Thyra Blog
HIPAA, data security architecture, and privacy-first design.
The EU's ProtectEU strategy has reignited the encryption backdoor debate. Here is why mandated backdoors are structurally incompatible with HIPAA's Security Rule, and what US clinics should track.
RBAC controls who can open a chart. Audit log monitoring catches employees who technically can but shouldn't. Here's what IT admins should require from an EHR vendor.
RBAC misconfiguration in shared endocrinology/primary care EHRs causes both HIPAA exposure and clinician friction. Here's how IT admins should structure roles, scopes, and audits.
AI can draft SOC 2 and ISO 27001 policy language fast, but evidence validation, control testing, and auditor sign-off still require human review. Here's where the line sits.
A practical guide for IT admins on what happens to patient audio after ambient AI scribe transcription, including retention windows, model training risk, and the exact contract language to demand.
AI hallucinations in clinical workflows pose significant patient safety risks. Essential prevention strategies include data grounding, deterministic rules, and audit trails.
HIPAA compliance is not a checkbox. For cloud-native EHRs, it requires deliberate architecture decisions around encryption, access control, and audit logging.
Keep exploring
