Notes from sixteen years of clinical safety, defect prevention, and healthcare data engineering. ONC, CMS, HIPAA, MHMDA, FHIR. What the enforcement record actually shows, what the engineering bar actually is, and why patient data ownership is not optional.
Most healthcare teams assume HTI-1 compliance instead of proving it. A "200 OK" is not conformance. Here is how to pressure-test your readiness against the actual implementation guides before an audit or a breach finds the gaps.
Read more →You generate it, someone else owns it, someone else profits. BetterHelp, Cerebral, and 23andMe are the same story. Here is why privacy policies do not fix it, and what a patient-owned data trust looks like.
Read more →Five years at Opala shipping IRIS, Smile CDR, and Fire.ly to production, plus extensive HAPI experience. Strengths, gotchas, and what an actual practitioner notices after the vendor demo is over.
Read more →January 2026 metrics reporting has already started. Most readiness checklists are vendor brochures. Here is what your engineering team should actually have on disk, with the public regulator citations.
Read more →The best surveillance result is the one you already knew was coming. How upstream conformance testing and a 15-year zero-defect record keep Friday quiet.
Read more →Our rule: never use a number we cannot link to its source. ONC, HHS OCR, and CMS already maintain the public record. We cite it and treat the buyer like a peer.
Read more →More posts coming. Subscribe via LinkedIn for cross-posted versions.