Audience: whoever is standing up a deployment for real use.
Every item here is something that has actually gone wrong, or that fails silently if skipped. Items
marked ⚠ fail quietly — the system will appear to work.
Security and data protection
| ✔ | Item | If skipped |
|---|
| ☐ | PII encryption enabled | Personal data sits in plaintext at rest |
| ☐ | ⚠ Backfill run together with enabling it | Encryption on without backfill leaves pre-existing rows with no blind-index hash, so every existing patient becomes unfindable by name. Reads by id still work, which is what makes this so easy to miss |
| ☐ | ⚠ Every retired key still present in configuration | Rows are not re-encrypted in place. Removing a retired key destroys access to everything encrypted under it — a retired key is a live secret, not an expired one |
| ☐ | Database TLS configured | Traffic between the application and the database is unprotected |
| ☐ | Secure defaults reviewed | See operations/secure-defaults.md |
| ☐ | Auth rate limiting on | Credential-stuffing has no friction |
| ☐ | Refresh-token reuse detection on | A stolen refresh token cannot be detected |
Configuration
| ✔ | Item | If skipped |
|---|
| ☐ | ⚠ Module configuration verified in the assembled jar | Only the application's own configuration is read in the single jar; a setting placed in a module's own file is silently ignored — see operations/module-configuration.md |
| ☐ | Scheduled jobs enabled and attributable | Background work either does not run, or runs unattributable |
| ☐ | Permissions declared for every module in use | An undeclared permission cannot be granted at all |
| ☐ | Tenant, facilities and care locations created | Nothing can be scoped |
| ☐ | Modules enabled per tenant | Whole sections of the product are invisible, and no role grant will reveal them |
Clinical readiness
| ✔ | Item | If skipped |
|---|
| ☐ | ⚠ Every visit type in use mapped to a published journey | Check-in opens the visit and issues the token but starts no pathway — a misconfigured visit type looks exactly like a working one. Use the configuration health panel |
| ☐ | Journeys published, not left as drafts | Only published definitions can be mapped |
| ☐ | ⚠ Publication understood as irreversible | There is no unpublish — see operations/journey-publication.md |
| ☐ | Concept dictionary loaded | Clinical screens have nothing to code against |
| ☐ | Queues bound to journey steps | Patients are checked in but appear on no board |
| ☐ | ⚠ Document scanner running | Nothing marks an uploaded document clean, so no document can be downloaded — uploads appear to succeed and retrieval always fails |
People
| ✔ | Item | If skipped |
|---|
| ☐ | Staff registered and given accounts | Registering someone does not create their login |
| ☐ | Roles and scopes assigned | They sign in to an empty product |
| ☐ | Credentials recorded where a unit gates on them | Staff cannot be rostered to that unit |
| ☐ | ⚠ Existing people linked, not re-registered | Two person records for one human, with clinical history and employment on different identities |
Verification before opening the doors
Do these as the roles that will actually use the system, not as an administrator — an administrator
can see things a clinician cannot, which is precisely the failure you are trying to catch.
| ✔ | Walk through |
|---|
| ☐ | Register a patient, check them in, confirm they appear on the waiting board |
| ☐ | Confirm the check-in started a journey — not merely that the visit opened |
| ☐ | Open a clinical form from the patient dashboard and save a record |
| ☐ | Raise an order and confirm the result returns against the same visit |
| ☐ | Upload a document and then download it back |
| ☐ | Sign in as a role that should be refused, and confirm it is refused with a message that does not reveal whether the record exists |
See also
operations/pii-encryption.md — encryption, backfill and key rotation in fulloperations/module-configuration.md — why a module's own configuration file is ignoredoperations/journey-publication.md — why publishing cannot be undoneoperations/permission-declaration.md — why an undeclared permission cannot be granted