Compliance & Staff Operations — Integration

​

Overview

​

Integration Points

​

Platform Foundation (PF) Dependencies

• PF-08 (Forms Integration): Compliance checklists, audit forms
• PF-10 (Notifications): Compliance deadline reminders, non-compliance alerts, training expiry reminders
• PF-11 (Document Management): Compliance evidence, audit documents, training certifications

​

Consumer Core Dependencies (Downstream)

• RH-01 (Episodes): Episode records for compliance tracking
• RH-02 (Programs & Phases): Program compliance requirements
• RH-03 (Significant Events): Significant event reporting compliance

• HR (Workforce): Staff information lookup for assignments and training

​

Event Contracts

​

Event: rh_compliance_deadline_approaching

interface RhComplianceDeadlineApproachingPayload {
  event_type: 'rh_compliance_deadline_approaching';
  compliance_requirement_id: uuid;
  organization_id: uuid;
  due_date: date;
  days_until_due: number;
  timestamp: timestamptz;
}

​

Event: rh_non_compliance_detected

interface RhNonComplianceDetectedPayload {
  event_type: 'rh_non_compliance_detected';
  compliance_requirement_id: uuid;
  organization_id: uuid;
  residence_id?: uuid;
  non_compliance_reason: string;
  timestamp: timestamptz;
}

​

API Contracts

​

API: HR Employee Lookup

• Query parameter: employee_id (uuid, required)

interface HrEmployeeResponse {
  id: uuid;
  full_name: string;
  job_title: string;
  primary_site_id?: uuid;
  employment_status: string;
  organization_id: uuid;
}

​

Platform Integration Layer Usage

• PF-08 (Forms Integration): Compliance checklists, audit forms via @/platform/forms
• PF-10 (Notifications): Compliance deadline reminders, non-compliance alerts, training expiry reminders via @/platform/notifications
• PF-11 (Document Management): Compliance evidence, audit documents, training certifications via @/platform/documents

​

Security Considerations

​

Multi-Tenancy

• ✅ RLS Enforcement: All rh_compliance_* and rh_staff_* tables filtered by organization_id via RLS policies

​

Role-Based Access Control

• ✅ Compliance Officer: Create requirements, view all compliance data
• ✅ House Manager: Complete checklists, record shift notes
• ✅ Program Manager: Review compliance, approve corrective actions
• ✅ Staff: View assigned compliance items, record training

​

Data Protection

• ✅ PII Handling: Compliance data may contain PHI (resident references); access controlled via RLS
• ✅ Document Security: Evidence documents stored securely via PF-11
• ✅ Audit Logging: All compliance access logged via PF-04

​

Testing Requirements

• Event payload structure validation
• Event fires on trigger condition (compliance deadline approaching, non-compliance detected)
• Correct organization_id included in all events
• Subscribers handle events correctly (PF-10)
• HR employee lookup API works correctly
• RLS policies enforce org isolation on compliance and staff operations queries
• RBAC roles work correctly for different user types

​

References

• RH-06 Spec
• EVENT_CONTRACTS.md
• API_CONTRACTS.md
• CROSS_CORE_INTEGRATIONS.md