Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Encore OS is in alpha (v0.9). Items marked as planned track on the changelog.
Evidence for intake screening and triage safeguards under HIPAA and 42 CFR Part 2.
| Control | Implementation | Evidence |
|---|---|---|
| PHI at rest | Supabase encryption; screening data in ce_screening_attempts and ce_screening_results | Tables created via migration with RLS |
| PHI in events | Event payloads contain only IDs and flags; no free-text clinical data | useCreateScreening.ts — payload construction excludes chief_complaint, notes |
| PHI in logs | No PHI logged; synthetic data in tests | Test files use Test-CE-28-* naming |
| PHI in errors | sanitizeErrorMessage() used in all user-facing error handlers | Component files use sanitized errors |
| Control | Implementation | Evidence |
|---|---|---|
| Consent capture | consent_obtained, consent_method, consent_recorded_at columns on ce_screening_attempts | Migration file |
| Consent gating on events | ce_screening_completed only published when consent_obtained === true | useCreateScreening.ts — conditional publish |
| Consent metadata in events | consent_recorded_at included in event metadata | Event payload construction |
| Consent UI | Form requires consent checkbox before submission | ScreeningForm.tsx — consent fields |
| Control | Implementation | Evidence |
|---|---|---|
| RLS on all tables | ce_screening_attempts, ce_screening_results, ce_screening_questionnaires, ce_screening_sla_config | Migration with ENABLE ROW LEVEL SECURITY + FORCE ROW LEVEL SECURITY |
| SECURITY DEFINER helpers | ce_can_view_screening() with REVOKE/GRANT pattern | Migration file |
| org_id on mutations | All hooks use .eq('organization_id', orgId) | Hook files |
| RLS tests | 4 test files covering all tables | tests/rls/ce-screening-*.rls.test.ts |
| Control | Implementation | Evidence |
|---|---|---|
| Permission gating | ce.screening.view, ce.screening.create, ce.screening.manage | Permission constants + seed migration |
| Route-level guards | <PermissionGate> on screening route | Route configuration |
| No hardcoded roles | Permission hooks used throughout | Component files |
Was this page helpful?
