Security and governance
Built for the institutions that answer to regulators
Patient data is designed to be held under national law, not a vendor's terms. The governance model is designed to be inspected — by a hospital board, a data protection authority, or a ministry procurement review.
Data residency
Designed to be deployed in-country where regulation or policy requires it. The sovereign deployment model is designed so patient data never has to leave the jurisdiction that governs it.
Encryption in transit and at rest
Designed for TLS on every connection and encryption at rest for the record store and backups, with key management separated from application access.
Least-privilege access
Role-based access scoped to facility and function, with break-glass access recorded and reviewable rather than silently permitted.
Immutable audit trail
Every read and write against a patient record is logged with actor, purpose and consent basis. The trail is queryable and cannot be edited after the fact.
Consent as a first-class object
Cross-facility access will be governed by recorded patient consent, with scope and expiry, not by whoever holds a login.
Exportable, never captive
A customer will be able to export their full record set in open formats at any time. Lock-in is not a retention strategy for national infrastructure.
Audit trail
HOS-DEMO-0142
- Time
- 10:03:52
- Actor
- Pharmacist · Illustrative pharmacy
- Action
- Read prescriptionHOS-DEMO-0142
- Purpose
- Dispensing
- Consent basis
- Patient consent, cross-facility
- Time
- 10:03:31
- Actor
- Emergency physician · Illustrative district hospital
- Action
- Read full recordHOS-DEMO-0142
- Purpose
- Emergency care
- Consent basis
- None on record
Break-glass. Flagged for review
- Time
- 10:02:58
- Actor
- Clinician · Illustrative clinic
- Action
- Read medication historyHOS-DEMO-0142
- Purpose
- Direct care
- Consent basis
- Patient consent, cross-facility
- Time
- 10:02:42
- Actor
- Lab technician · Illustrative district hospital
- Action
- Wrote lab resultHOS-DEMO-0142
- Purpose
- Direct care
- Consent basis
- Treating facility
- Time
- 10:02:14
- Actor
- Nurse · Illustrative district hospital
- Action
- Read vital signsHOS-DEMO-0142
- Purpose
- Direct care
- Consent basis
- Treating facility
Engineered to the standards national systems require
HL7 FHIR R4
Clinical data exchange
ICD-11 · SNOMED CT
Coded diagnoses and terminology
OpenHIE architecture
National exchange patterns
ISO 27001 controls
Information security baseline
Data residency
Set by national law
Standards HealthOS is built to. Formal certification follows first production deployment.