Skip to content
All writing

September 8, 2026

Architecting HIPAA compliance into a multi-tenant SaaS

“HIPAA-compliant” is often a checkbox on a marketing page. For My Elara — a platform for mental-health practices handling some of the most sensitive data there is — it had to be something you could point to in the code.

The approach was to make compliance architectural rather than procedural: build the safeguards into the structure of the system, and map each one to the specific HIPAA Security Rule requirement it satisfies.

Access control (45 CFR 164.312(a)(1))

Authentication is JWT with Argon2 password hashing plus enterprise SSO; authorization is role-based guards across super-admin, admin, clinician, and client roles. The role a request carries decides what it can even attempt, before any business logic runs.

Tenant isolation and minimum necessary (45 CFR 164.514(d))

Every practice is a tenant, and a tenant-aware data layer injects and validates practice scoping on every read and write. A clinician in one practice cannot reach another practice’s data, because the boundary lives below the application code, not inside it.

Audit controls (45 CFR 164.312(b))

A global interceptor logs every operation — actor, IP, resource, method, duration, and before and after values — with a dedicated admin viewer. When protected health information is read or changed, there is a durable, queryable record of it.

Encryption and consent

  • TLS throughout, server-side encryption on stored files, and time-limited scoped URLs for uploads
  • Per-client HIPAA, treatment, telehealth, and communication consents, each individually timestamped

PHI-aware AI

My Elara uses AI to analyze clinical journaling, which means protected health information can reach a model. The provider layer is pluggable specifically so PHI only routes to a vendor under a business associate agreement, and every AI interaction is bounded by per-client token budgets and tracked with prompt versions.

The lesson

Bolting compliance onto a finished product is painful and fragile. Designing the safeguards in from the start — and tying each to the rule it implements — makes compliance something you can demonstrate, not just claim.