Question 1

Where is the DPO UI today?

Accepted Answer

Server endpoints under /v1/admin are live in production today (OH-12). The unified DPO UI is being built as part of the consolidated Fastclinic admin platform shipping 2026-H2; the OneHealth admin surfaces will be one of the contexts in that platform. Until then, you have two integration paths: scripts against the /v1/admin endpoints under a service token scoped to the appropriate role, or pre-built CLI runners that the Fastclinic compliance team operates on your behalf during the interim.

Question 2

How is the audit chain hashed?

Accepted Answer

Each row carries a hash column over the canonical JSON of its content (event constants, actor IDs, resource IDs, timestamps, sanitised metadata) plus a prev_hash column that points at the previous row's hash. The verifier replays the canonical-hash function and confirms each prev_hash matches the prior row's computed hash. The same canonical-hash function lives in internal/audit/canonical.go and is shared between writer and verifier so a schema evolution does not silently false-flag every legitimate row. SHA-256 is the underlying primitive.

Question 3

What is the §9.7 metadata sanitiser?

Accepted Answer

Audit metadata may contain key-value pairs from the surrounding request context. The §9.7 sanitiser strips Tier-4 keys before any logging happens — passwords, tokens, session IDs, WebAuthn public keys, TOTP secrets, master keys, document bytes, plaintext data, plaintext findings, plaintext diagnoses, plaintext prescription text, NIN, BVN, SSN, and roughly twenty-five forbidden keys. The match is case-insensitive exact-key match, not substring, so 'sid' does not match 'residential'. If a forbidden key is present, the audit emit raises ErrAuditForbiddenField; the writer never silences this error.

Question 4

How does retention enforcement work?

Accepted Answer

Records carry a retention_until timestamp computed from creation plus the per-deployment retention period (default seven years, configurable per record type). The retention worker runs daily and identifies records past retention; for each record, the per-record DEK is destroyed, the ciphertext becomes unrecoverable (NIST 800-88 crypto-erase), and the metadata row is marked status=erased. The audit chain records record.erasure_executed. Records under active care can be held by the DPO; the hold extends retention until released.

Question 5

What metrics are in the compliance report?

Accepted Answer

Records under management. Record reads in window. Grants created, revoked, expired in window. Sessions started, ended, expired in window. Emergency accesses with review status (pending, reviewed, auto-flagged). DSAR requests by status (pending, completed, downloaded, expired). Retention countdowns by record type and bucket. Key rotations in window. Audit-chain integrity status (last verified at, breaks, rows since last break). The report is generated server-side, signed with Ed25519, exported in JSON or PDF.

Question 6

How does Safe-Harbor de-identification work?

Accepted Answer

The de-identification endpoint produces a record export with the eighteen Safe-Harbor identifiers stripped: names, geographic subdivisions smaller than state, all date elements except year, telephone numbers, fax numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or licence numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographic images, and any other unique identifying number, characteristic, or code. Statistical disclosure controls are applied where age and date of birth would be re-identifiable. The export is signed and audit-logged.

Question 7

Can I generate a regulator-ready evidence pack?

Accepted Answer

Yes. The compliance-report endpoint generates the structured metrics; the audit-explorer endpoint generates a filtered audit slice for a specific date range, actor, or resource; the DSAR queue surfaces the export receipts. Combine the three into a regulator-facing evidence pack: aggregate metrics, slice of relevant audit, and the signed manifests for any patient-specific exports. The Ed25519 signatures let the regulator verify provenance offline. The Fastclinic compliance team can produce this pack on your behalf during the OH-12-to-DPO-UI interim.

Question 8

What is the lawful basis for processing under NDPA 2023?

Accepted Answer

The patient's consent for record-by-record access (§25(1)(a)). The contract with the patient for account operation (§25(1)(b)). The legal obligation to retain medical records for seven years (§25(1)(c)). Vital interest in emergency access where the patient cannot consent (§25(1)(d)). Legitimate interest of the controller for fraud prevention and security incident response (§25(1)(f)). The data-processing record names every dataset, every processor, every cross-border transfer (none, in OneHealth's normal operation), and every retention period. NDPA 2023 §65 governs processor obligations between Fastclinic and the hospital tenants.

Question 9

How does break-the-glass auto-flagging work?

Accepted Answer

Every emergency access creates a row in the emergency_access table with status=active, created_at, reason, scope, and duration. A worker — emergency_review_expirer — runs every five minutes, claims rows under FOR UPDATE SKIP LOCKED where status=active and created_at + 48 hours has elapsed, marks them flagged, and emits emergency.auto_flagged on the audit chain. The worker is idempotent across overlapping ticks because SKIP LOCKED is transaction-scoped; the next tick simply re-claims any row a previous tick failed to commit. Your DPO queue surfaces flagged rows in priority order; the audit chain records every review action.

Question 10

What if a hospital tenant misuses the system?

Accepted Answer

Bulk-access detection plus break-the-glass abuse pattern emit warnings to the DPO queue. Multiple emergency accesses by the same provider over a short window without distinct clinical contexts surface as a flag. Suspicious patterns in the audit chain (high read volume, off-hours access spikes, bulk reads against many patients) generate review tasks. The administrative path is suspension of the tenant's access via the FastLogin admin platform; the contractual path is the processor agreement under NDPA 2023 §65. The audit chain becomes the evidence base for either action.

Title	Created	Erase scheduled	Action
Discharge summary · LASUTH	2019-04-30	2026-04-30 · 4 days	Auto
Lab result · LFT panel	2019-05-12	2026-05-12 · 16 days	Auto
Imaging report · MRI L-spine	2019-05-29	2026-05-29 · 33 days	Auto
Prescription · ARV regimen	2019-06-01	2026-06-01 · 36 days	Hold (active care)

Audit chain. DSAR queue. Retention controls.

1 · Verify the audit chain

2 · Review break-the-glass

3 · Process the DSAR queue

4 · Watch retention

5 · Export Safe-Harbor de-identification

6 · Generate the compliance report

Live DPO endpoints today, unified UI 2026-H2

Hash-chain integrity verification

Forty-eight-hour break-glass review SLA

FHIR R4 + Safe-Harbor de-identification

Capabilities

Integrations

Compliance & safety

Plain answers

Compliance posture, automated where it can be.

Audit chain. DSAR queue. Retention controls.

1 · Verify the audit chain

2 · Review break-the-glass

3 · Process the DSAR queue

4 · Watch retention

5 · Export Safe-Harbor de-identification

6 · Generate the compliance report

Live DPO endpoints today, unified UI 2026-H2

Hash-chain integrity verification

Forty-eight-hour break-glass review SLA

FHIR R4 + Safe-Harbor de-identification

Capabilities

Integrations

Compliance & safety

Plain answers

01Where is the DPO UI today?

02How is the audit chain hashed?

03What is the §9.7 metadata sanitiser?

04How does retention enforcement work?

05What metrics are in the compliance report?

06How does Safe-Harbor de-identification work?

07Can I generate a regulator-ready evidence pack?

08What is the lawful basis for processing under NDPA 2023?

09How does break-the-glass auto-flagging work?

10What if a hospital tenant misuses the system?

Compliance posture, automated where it can be.