HIPAA — local development

Summary for local MVP. Full production controls: SECURITY.md.

Local MVP rules

• Use synthetic or redacted PDFs only
• Never commit .env, samples, or parser output with PHI
• samples/ is gitignored
• Elation preview JSON in UI is dry-run — no HTTP to Elation

GCP parsers

When enabling Document AI or Vertex Gemini locally:

• Use a GCP project under signed BAA
• Vertex AI only — never Google AI Studio for PHI
• Set telemetry suppression in .env (see .env.example)

Before cloud deploy

Complete SECURITY.md Phase 4 checklist:

• Default-deny VPC egress
• Elation-only external path
• PHI-redacted logging
• CI/CD dependency and container scanning

Phase 0a still required

Before real Elation integration, run elation sandbox validation.