Architecture & security
Local-first medical data: what it really means
Understand the boundary between local clinical records, optional cloud services, encryption, backups and the practice’s responsibilities.
Local-first does not mean a product never communicates with the internet. It means clinical records remain under the practice’s operational control and essential workflows continue locally. Every connected service should then be described separately.
Separate clinical data from operational services
Notes, prescriptions, documents and patient histories can remain in the local database while a licensing service receives only product and device identifiers. Public scheduling can publish availability and anonymous busy intervals without sending a patient’s identity or reason for visiting.
This separation should exist in the data model, permissions and audit records. A marketing sentence is not a substitute for an inventory of data flows.
Encryption does not remove responsibility
Encryption helps prevent some unauthorized reading. Sessions, roles, exports, backups and shared workstations still require controls. A lost key can make a backup unusable; a poorly protected key can make encryption largely symbolic.
The practice also needs a human procedure: named owners, a verified recovery copy, access rotation and a restore drill.
Request a data map
Before deployment, ask for a written answer for every connected flow.
- Exact data category and purpose
- Applicable consent or legal basis
- Storage location and retention
- Encryption in transit and at rest
- Revocation, export and erasure procedure
Review the Clinosys security approach
Read the published controls and request a data map for your scenario before any real-world deployment.