[{"data":1,"prerenderedAt":779},["ShallowReactive",2],{"insight-hipaa-technical-safeguards-checklist":3,"insights-cards":670},{"id":4,"title":5,"body":6,"category":651,"date":652,"description":653,"extension":654,"meta":655,"navigation":548,"path":656,"readingTime":657,"relatedArticles":658,"relatedAssessment":662,"relatedServices":663,"seo":667,"stem":668,"__hash__":669},"insights\u002Finsights\u002Fhipaa-technical-safeguards-checklist.md","Reading 45 CFR 164.312 Like a Design Document: HIPAA Technical Safeguards for Engineers",{"type":7,"value":8,"toc":636},"minimark",[9,13,16,21,24,31,37,43,49,55,59,196,199,203,206,212,233,236,239,245,251,257,261,264,267,284,287,293,299,305,308,311,314,318,321,324,362,366,369,372,375,378,401,404,408,411,414,446,450,453,485,489,492,512,515,521,527,533,537,629,633],[10,11,12],"p",{},"The technical safeguards section of the HIPAA Security Rule is short enough to read in five minutes and vague enough to argue about for a year. It names outcomes and leaves the technology to you. The way to make it useful is to treat it as a requirements document: five standards, each of which turns into a small set of architecture decisions that you make once, write down, and can defend later.",[10,14,15],{},"This article is general information for engineering teams, not legal advice. Your organization's risk analysis and your counsel govern the specifics.",[17,18,20],"h2",{"id":19},"how-the-rule-is-put-together","How the rule is put together",[10,22,23],{},"A few structural points remove most of the confusion.",[10,25,26,30],{},[27,28,29],"strong",{},"It covers electronic protected health information."," The Security Rule is about ePHI: individually identifiable health information that is created, received, maintained or transmitted in electronic form. If your system stores or moves it, the rule is talking about your system.",[10,32,33,36],{},[27,34,35],{},"It applies to covered entities and to business associates."," Health plans, clearinghouses and most providers are covered entities. A vendor that handles ePHI on their behalf, such as a software company hosting a patient portal, is a business associate and is directly responsible for complying with the Security Rule, not only bound by contract.",[10,38,39,42],{},[27,40,41],{},"Standards and implementation specifications are different things."," A standard states what must be achieved. Some standards come with implementation specifications, which are more specific instructions. Two of the five technical standards have none at all.",[10,44,45,48],{},[27,46,47],{},"Specifications are either required or addressable."," Required means implement it. Addressable is the word that causes trouble, because it sounds like optional. It is not. For an addressable specification you must assess whether it is reasonable and appropriate in your environment. If it is, implement it. If it is not, document why and implement an equivalent alternative where that is reasonable. Silence is not one of the choices.",[10,50,51,54],{},[27,52,53],{},"The rule is deliberately technology neutral and scalable."," It has to fit a solo practice and a national insurer. So it lets you weigh your size, complexity, technical capabilities, costs and the likelihood and severity of risks. That flexibility is why the risk analysis matters so much: it is the document that justifies each choice.",[17,56,58],{"id":57},"the-whole-section-on-one-page","The whole section on one page",[60,61,62,81],"table",{},[63,64,65],"thead",{},[66,67,68,72,75,78],"tr",{},[69,70,71],"th",{},"Citation",[69,73,74],{},"Standard",[69,76,77],{},"Implementation specifications",[69,79,80],{},"Status",[82,83,84,99,110,122,133,147,160,172,185],"tbody",{},[66,85,86,90,93,96],{},[87,88,89],"td",{},"164.312(a)",[87,91,92],{},"Access control",[87,94,95],{},"Unique user identification",[87,97,98],{},"Required",[66,100,101,103,105,108],{},[87,102],{},[87,104],{},[87,106,107],{},"Emergency access procedure",[87,109,98],{},[66,111,112,114,116,119],{},[87,113],{},[87,115],{},[87,117,118],{},"Automatic logoff",[87,120,121],{},"Addressable",[66,123,124,126,128,131],{},[87,125],{},[87,127],{},[87,129,130],{},"Encryption and decryption",[87,132,121],{},[66,134,135,138,141,144],{},[87,136,137],{},"164.312(b)",[87,139,140],{},"Audit controls",[87,142,143],{},"None listed",[87,145,146],{},"Standard is required",[66,148,149,152,155,158],{},[87,150,151],{},"164.312(c)",[87,153,154],{},"Integrity",[87,156,157],{},"Mechanism to authenticate ePHI",[87,159,121],{},[66,161,162,165,168,170],{},[87,163,164],{},"164.312(d)",[87,166,167],{},"Person or entity authentication",[87,169,143],{},[87,171,146],{},[66,173,174,177,180,183],{},[87,175,176],{},"164.312(e)",[87,178,179],{},"Transmission security",[87,181,182],{},"Integrity controls",[87,184,121],{},[66,186,187,189,191,194],{},[87,188],{},[87,190],{},[87,192,193],{},"Encryption",[87,195,121],{},[10,197,198],{},"Note what the table says about encryption. Both encryption specifications, at rest under access control and in transit under transmission security, are addressable. In practice it is very hard to write a credible justification for leaving ePHI unencrypted on modern infrastructure, where encryption is a configuration setting. Treat both as things you will do.",[17,200,202],{"id":201},"access-control-164312a","Access control: 164.312(a)",[10,204,205],{},"The standard asks for technical policies and procedures that allow access only to the persons or software programs that have been granted access rights.",[10,207,208,211],{},[27,209,210],{},"Unique user identification (required)."," Every user gets an identifier that is theirs alone. This is the foundation for everything else, because audit logs are only meaningful if an action maps to a person. The usual violations are not in the application. They are around it:",[213,214,215,224,227,230],"ul",{},[216,217,218,219,223],"li",{},"A shared ",[220,221,222],"code",{},"admin"," login on the database.",[216,225,226],{},"One cloud console account used by the whole team.",[216,228,229],{},"A service account whose credentials three engineers use to run ad hoc queries.",[216,231,232],{},"A support tool where agents share a login.",[10,234,235],{},"The engineering fix is to federate everything to one identity provider, give humans individual identities everywhere including the database layer, and reserve service accounts for services. Where a human must act through a service identity, record which human.",[10,237,238],{},"Unique identity is necessary and not sufficient. The standard is about granted rights, so pair it with role-based access and least privilege: a billing clerk does not need clinical notes, and an engineer does not need standing read access to production data.",[10,240,241,244],{},[27,242,243],{},"Emergency access procedure (required)."," You need a documented way to obtain necessary ePHI during an emergency. People read this as disaster recovery, and it partly is. It also covers the case where normal authentication is unavailable and care or operations still need the data. The pattern that works is \"break glass\": a sealed, highly privileged path that requires a stated reason, alerts security the moment it is used, expires quickly and is reviewed afterward. An envelope holding one common credential, kept in a desk for bad days, technically counts as a procedure, yet it throws away unique identification at the exact moment you need it most.",[10,246,247,250],{},[27,248,249],{},"Automatic logoff (addressable)."," Sessions end after a period of inactivity. Apply it to every interface that reaches ePHI, not only the web application: admin consoles, database clients, remote desktop sessions, internal tools and mobile apps. Choose timeouts by context. A workstation in a shared clinical area warrants a much shorter timeout than a locked office.",[10,252,253,256],{},[27,254,255],{},"Encryption and decryption (addressable)."," This is encryption at rest: databases, object storage, file systems, backups, snapshots, laptops and removable media. The design questions are about keys more than algorithms. Who can use the keys? Are they separated from the data? Are they rotated? Is use of the key logged? Encryption where every workload and every engineer can decrypt everything protects against a stolen disk and little else. For the most sensitive fields, consider application-level encryption so that database access alone does not reveal them.",[17,258,260],{"id":259},"audit-controls-164312b","Audit controls: 164.312(b)",[10,262,263],{},"The standard requires hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI. It does not say which events, in what format or for how long. Your risk analysis decides.",[10,265,266],{},"A defensible baseline records, for each access to a patient record:",[213,268,269,272,275,278,281],{},[216,270,271],{},"Who (the unique identity, and the service on whose behalf if relevant)",[216,273,274],{},"What (which record, which patient, which fields or document)",[216,276,277],{},"Which action (viewed, created, changed, exported, deleted, printed)",[216,279,280],{},"When, and from where (timestamp, source address, device or session)",[216,282,283],{},"The outcome (allowed or denied)",[10,285,286],{},"Three mistakes account for most weak implementations.",[10,288,289,292],{},[27,290,291],{},"Logging writes and not reads."," In healthcare the most common misuse is looking at a record without a reason: a neighbor, a celebrity, a family member. If reads are not logged, that event is invisible.",[10,294,295,298],{},[27,296,297],{},"Logs that the people being logged can change."," An administrator who can edit the audit trail has no audit trail. Ship logs to storage with separate access, write-once retention where available, and alert on gaps.",[10,300,301,304],{},[27,302,303],{},"Logs nobody examines."," The standard says record and examine. A related administrative requirement calls for regular review of information system activity. Build queries that answer real questions (\"who viewed this patient in the last 90 days?\", \"which user viewed far more records than their peers?\") and make someone responsible for running them.",[10,306,307],{},"Retention is not specified for audit logs in this section. The Security Rule does require that documentation of policies and required actions be kept for six years, and many organizations align log retention with that. Decide a period, write down the reason, and check state law and contracts.",[10,309,310],{},"One caution that pairs with this section: the audit log should identify the record, and should not copy the record. Dumping full payloads into logs creates a second, less protected store of ePHI.",[10,312,313],{},"Timing drives the cost of this control more than anything else. Added early, it is a single layer that every read and write passes through. Added late, it means hunting down every query, report, export and background job that touches patient data.",[17,315,317],{"id":316},"integrity-164312c","Integrity: 164.312(c)",[10,319,320],{},"The standard is to protect ePHI from improper alteration or destruction. The addressable specification asks for electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.",[10,322,323],{},"This is a familiar engineering problem with familiar tools:",[213,325,326,332,338,344,350,356],{},[216,327,328,331],{},[27,329,330],{},"Versioned records."," A correction creates a new version, and the prior version remains retrievable with its author and time. Clinical data should almost never be overwritten in place.",[216,333,334,337],{},[27,335,336],{},"Database constraints and transactions",", so partial writes and orphaned references cannot corrupt a chart.",[216,339,340,343],{},[27,341,342],{},"Checksums or digital signatures"," on stored documents, images and files, verified on read or on a schedule.",[216,345,346,349],{},[27,347,348],{},"Soft deletion with restricted hard deletion",", plus logging of every delete.",[216,351,352,355],{},[27,353,354],{},"Backups with verified restores."," Integrity includes being able to get the correct data back. A backup that has not been restored in a test is an assumption.",[216,357,358,361],{},[27,359,360],{},"Controls on bulk operations."," Migrations and batch updates are where large-scale accidental alteration happens. Require review and a rollback plan.",[17,363,365],{"id":364},"person-or-entity-authentication-164312d","Person or entity authentication: 164.312(d)",[10,367,368],{},"The standard requires procedures to verify that a person or entity seeking access to ePHI is the one claimed. It names no method. The current text does not use the phrase multi-factor authentication.",[10,370,371],{},"That said, a password alone is hard to defend for any system holding health data today, and regulators have signaled the direction clearly (see the note on proposed changes below). The practical baseline is multi-factor authentication for every human path to ePHI, with phishing-resistant methods for privileged access.",[10,373,374],{},"\"Entity\" matters as much as \"person\". Services, devices and partner systems authenticate too. Use mutual TLS, signed tokens with short lifetimes or managed workload identity, not long-lived static keys in configuration files.",[10,376,377],{},"The gap is usually around the application, not in it. Walk the full list of ways to reach the data:",[213,379,380,383,386,389,392,395,398],{},[216,381,382],{},"The cloud provider console and its API keys",[216,384,385],{},"Direct database access and read replicas",[216,387,388],{},"The CI\u002FCD system, which can deploy code that reads anything",[216,390,391],{},"Backup storage and the tools that restore from it",[216,393,394],{},"Remote access paths, VPNs and bastion hosts",[216,396,397],{},"Support and analytics tools that sit beside the product",[216,399,400],{},"Vendor access for maintenance",[10,402,403],{},"Each needs individual identity and strong authentication, because each is a route to the same records.",[17,405,407],{"id":406},"transmission-security-164312e","Transmission security: 164.312(e)",[10,409,410],{},"The standard is to guard against unauthorized access to ePHI while it is being transmitted over an electronic communications network. Both specifications, integrity controls and encryption, are addressable.",[10,412,413],{},"TLS between the browser and your application is the easy part. Modern TLS provides both confidentiality and integrity in transit. The misses are elsewhere:",[213,415,416,422,428,434,440],{},[216,417,418,421],{},[27,419,420],{},"Internal traffic."," Service to service, application to database, and data center to data center links should be encrypted too. \"It is inside our network\" is not a boundary anyone should rely on.",[216,423,424,427],{},[27,425,426],{},"Backups, exports and replication."," Data leaving for another region, a warehouse or a partner needs encryption on the wire and at the destination.",[216,429,430,433],{},[27,431,432],{},"Email and messaging."," Still a common way ePHI leaves an organization unprotected. Standard email is not reliably encrypted end to end. Use a secure portal or enforced encryption.",[216,435,436,439],{},[27,437,438],{},"File transfers to partners."," Replace plain FTP and ad hoc shares with authenticated, encrypted transfer and expiring links.",[216,441,442,445],{},[27,443,444],{},"Mobile and device traffic",", including older integrations and medical device feeds that predate current protocols.",[17,447,449],{"id":448},"where-ephi-escapes-in-a-modern-stack","Where ePHI escapes in a modern stack",[10,451,452],{},"The regulation was written before most current tooling existed. These are the places where a well-built application still leaks:",[213,454,455,461,467,473,479],{},[216,456,457,460],{},[27,458,459],{},"Observability."," Error trackers capture request bodies and stack traces. Log aggregators receive full payloads. Session replay tools record the screen. If a patient record lands in a service with no business associate agreement, you have made a disclosure. Scrub at the source, in the application, before data leaves.",[216,462,463,466],{},[27,464,465],{},"Product analytics and advertising pixels."," Scripts on authenticated pages, or on pages whose URLs reveal a condition or appointment, can send health-related information to third parties.",[216,468,469,472],{},[27,470,471],{},"Lower environments."," Production data copied to staging or a developer laptop carries all its obligations with it, usually into a place with none of the controls. Use synthetic or de-identified data.",[216,474,475,478],{},[27,476,477],{},"AI services."," A prompt containing patient details sent to a model API is a transmission to a vendor. It needs a business associate agreement, a clear position on retention and training use, and the same audit logging as any other access.",[216,480,481,484],{},[27,482,483],{},"Caches, queues and search indexes."," Secondary stores get populated automatically and forgotten in encryption and access reviews.",[17,486,488],{"id":487},"what-this-section-does-not-cover","What this section does not cover",[10,490,491],{},"Passing a 164.312 review does not make a system compliant. The Security Rule groups its safeguards into three families, and this section is only the technical one. Documentation duties sit alongside them.",[213,493,494,500,506],{},[216,495,496,499],{},[27,497,498],{},"The administrative family"," (164.308) includes the risk analysis, risk management, workforce training, access authorization processes, incident response and contingency planning. The risk analysis is the foundation: it is what each of your technical choices is justified against, and its absence is a frequent finding in enforcement actions.",[216,501,502,505],{},[27,503,504],{},"Physical safeguards"," (164.310) cover facility access, workstation use and security, and device and media controls, including disposal.",[216,507,508,511],{},[27,509,510],{},"Documentation requirements"," (164.316) require written policies and procedures and retention of that documentation.",[10,513,514],{},"Two connected points are worth knowing.",[10,516,517,520],{},[27,518,519],{},"The breach notification incentive."," Breach notification obligations apply to unsecured PHI. PHI that is encrypted in line with the guidance issued by the Department of Health and Human Services, with the keys not compromised, is not considered unsecured. A lost encrypted laptop can therefore be a very different event from a lost unencrypted one. This is the strongest practical argument for treating encryption as mandatory.",[10,522,523,526],{},[27,524,525],{},"The contract."," Vendors carry these duties twice: once under the rule itself, and again under the business associate agreement they sign with each client. The agreement sets out permitted uses, reporting timelines and what happens to data at termination. Your subcontractors that touch ePHI need agreements too, which includes cloud providers and many of the tools listed in the previous section.",[10,528,529,532],{},[27,530,531],{},"Proposed changes."," The Department of Health and Human Services published a proposal to update the Security Rule that would, among other things, remove the required versus addressable distinction and make controls such as encryption and multi-factor authentication explicit. Check its current status before you finalize a design. Building to the stricter reading now is the low-regret choice either way.",[17,534,536],{"id":535},"a-working-checklist-for-the-next-architecture-review","A working checklist for the next architecture review",[213,538,541,551,557,563,569,575,581,587,593,599,605,611,617,623],{"className":539},[540],"contains-task-list",[216,542,545,550],{"className":543},[544],"task-list-item",[546,547],"input",{"disabled":548,"type":549},true,"checkbox"," Every human has an individual identity on every system that reaches ePHI, including databases and cloud consoles.",[216,552,554,556],{"className":553},[544],[546,555],{"disabled":548,"type":549}," Access is granted by role, with least privilege, and reviewed on a schedule.",[216,558,560,562],{"className":559},[544],[546,561],{"disabled":548,"type":549}," A break-glass procedure exists, alerts on use and is reviewed after use.",[216,564,566,568],{"className":565},[544],[546,567],{"disabled":548,"type":549}," Inactivity timeouts apply to all interfaces, with documented values.",[216,570,572,574],{"className":571},[544],[546,573],{"disabled":548,"type":549}," ePHI is encrypted at rest everywhere, including backups, snapshots and endpoints, with managed and logged keys.",[216,576,578,580],{"className":577},[544],[546,579],{"disabled":548,"type":549}," Reads and writes of patient records are logged with who, what, when, where and outcome.",[216,582,584,586],{"className":583},[544],[546,585],{"disabled":548,"type":549}," Audit logs are tamper resistant, retained for a defined period and actually reviewed.",[216,588,590,592],{"className":589},[544],[546,591],{"disabled":548,"type":549}," Records are versioned, deletes are controlled, and restores are tested.",[216,594,596,598],{"className":595},[544],[546,597],{"disabled":548,"type":549}," Multi-factor authentication covers every path to production, and services authenticate with short-lived credentials.",[216,600,602,604],{"className":601},[544],[546,603],{"disabled":548,"type":549}," All transmission is encrypted, internal traffic included, and email and file exchange have a secure path.",[216,606,608,610],{"className":607},[544],[546,609],{"disabled":548,"type":549}," Logs, error trackers, analytics and AI services have been checked for ePHI, and each such vendor has a signed agreement.",[216,612,614,616],{"className":613},[544],[546,615],{"disabled":548,"type":549}," Non-production environments contain no real patient data.",[216,618,620,622],{"className":619},[544],[546,621],{"disabled":548,"type":549}," Every addressable specification has a written decision.",[216,624,626,628],{"className":625},[544],[546,627],{"disabled":548,"type":549}," A current risk analysis exists and references these controls.",[17,630,632],{"id":631},"which-of-these-controls-is-designed-into-your-system-and-which-is-waiting-to-be-bolted-on-after-the-first-audit","Which of these controls is designed into your system, and which is waiting to be bolted on after the first audit?",[10,634,635],{},"Retrofitting identity and audit logging is far more expensive than designing them in, so the right time to ask is before the architecture hardens. Trivo builds software for regulated environments with these safeguards as requirements from the first sprint. Bring your system and its data flows, and you will get a plain account of the controls already in place, the ones still missing and the design changes each missing one would require.",{"title":637,"searchDepth":638,"depth":638,"links":639},"",2,[640,641,642,643,644,645,646,647,648,649,650],{"id":19,"depth":638,"text":20},{"id":57,"depth":638,"text":58},{"id":201,"depth":638,"text":202},{"id":259,"depth":638,"text":260},{"id":316,"depth":638,"text":317},{"id":364,"depth":638,"text":365},{"id":406,"depth":638,"text":407},{"id":448,"depth":638,"text":449},{"id":487,"depth":638,"text":488},{"id":535,"depth":638,"text":536},{"id":631,"depth":638,"text":632},"Compliance","2026-10-12","The five HIPAA technical safeguard standards mapped to concrete engineering decisions: identity, logging, integrity, authentication and encryption.","md",{},"\u002Finsights\u002Fhipaa-technical-safeguards-checklist",11,[659,660,661],"hipaa-business-associate-agreement","cloudflare-zero-trust-and-integrity","llm-in-production-confidence-thresholds","hipaa-technical-safeguards",[664,665,666],"custom-software","modernization","cloudflare",{"title":5,"description":653},"insights\u002Fhipaa-technical-safeguards-checklist","kge7icQawD9pFDaJH_yk2IPTHyXj_jK8It8irCoXvGE",[671,678,684,689,694,699,707,712,717,722,728,735,740,745,747,753,759,764,769,774],{"path":672,"title":673,"description":674,"category":675,"readingTime":676,"relatedServices":677,"date":652},"\u002Finsights\u002Fbuild-vs-buy","The License Fee Is the Small Number: A Working Guide to Build or Buy","Buying software is usually right, until the product sits on top of how you make money. How to sort capabilities, price the hidden costs and decide.","Strategy",9,[664,665],{"path":679,"title":680,"description":681,"category":682,"readingTime":676,"relatedServices":683,"date":652},"\u002Finsights\u002Fcloudflare-observability","The Cloudflare Signals You Need Wired Up Before Something Breaks","Cloudflare records plenty by default. Whether a person hears about a problem in time depends on choices made in a quiet week, not mid-outage.","Cloudflare",[666,665],{"path":685,"title":686,"description":687,"category":682,"readingTime":676,"relatedServices":688,"date":652},"\u002Finsights\u002Fcloudflare-performance-tuning","After the Static Assets: Where Cloudflare Performance Is Actually Won","Default caching handles images, CSS and JavaScript. The larger gains sit in HTML, API responses, cache keys and origin trips that nobody tuned.",[666,664],{"path":690,"title":691,"description":692,"category":682,"readingTime":676,"relatedServices":693,"date":652},"\u002Finsights\u002Fcloudflare-waf-and-ddos","Managed Rules Know the Internet. Custom Rules Have to Know Your Application.","Cloudflare's managed WAF and DDoS rules stop generic attacks. Logins, APIs, bots and false positives still need rules written from your own traffic.",[666,664],{"path":695,"title":696,"description":697,"category":682,"readingTime":676,"relatedServices":698,"date":652},"\u002Finsights\u002Fcloudflare-zero-trust-and-integrity","Who Got In Versus What Is Running: Two Integrity Problems One Control Cannot Solve","Zero Trust verifies who reaches a system. Client-side script monitoring verifies what runs in the browser. They fail differently and need separate owners.",[666,665],{"path":700,"title":701,"description":702,"category":703,"readingTime":704,"relatedServices":705,"date":652},"\u002Finsights\u002Fcrm-adoption-and-training","Your CRM Passed Every Test and Nobody Uses It: A Diagnostic for Stalled Adoption","Low CRM adoption is rarely a training gap. How to tell whether the cause is screen friction, missing payback or management habits, and what to fix first.","CRM",8,[706],"crm",{"path":708,"title":709,"description":710,"category":703,"readingTime":704,"relatedServices":711,"date":652},"\u002Finsights\u002Fcrm-implementation-timeline","The Honest Calendar of a CRM Implementation: Five Phases and Where the Weeks Go","Provisioning a CRM takes a day. Making it the place your team sells from takes months. A phase-by-phase calendar, with the parts quotes tend to leave out.",[706,664],{"path":713,"title":714,"description":715,"category":703,"readingTime":676,"relatedServices":716,"date":652},"\u002Finsights\u002Fcrm-migration-checklist","CRM Migration Checklist: The Records Arrive, the Selling Process Gets Left Behind","A CRM migration is a process migration with a data load attached. What a plain export loses, how to choose a cutover, and a checklist for each stage.",[706,665],{"path":718,"title":719,"description":720,"category":703,"readingTime":704,"relatedServices":721,"date":652},"\u002Finsights\u002Fcustom-crm-vs-off-the-shelf","Should You Build Your Own CRM? Run the Build-or-Buy Test on Your Sales Process","Most of a CRM is a commodity you should buy. The question is whether the way you sell fits the platform's model, and what it costs when it does not.",[706,664],{"path":723,"title":724,"description":725,"category":675,"readingTime":726,"relatedServices":727,"date":652},"\u002Finsights\u002Fcustom-software-cost-framework","Estimate Before the Estimate: Sizing a Custom Software Budget on Your Own","You can't know the price before a quote, but you can know what drives it. Six cost drivers, a self-check worksheet and how to read a proposal.",10,[664],{"path":729,"title":730,"description":731,"category":732,"readingTime":676,"relatedServices":733,"date":652},"\u002Finsights\u002Fetl-vs-elt","Transform before or after loading? A practical ETL versus ELT decision for mid-sized teams","ETL or ELT is a question of where transformation runs and who pays for it. A practical way for a mid-sized team to choose, with the costs most plans miss.","Data",[664,734],"ai-automation",{"path":736,"title":737,"description":738,"category":675,"readingTime":726,"relatedServices":739,"date":652},"\u002Finsights\u002Fevaluating-engineering-depth","Ask About the Outage: How to Vet a Software Vendor's Real Engineering Ability","Portfolios and logos look the same from every vendor. The interview questions, artifacts and deal-breakers that show who has really run software in production.",[664,665],{"path":741,"title":742,"description":743,"category":651,"readingTime":726,"relatedServices":744,"date":652},"\u002Finsights\u002Fhipaa-business-associate-agreement","A BAA Is a Contract, Not a Badge: What Your Software Vendor Is Really Signing Up For","What a HIPAA Business Associate Agreement commits a software vendor to, what it leaves unproven, and what to ask and build before PHI reaches the system.",[664,734],{"path":656,"title":5,"description":653,"category":651,"readingTime":657,"relatedServices":746,"date":652},[664,665,666],{"path":748,"title":749,"description":750,"category":751,"readingTime":676,"relatedServices":752,"date":652},"\u002Finsights\u002Flegacy-erp-anticorruption-layer","The ERP stays as it is: building on a decades-old system through an anti-corruption layer","How to build new software on an old ERP without modifying it, using an anti-corruption layer: what goes inside, how to handle writes, when to skip it.","Modernization",[665,664],{"path":754,"title":755,"description":756,"category":757,"readingTime":726,"relatedServices":758,"date":652},"\u002Finsights\u002Fllm-in-production-confidence-thresholds","An LLM that proposes and a system that decides: thresholds, review and audit for production AI","Running an LLM in production without giving it autonomy: measured confidence, thresholds set by business cost, human review that works, an audit trail.","AI",[734,664],{"path":760,"title":761,"description":762,"category":675,"readingTime":676,"relatedServices":763,"date":652},"\u002Finsights\u002Fnearshore-offshore-onshore-cost","Cheap Hours, Expensive Projects: Pricing US, Nearshore and Offshore Teams Honestly","The hourly rate tells you little about what a project will cost. How overlap, rework, turnover and compliance change the math for each delivery model.",[664],{"path":765,"title":766,"description":767,"category":757,"readingTime":676,"relatedServices":768,"date":652},"\u002Finsights\u002Frpa-vs-api-integration","Bots on the screen or calls to the API: where RPA earns its place and where it becomes debt","RPA and API integration solve the same problem at different layers. How to choose, what screen automation really costs, and how to run it safely if you must.",[734,664],{"path":770,"title":771,"description":772,"category":751,"readingTime":676,"relatedServices":773,"date":652},"\u002Finsights\u002Fstrangler-fig-modernization","Replace the legacy system in slices: a working guide to the strangler fig pattern","How to retire a legacy system piece by piece while the business keeps running: the facade, the first slice, parallel runs, and when the pattern fails.",[665,664],{"path":775,"title":776,"description":777,"category":675,"readingTime":726,"relatedServices":778,"date":652},"\u002Finsights\u002Ftwo-week-discovery-deliverables","Paying for a Plan, Not a Pitch: What Two Weeks of Discovery Owes You","A paid discovery should leave you with documents another team could build from. The five deliverables, the work behind them and the limits to expect.",[664,665],1792618973203]