Industries
Healthcare
Healthcare software fails in private. IncogX designs for the clinical or operational job, and for the record of who saw what. A public example is a healthcare platform moved to AWS. The client’s name is not published.
In brief, then in detail
- The clinical or operational job. Scheduling, records, coordination, or the workflow around them. The software has to fit a day that is already interrupted.
- Access and audit. Role-based access, a trail of sensitive views and changes, and a way to answer who looked at this record.
- Availability. What must stay up, what can wait, and how a degraded mode is explained to the people in the room.
- Privacy as scope. Minimum data, retention, and export controls. IncogX does not claim a certification the engagement has not earned. The applicable duties are assessed with the client.
How it is run
Discovery includes the people who carry the risk: clinical leads, operations, and whoever owns information governance. Architecture records where health data rests and how it moves. Sprints still demo working software, using realistic but non-production data unless the client has approved otherwise. A migration, such as the AWS example, moves in waves with a rollback.
ExampleHealthcare platform on AWS
DataAccess, audit, and minimum use
ClaimDuties assessed per engagement
Controls that matter here
- Role-based access
- Audit trail
- Encryption
- Backup and restore
- Non-production data
- Staged migration
Terms, in plain language
- Audit trail. A record of access and change that can be read later by someone who was not in the room.
- Minimum necessary. Collect and show the health information the job needs, and not the rest because the field was easy to add.
- Availability. How long the service can be down, and what staff do in that window. Named before go-live.
- Compliance. The legal and contractual duties that apply to this client, in this country. They are analysed. They are not a logo on the homepage.