reference/security.md

15. Security Architecture

The security architecture the MVP build implements, covering network topology, data protection, threat model, access controls, and the assurance roadmap. Written to support hospital IT security reviews and investor diligence; anything marked planned is a commitment with a gate, not a completed certification.

15.1 Platform Threat Overview (likelihood & control status)

Status reads DESIGNED-IN where the control is specified in the MVP build (phases 01–14) and enforced by its definition of done; nothing on this page claims a completed external audit.

Threat	Likelihood	Control	Status
PHI data breach	HIGH	AES-256 field-level encryption, PHI vault isolation, no PHI in logs, BAA with all vendors	DESIGNED-IN
API injection / SSRF	MEDIUM	WAF with OWASP ruleset, input validation at API Gateway, parameterized queries, SSRF blocklist	DESIGNED-IN
LLM prompt injection	MEDIUM	Structured output schema enforcement, 7-gate post-processing validation, human review flag for anomalous outputs	DESIGNED-IN
Credential compromise	MEDIUM	AWS Secrets Manager with auto-rotation, no hardcoded secrets, MFA enforced for all admin access, least-privilege IAM	DESIGNED-IN
DDoS / availability	LOW	AWS Shield Standard + Advanced, CloudFront CDN, auto-scaling ECS Fargate, rate limiting at API Gateway	DESIGNED-IN
Insider threat	LOW	Role-based access control, immutable audit log, no single person can access PHI vault + audit logs simultaneously, background checks	DESIGNED-IN
Third-party vendor breach	MEDIUM	BAA with every PHI-touching vendor (AWS including Bedrock with zero-retention inference, Twilio), annual vendor security review, data minimization, non-BAA vendors receive no PHI	PLANNED

15.2 Review Threats → Controls (all 13)

Threat	Primary Controls (sections)
1 Activation-link interception	Single-use 72 h token, zero-PHI pre-verify, DOB+possession, lockout, WAF rate limit (§9.1).
2 Clinician link forwarding	Device-bound grants, OTP on new device, geo/device anomaly re-challenge, short expiry (§9.3).
3 Cross-tenant access	tenant_id on every row + session filter + composite indexes; authz object checks; pen-test case.
4 Excessive employee access	Break-glass only, time-boxed, dual-notified, fully audited; quarterly access reviews (§9.4).
5 Prompt injection in documents	Data/instruction separation, offset entailment, GS-12 gate, sandboxed drafting (§11.5).
6 Agent overreach	Policy envelopes, tool allowlists, evidence-not-state pattern, kill switches (§12).
7 Model data leakage	Bedrock BAA + zero retention, no PHI in third-party telemetry, registry-pinned models (§9.6, 11.6).
8 SMS disclosure	No-PHI payload rule + CI template lint; lock-screen-safe copy (§13.2).
9 Tampered source documents	Fingerprints, signed VPN/mTLS channel, finality checks, provenance immutability (§10).
10 Audit-log alteration	INSERT-only DB role, monthly partitions, S3 Object-Lock compliance archive (§6.4, ADR-018).
11 Ransomware / data loss	PITR, cross-AZ, versioned KMS buckets, quarterly restore drills, IaC rebuild (§5.4).
12 Vendor compromise	BAA inventory (AWS, Twilio, Sentry-scrubbed), least-scope API keys, 90-day rotation, vendor review in Phase 0.
13 Enumeration via recovery	Uniform failure responses, silent lockouts, ops alerting (§9.1).

15.3 Access Control Model

Patient

SMS link opens the Today PWA: no app store, no password, DOB verification, single-use 72 h token. No PHI in the SMS payload itself; consent captured in the verified session.

Care Coordinator

Clinical review console with MFA. Cohort-scoped read access and review-queue actions only; no direct database access. Hospital IdP SSO (SAML 2.0) on the enterprise roadmap.

Physician

Receives the 60-second brief via secure link: no account, device-bound grant, step-up verification before any confirmation. Every open and action is audit-logged. No EHR write-back in the MVP (read-mostly by design).

Hospital Admin

Read-only analytics API access. Can query aggregate outcomes and HRRP metrics. No access to individual patient records. Scoped JWT tokens.

Travi Engineering

Zero standing access to production PHI. Break-glass access requires dual approval + is logged immutably. Prod access reviewed quarterly.

Compliance Officer

Read-only access to audit logs and access reports. Can trigger access reviews. Cannot modify data. Separate audit-only IAM role.

Penetration Testing & Vulnerability Management (roadmap)

Third-party penetration test on the activation, clinician-grant, and tenant-isolation paths is a pre-pilot gate: no pilot go-live with unresolved critical or high findings, then annual retests. Continuous dependency and container scanning (AWS Inspector, Snyk) runs from the first CI pipeline in Phase 01. CVE patching SLA targets: critical within 24 h, high within 7 days.

See also: FHIR R4 Data Flow, for how PHI moves through the pipeline, and Product Cycle Diagram, for the end-to-end episode execution flow.

15.4 Cryptography & Audit

Transit TLS 1.2+ everywhere incl. VPC-internal ALB→task; at rest AES-256 via KMS CMKs (RDS, S3, Redis, EBS); JWTs ES256 with 90-day key rotation and kid-based rollover.
Audit event fields: actor_type/id, on_behalf_of, action, object_type/id, purpose, context (diff hash), ip, user_agent, trace_id, occurred_at. Every PHI read API emits one; every state transition emits one; export jobs emit per-object events (SEC-003, DQS-001).
Logging: structlog processors strip configured PHI fields; Sentry before_send scrubber; log retention 13 months (non-PHI).

15.5 Compliance Roadmap

Phase 0: BAAs executed (AWS, Twilio), security risk assessment, vendor review, policies (access, incident, retention). Phase 2–3: SOC 2 Type I evidence collection (Vanta or equivalent), pen test on activation/grant/tenant paths. Pilot go-live gate: zero unresolved critical/high findings; incident-response and clinical-routing procedures rehearsed (matches the PRD definition of done).