What We Have Considered So Far About HIPAA
TIR Labs handles patient health data. That means HIPAA is not a consideration to defer: it shapes which vendors the product can rely on, which features should be constrained, and what has to be in place before real patients are involved.
The approach has been practical. Understand where sensitive data enters the system, identify which vendors and workflows create risk, and constrain the product before real patient data moves through unreviewed paths. A feature is not only a product decision. It can also be a compliance decision. If a feature spreads patient context to a new vendor, stores sensitive content carelessly, or opens a new data-access path, that matters before it ships.
The most concrete decisions so far have been about vendors. Resend has handled transactional email for magic-link and enrollment flows, but email is sensitive territory. Even an email address can become PHI in context. We flagged Resend as a service not to rely on for PHI-bearing workflows and are migrating to Amazon SES, which has a clearer HIPAA path. Fly and Neon are core infrastructure for the deployed app and database. BAA (Business Associate Agreement) status for both needs to be confirmed before real patient data enters production. That step is documented and pending. USDA FoodData Central supports nutrition lookup for meal logging, but free-text meal content can carry sensitive context. We blocked that path for any PHI pilot until the data flow is reviewed more carefully. Meal photo support was flagged for the same reason: photos can contain more than food, and the storage and access controls are not ready for that yet.
The next step is turning that awareness into stronger operational controls, confirmed vendor coverage, written risk analysis, PHI-safe logging, audit trails, and incident response documentation.
This is early work. But it is deliberate. The standard we are trying to hold is not to pretend we are finished. It is to be specific about the risks we see, conservative about the claims we make, and careful about which product choices determine where patient data goes.