From 9133acf34d537b41f31fc55a5e4e3eaaaa6453a4 Mon Sep 17 00:00:00 2001 From: sososttil Date: Mon, 27 Jul 2026 04:53:56 -0400 Subject: [PATCH] Flag the patient_id PHI dispute and a stale readiness row Three corrections, none of which resolve a question that belongs to counsel. - PHI Architecture: the bullets accurately describe an architecture that excludes direct identifiers, but they do not establish that Signal is PHI-free and were being read that way. An internal account number is one of HIPAA's 18 identifiers. context/current-state.md said the opposite outright. Both now carry a matching DISPUTED flag pointing at each other, with instructions to build to the more restrictive reading until Clyde Mathes replies. Deliberately not resolved here. - Attorney rows named Bittinger/Nixon. The bundle went to Clyde Mathes ~2026-07-23. - Readiness table: it reads 13/13 and "100% pilot-ready" as of 2026-06-16, but the row "Demo login / controlled access working: PASS" is contradicted by the CLERK LOGIN thread dated 2026-07-07 recording that sign-in fails. Added a warning not to quote the percentage externally until that row is re-tested. Re-counting a table doesn't help when a row has gone stale. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011bZhDfpTgToFvDX1CDE8oh --- CLAUDE.md | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 0a07f76..5ce0745 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -31,6 +31,17 @@ and stays predictable. quantity, payer — NOTHING else - All logs use hashed patient_id, never raw +**DISPUTED, awaiting counsel (flagged 2026-07-26).** The bullets above describe an +architecture that excludes direct identifiers, and that is accurate. They do NOT +establish that Signal is therefore PHI-free, and must not be read that way. An +internal account number is one of HIPAA's 18 identifiers, so `patient_id` itself +may be PHI. The attorney bundle sent to Clyde Mathes ~2026-07-23 asks this exact +question and the answer governs. Until it returns, build to the more restrictive +reading: treat `patient_id` as potentially PHI. Cross-reference: +`context/current-state.md` Stack section carries the matching flag. +Never state externally that Signal is HIPAA compliant, holds no PHI, or needs no +BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md:51`. + ## Current Stack (Updated 2026-06-22) - Backend: Railway (Python/FastAPI) — live at @@ -79,6 +90,16 @@ Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Project ### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13) +> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has +> not been re-verified since. The row "Demo login / controlled access working: PASS" +> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md` +> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app +> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug +> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready" +> to anyone external.** The file's own instruction below says to re-count before +> quoting a percentage; re-counting is not enough if a row is stale, so re-test the +> login row specifically. + | Checklist Item | Status | |---|---| | App hosted behind stable URL | PASS — (deployed 2026-05-29) | @@ -132,8 +153,8 @@ This checklist tracks compliance gates separately from build readiness. Update i | Privacy Policy published at stable public URL | PASS — privacy-policy.md written 2026-06-07; Privacy.jsx deployed to | | FDA CDS exemption memo written and attorney-reviewed | NOT DONE | | Supabase plan tier confirmed (Pro vs Team) and PHI posture documented | PASS — Pro plan confirmed 2026-06-10 ($25/mo). HIPAA available as paid add-on on Team ($599/mo) — deferred to post-funding per Real PHI gate. Pro is correct posture for pilot. | -| Pilot LOI reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending | -| NDA template reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending | +| Pilot LOI reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, bundle sent ~2026-07-23, reply expected within days** (corrected 2026-07-26; the prior "Bittinger/Nixon review pending" note was stale) | +| NDA template reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, same bundle, sent ~2026-07-23** (corrected 2026-07-26) | | Pilot LOI executed with supplier | NOT DONE | | NDA executed with supplier | NOT DONE | | Minimum necessary field documentation written (why each of 5 fields is required) | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |