Building HIPAA-Compliant Software: What It Actually Takes

Novos Leaf is a cannabis care platform that handles protected health information, which means it lives under HIPAA — a law most software teams cite and few have actually engineered against. Compliance isn't a certificate you buy or a checkbox in a framework. It's layered engineering, and every layer has to hold.

Layer 1: Access control

HIPAA's foundation is the question 'who can see this, and why?' — answered per role, per record, enforced by the server. Novos Leaf implements role-based access with least privilege: authentication with mandatory session limits, authorization checks on every request (not just every page), and automatic timeout on idle sessions. The rule that matters: access decisions live on the server, never in the interface. Hiding a button is not access control.

Layer 2: Encryption everywhere

PHI is encrypted at rest with AES-256 and in transit with TLS. The subtler discipline is coverage: backups, logs, exports, and caches are all places PHI leaks out of the 'encrypted database' story. A compliant system treats every copy of data as data — including the ones created by accident.

Layer 3: The audit trail

HIPAA requires knowing who accessed what, when. Every PHI access and modification in Novos Leaf is logged with actor, action, and timestamp — and audit logs must be harder to alter than the records they protect, because the first move of a bad actor with admin access is editing the log. Tamper-evidence isn't paranoia; it's the requirement done honestly.

Layer 4: Minimum necessary

The least glamorous rule is the most architectural: each role sees only the information its job requires. A scheduler doesn't need clinical notes; a billing role doesn't need the full chart. Building 'minimum necessary' means designing views, queries, and APIs around roles from the start — retrofitting it onto a system that returns whole records everywhere is a rewrite wearing a patch.

What compliance buys

Done right, HIPAA engineering isn't overhead — it's the moat. Regulated industries have fewer competitors precisely because this work is hard, and trust is the product feature that compounds. We build to healthcare standards because that's where software that matters gets to operate. Novos Leaf runs at novosleaf.com.