Healthcare and regulated industries
Domain coverage for two of the roles in scope: a clinical trial management system with an AI protocol engine, and a healthcare platform normalising medical data to an international standard.
The technical work is ordinary senior backend engineering. What changes is that several practices stop being good hygiene and become obligations you must be able to evidence — and that a handful of domain terms (FHIR profiles, ALCOA+, BAA, CSA) are the vocabulary the interview is conducted in.
Files
| # | File | Covers |
|---|---|---|
| 01 | Healthcare data standards | HL7 v2, FHIR (R4 vs R5 vs R6), profiles, terminology (LOINC/SNOMED/RxNorm/ICD-10), OMOP CDM, CDISC |
| 02 | PHI, privacy and secure coding | HIPAA, GDPR, BAAs, de-identification, audit logging, where PHI leaks, LLMs on clinical data |
| 03 | GxP and validation | GCP/GMP/GLP, ALCOA+, 21 CFR Part 11, CSV and the risk-based CSA approach, validation vs CI/CD |
| 04 | Clinical document intelligence | protocol-to-workflow extraction, parsing, schema-constrained extraction, citations, pgvector, evaluation |
The three things that catch engineers out
- A BAA constrains your tool choices before you write code. Any third party touching PHI — cloud, LLM API, log aggregator, error tracker — needs one. This rules out several defaults.
- Audit logging is a functional requirement, not observability. Append-only, attributable, retained for years, and queryable for “did this person view this record”. A 14-day log retention fails an audit.
- No destructive updates on regulated records. Part 11 requires the previous value to survive. That is an append-only event log or bitemporal tables, decided at schema-design time.
Cross-references
- RAG, chunking, hybrid search, evaluation: ../../ai_ml/09_rag_embeddings/ and ../../ai_ml/13_evaluation/
- PII handling and the EU AI Act: ../../ai_ml/14_guardrails_safety/03_pii_privacy_and_compliance.md
- Application security: ../25_security/
- Secrets and configuration: ../../system_design/04_secrets_config/01_secrets_and_configuration.md
- Integration boundaries and anti-corruption layers: ../../system_design/01_api_integrations/01_integration_design.md
- Postgres and pgvector: ../08_databases/