HIPAA-grade scheduling for a multi-clinic network in 19 days

The situation

• The CTO of a Toronto-based specialist network built a working scheduling tool on Replit during a hackathon, then quietly rolled it out to all 14 clinics. It saved hours per week, the doctors loved it, and then their compliance officer found out.
• PHI stored in plaintext columns. No audit log.
• Auth based on shared passwords. A scheduled HIPAA + PHIPA review was 4 weeks away.

What we did

• Column-level PHI encryption with AWS KMS-managed keys
• Azure AD SSO with enforced MFA and group-based access
• Immutable audit log with 7-year S3 Object Lock retention
• Role hierarchy: clinic admin, clinician, front desk, auditor, break-glass
• Encrypted attachment storage for clinical notes and referrals
• Audit-ready exports for HIPAA + PHIPA reviewer requests

The result

• The HIPAA + PHIPA audit completed with zero findings.
• The clinic network has since added 6 more clinics without any architectural changes. The CTO uses the audit log dashboard as a recurring board agenda item, auditability has become a selling point when recruiting new specialists.