Policies and Guardrails

• ABAC personas enforce route and API behavior.
• Segregation of duties blocks self-approval for elevated admin permissions.
• Clinicians cannot finalize restricted incident closures.
• Proxy consent categories can allow or deny records sharing.

Retention simulation

• Messages: 3 years
• Results: 10 years
• Bills: 7 years
• Incident reports: 8 years