Pre-HIPAA · Plain language
What Life Spark Survivorship Institute can and can't do — before we're HIPAA-ready.
We're building for cancer survivors, and HIPAA compliance is a serious engineering and legal project. Until it's done, we've drawn a hard line: the app is safe for you to use with your own data, but any feature that would let someone else touch your PHI is locked at the code level — not just hidden. This page explains what that means, in the same language we'd use talking to a survivor.
Current status: HIPAA-ready mode OFF (controlled by the VITE_HIPAA_READY flag).
The short version
Safe to use right now
- • Marketing, education, and transition-gap content.
- • Every patient tool — you log data about yourself into your own row.
- • Your own exports: CSV, JSON, FHIR Bundle download, personalized PDF plan.
- • In-app trend charts and history for your own entries.
- • Your personal access log (who touched your record — currently nobody).
Locked until HIPAA-ready
- • The entire clinician workspace (viewing another user's PHI).
- • Automated server-to-EHR FHIR sync.
- • SMS/email reminders that contain PHI.
- • Consent-refresh reminders (they route through the same messaging channel).
- • Uploading raw clinical documents, imaging, or pathology.
- • LLM features that would send PHI to third-party model providers.
- • Multi-user caregiver/household shared views.
Feature-by-feature
Read across each row: what you can do today, and what stays off until Life Spark Survivorship Institute finishes its HIPAA administrative safeguards and executes a Business Associate Agreement with the backend provider.
| Area | Available now | Locked until HIPAA-ready |
|---|---|---|
| Account & sign-in | Email + Google sign-in. Password reset. You own and can delete your account at any time. | SSO tied to a hospital identity provider. Enterprise session policies and forced re-auth on PHI screens. |
| Marketing & education pages | Homepage, About, Transition-Gap guide, Library, Stories, Support Groups, Policy, and the CSPN clinician-network partnership pages. No PHI is displayed. | Nothing — these pages remain public. |
| Patient tools (symptoms, sleep, distress, nutrition, activity, medications, financial, cognition, sexual health, fertility, lymphedema, caregiver, second opinion, care plan, care team, appointment prep) | You log your own data into your own row. Row-level security means no other user — including clinicians — can read it. Trend charts, history, and delete-your-own-data are all available. | Nothing here is locked. The data belongs to you. Everything you enter is scoped to your account. |
| PHI you enter about yourself | You can type, track, and delete anything you want in your own record. It's saved encrypted at rest and only visible to you. | You cannot upload raw medical records (PDFs, imaging, pathology) yet — file storage of clinical documents is a HIPAA-scoped feature and stays off. |
| PHI exports (your own data) | You can download your history as JSON or CSV, generate a FHIR R4 Bundle for a future clinician, and print or save the personalized transition-plan PDF. All triggered by you, delivered to your device. | Automated server-side pushes of your Bundle to a specific EHR (Epic/Cerner) endpoint — that requires a BAA with the receiving system. Do it yourself for now: download and hand it off. |
| Clinician workspace | Reference library (CME-style survivorship cards), de-identified cohort insights (k-anonymized, minimum cell size 20, computed inside the database), cascade builder, deprescribing worksheet, tumor-board worksheet, and a patient-shared snapshot viewer. None of these read another user's identifiable row — the database enforces this with row-level security. | Any workflow that would let a clinician query another user's record directly, subscribe to a patient's data feed, or receive automated push of a patient's PHI. Those stay off until a BAA is executed. |
| Sharing your data with a clinician | You generate a private, time-limited, revocable snapshot link from /institute/share, then send it to your clinician yourself (email, portal message, in-visit QR). The recipient views only what you chose to include, only for as long as you allow. You can revoke at any moment. Because you are the discloser, no BAA is required. | Standing clinician access to your live record. That would require a HIPAA-covered relationship. |
| Automated reminders | In-app banners you see when you're actively using the site (e.g. "you haven't logged sleep in 10 days", "your FHIR consent is stale, renew when you visit next"). Nothing leaves the browser. | SMS and email reminders that carry any PHI (scores, symptom names, appointment context) — those stay off. |
| Automated FHIR sync | One-tap, patient-initiated FHIR Bundle download from your device. | Scheduled background sync from the Institute to your health system. No automated transmission of PHI to third parties happens today. |
| AI features | Deterministic scoring, plan generation, and summaries that run on data you already entered — no calls to third-party model providers with PHI. | LLM-powered chat, ambient scribing, or model-assisted summaries that would send your PHI to an external model provider. Off until a BAA covers the model host. |
| Caregiver / household sharing | You can download and hand off your PDF or JSON. | Multi-user shared views of your record inside the app. Delegated access requires HIPAA-compliant access control and audit logging. |
| Audit trail | You can view every clinician or admin access to your data (Who Accessed My Data) and download it as CSV. The log stays empty until you share a snapshot with a clinician. | Formal HIPAA §164.312(b) audit reports and tamper-evident WORM archival — that's a compliance-artifact tier that ships with HIPAA readiness. |
How we enforce this in code
- • A single feature flag,
VITE_HIPAA_READY, decides whether HIPAA-scoped surfaces are reachable at all. - • Every URL under
/institute/clinicians/*is role-gated in the route-access table: only a verified clinician (or an admin) reaches it, and visitors without that role see an "Access limited" screen before any workspace HTML renders. These surfaces hold the clinician's own workflow, de-identified aggregates, or a snapshot a patient chose to share — no route reads another person's identifiable record. - • The consent-refresh reminder runs in-app only. It reads your local consent record and prompts you inside the site — it never emails, texts, or transmits anything on your behalf.
- • Row-level security is on for every patient-data table. RLS is enforced by the database, not the app.
- • Your data belongs to you. Exports are downloaded to your device — the app does not transmit PHI on your behalf.
This page is maintained by My Life Spark P.C. to describe the current, app-visible controls of Life Spark Survivorship Institute. It is not a certification, an audit, or legal advice. If a regulated healthcare use case requires HIPAA-covered handling, wait for HIPAA-ready mode before using this app for that workflow.