kept out of notification payloads, URLs, analytics events and error reports, and the rider survey text message carries no clinical content (docs/prd/healthyrides-mvp-prd.md).
Scheduled report emails carry figures for the organization, never a row about a patient (docs/decisions/0045-scheduled-report-emails-carry-aggregates-only-and-are-sent-as-the-recipient.md).
Deletion on request
A facility can ask for a patient's record to be erased. A HealthyRides platform administrator approves or rejects the request. On approval the patient's PHI is erased, on the patient and on its rides, including ride messages and dispute notes, and the de-identified ride record is kept so scores and reports stay whole (docs/decisions/0049-patient-erasure-redacts-ride-messages-and-dispute-notes.md; docs/prd/healthyrides-mvp-prd.md).
Otherwise, PHI is kept while the organization is active. When the business associate agreement ends, HealthyRides returns or destroys it within 90 days (platform/packages/domain/src/agreements/texts/baa-v2.ts).