Why systems handling health data require more than just "working well"

Health data is considered sensitive data under Brazil's LGPD, which completely changes the standard of care for a system handling electronic medical records. It's not enough for it to work — it has to be born with security and privacy as a design requirement, not something bolted on at the end.

Among other things, that means each client can only access their own data, every action on a sensitive record stays traceable, and access is always restricted to whoever actually needs it to do their job. As a policy, we don't publicly detail the security architecture of any project — including the clinics one — precisely to avoid handing out information that could be used against the system or its data.

This level of care costs more to develop than a regular system, which is why projects handling health, financial or legal data aren't the place for technical shortcuts — nor for full transparency about exactly "how" the protection is implemented.

When the data your system stores can trigger an LGPD fine or a lawsuit, security stops being a technical detail and becomes a core requirement of the project, discussed case by case during the initial scoping — not in public content.