backend / README.md

Healthcare and regulated industries

1 min read index source

Healthcare and regulated industries

Domain coverage for two of the roles in scope: a clinical trial management system with an AI protocol engine, and a healthcare platform normalising medical data to an international standard.

The technical work is ordinary senior backend engineering. What changes is that several practices stop being good hygiene and become obligations you must be able to evidence — and that a handful of domain terms (FHIR profiles, ALCOA+, BAA, CSA) are the vocabulary the interview is conducted in.

Files

# File Covers
01 Healthcare data standards HL7 v2, FHIR (R4 vs R5 vs R6), profiles, terminology (LOINC/SNOMED/RxNorm/ICD-10), OMOP CDM, CDISC
02 PHI, privacy and secure coding HIPAA, GDPR, BAAs, de-identification, audit logging, where PHI leaks, LLMs on clinical data
03 GxP and validation GCP/GMP/GLP, ALCOA+, 21 CFR Part 11, CSV and the risk-based CSA approach, validation vs CI/CD
04 Clinical document intelligence protocol-to-workflow extraction, parsing, schema-constrained extraction, citations, pgvector, evaluation

The three things that catch engineers out

  1. A BAA constrains your tool choices before you write code. Any third party touching PHI — cloud, LLM API, log aggregator, error tracker — needs one. This rules out several defaults.
  2. Audit logging is a functional requirement, not observability. Append-only, attributable, retained for years, and queryable for “did this person view this record”. A 14-day log retention fails an audit.
  3. No destructive updates on regulated records. Part 11 requires the previous value to survive. That is an append-only event log or bitemporal tables, decided at schema-design time.

Cross-references