HealthyRides

Sub-processors

The outside services HealthyRides uses, what each receives, and which of them handle PHI.

This list is taken from the services the production configuration switches on and the adapters in the code, not from contracts (infrastructure/environments/prod/main.tf; platform/packages/integrations/src/factory.ts). Every sub-processor that receives PHI must sign a business associate agreement with HealthyRides before it receives any (platform/packages/domain/src/agreements/texts/baa-v2.ts). See Business associate agreements.

Services that handle PHI

  • Google Cloud hosts the application, the database, the task queues, the storage buckets and the logs, in its us-central1 region (infrastructure/environments/prod/main.tf; infrastructure/environments/prod/terraform.tfvars).
  • Amazon Web Services, Simple Email Service (SES) sends the app's email from a dedicated sending subdomain. It receives each recipient's address and the message (docs/decisions/0006-aws-ses-transactional-email.md; infrastructure/environments/prod/main.tf). No email carries a patient field: one about a ride names it by its reference. SES is listed with the services that handle PHI as a precaution, and is required to be covered by a business associate agreement all the same (platform/packages/domain/src/notifications/content.ts; platform/packages/domain/src/agreements/texts/baa-v2.ts).

Identity

  • WorkOS signs people in and holds each staff member's account: name, email, organization and roles (docs/decisions/0010-workos-is-the-system-of-record-for-identity.md; docs/decisions/0038-the-workos-adapters-live-in-a-package-only-web-depends-on.md). The app sends it no patient record.

Built, and not switched on in production

  • Twilio would send text messages to staff and to consenting patients, and so would receive their phone numbers. The adapter is built and stays off until it is configured, and production's configuration does not switch it on today (docs/decisions/0022-twilio-for-sms.md; infrastructure/environments/prod/main.tf).
  • Resend is a second email adapter kept as a fallback; production sends through SES instead (docs/decisions/0006-aws-ses-transactional-email.md; infrastructure/environments/prod/main.tf).

Services that receive no PHI

  • The US Census Bureau geocoder turns a facility's business address into map coordinates. It is given facility addresses only, never a pickup address or anything about a patient (platform/packages/integrations/src/geocoding.ts; infrastructure/environments/prod/main.tf).
  • Google Cloud Text-to-Speech voices the narration of this site's videos, which show invented data only (docs/decisions/0052-the-docs-site-and-media-cdn-are-public-non-phi-services.md).