Health & Records

Modern healthcare and government services run on sensitive, long-lived records: clinical histories, benefits eligibility, civil status, land titles, taxation, licensing, and identity. These data aren’t just private—they’re persistent, interdependent, and heavily regulated. A single breach, unauthorised lookup, or wrongful disclosure can cascade across agencies, providers, insurers, and cross-border data partners.

Health-Records
Request More Information

Global & Local

In today’s connected world, trust is defined by how data is protected. Every breach, record, or exposure leaves lasting consequences for institutions and individuals. PastWipe’s patented technology and the RepSec™ protocol neutralize stolen information and safeguard digital sovereignty, offering a level of protection far beyond reputation management.

PastWipe News

Why Health & Public Records Demand a Higher Standard

Modern healthcare and government services run on sensitive, long-lived records: clinical histories, benefits eligibility, civil status, land titles, taxation, licensing, and identity. These data aren’t just private—they’re persistent, interdependent, and heavily regulated. A single breach, unauthorised lookup, or wrongful disclosure can cascade across agencies, providers, insurers, and cross-border data partners.

What’s different about health & public records

  • Special sensitivity & longevity. Health data (e.g., diagnoses, genomics, mental health notes) and public records (e.g., birth/death, immigration, property) outlive typical IT cycles and vendor contracts.

  • Complex sharing. Providers, labs, insurers, pharmacies, social services, courts, registries, and national ID systems must exchange subsets of the same person’s data—with precise purpose limits.

  • Tight regulation. In the EU this includes GDPR (special categories and lawful bases; Art. 5, 6, 9, 25, 30, 32), NIS2, and eIDAS for trusted identities and signatures. In the U.S., HIPAA Security/Privacy Rules and HITECH. Globally, sector profiles and technical standards such as HL7 FHIR, DICOM, IHE profiles, OpenID Connect, and OAuth 2.0 govern exchange and access.

  • Proof requirements. Auditors and courts increasingly expect evidence of correct handling, not just policies. It’s not enough to “be compliant”—you must be able to show who accessed what, when, under which purpose and role, and with what consent or legal mandate.

PastWipe for Health & Records

PastWipe provides a cryptographically enforced envelope around data. It makes stolen or exfiltrated data non-reusable (breach-triggered neutralisation), enforces purpose-bound use even off your network, and emits verifiable, signed usage events. Our RepSec™ protocol (optional to deploy) standardises those protections across organisations, vendors, and borders—so trust is portable.

  • Breach-Triggered Neutralisation (BTN). If data leaves the allowed pathways or attestation conditions fail, the payload becomes practically useless to attackers.

  • Purpose & consent binding. Requests are evaluated against declared purpose, legal basis, consent state, and data minimisation rules—then released in least-privilege slices.

  • Attestation by design. Every access becomes a tamper-evident, signed event that regulators and auditors can verify.

  • Standards-first. Aligns with GDPR special category handling, HIPAA access controls and audit, NIS2 operational resilience, eIDAS trust services, HL7 FHIR resources, IHE exchange, OAuth 2.0/OIDC for delegated access.

Result: safer clinical and civic services, faster cross-entity collaboration, and reduced breach externalities—with evidence.

Useful references

  • GDPR (official text): EUR-Lex (Regulation (EU) 2016/679)

  • HIPAA Security Rule: U.S. HHS

  • HL7 FHIR: hl7.org/fhir

  • DICOM: dicomstandard.org

  • IHE Profiles: ihe.net/resources/profiles

  • OAuth 2.0 (RFC 6749): IETF Datatracker

  • OpenID Connect: openid.net/connect

  • NIST SP 800-53 (Rev. 5): csrc.nist.gov

  • NIS2: EUR-Lex (Directive (EU) 2022/2555)

  • eIDAS: EUR-Lex (Regulation (EU) No 910/2014)

Request More Information

The PastWipe Approach: Controls That Travel with the Record

1. Envelope the data, not just the perimeter.
PastWipe wraps records in a cryptographic envelope that carries policy, provenance, legal basis, consents, and usage rules alongside the data. Even when copied, exported, or cached by a third-party system, the envelope enforces:

  • Identity & role attestation. Strong identity (eIDAS/OIDC), role, and device posture checks before release.

  • Purpose binding. Requests must declare a permitted purpose (e.g., treatment, payment, operations; specific statutory mandate; court order) that maps to your policy matrix.

  • Data minimisation. Only the necessary fields and timeframe are released (GDPR Art. 5(1)(c)); defaults to de-identification or aggregation when possible.

  • Record-level keying. Split-scoped keys with in-country KMS/HSM options; role-based and attribute-based policies (RBAC/ABAC) to prevent “all-or-nothing” access.

2. Breach-Triggered Neutralisation (BTN).
If the envelope detects policy violations (e.g., exfil path, missing attestation, abnormal geography, revoked purpose), it revokes cryptographic material and switches payloads to a non-reusable state. Stolen CSVs or database dumps lose operational value.

3. Evidence by design.
Every permitted access emits a signed, immutable event suitable for SIEM/SOAR ingestion and auditor-grade reports: who, what, when, why, where—plus the minimal released subset. This yields:

  • Attestation trails for regulators and data protection authorities.

  • Cross-party accountability: vendors and agencies can’t dispute what their systems did.

  • Rapid incident scoping: know exactly which minimal slices were exposed.

4. Interoperable with existing health & records stacks.
We integrate at logical choke points—EHRs/EMRs, LIS/PACS, HIEs, health insurers/TPAs, registries (civil, land, tax), case management, and document management:

  • FHIR ($export, consent, provenance, audit-event), IHE (XDS/XCA/XUA), DICOM for imaging, OpenID Connect for identity, OAuth 2.0 for delegated access, SAML where needed.

  • Event wiring into your SIEM (e.g., Splunk, Elastic, Microsoft Sentinel) and SOAR runbooks.

  • Cloud/on-prem/hybrid deployments, with in-country HSM/KMS and “separation of duties” to satisfy sovereignty requirements.

5. RepSec-ready (optional).
RepSec™ is an optional protocol layer that standardises BTN, purpose semantics, and attestation formats across organisations—so the same record can move from hospital to regulator to research partner without losing its guardrails or auditability. You can adopt PastWipe without RepSec, and add RepSec later for inter-org portability.

Key advantages for health & government custodians

  • Reduce breach blast radius: exfiltrated data becomes non-reusable.

  • Limit insider misuse: purpose checks + minimal slices + signed events.

  • Accelerate lawful sharing: faster responses to statutory requests with automatic scoping and proofs.

  • Shrink audit cycles: regulators can verify controls via evidence, not promises.

  • Defensible posture: policy-to-proof alignment across systems and vendors.

Request More Information

Implementation Blueprint: Intake → Use → Exchange → Retention

Phase 1 — Readiness & Design

  • Data flow inventory. Map high-value flows: EMR/EHR, lab, imaging, pharmacy, benefits adjudication, claims, civil registries, land titles, tax and licensing, identity verification.

  • Policy translation. Convert GDPR/HIPAA/NIS2/eIDAS and sector rules into machine-enforceable policies attached to envelopes: purpose catalogues, legal bases, retention clocks, cross-border constraints.

  • Sovereign deployment plan. Decide on cloud/on-prem/hybrid, in-country HSM/KMS, key-custody models, and separation of duties.

  • Risk-based scoping. Start with crown-jewel flows (e.g., EHR outbound summaries, cross-agency benefits, sensitive registry extracts).

Phase 2 — Pilot & Integration

  • Envelope the first flows. Bind policies to data for 2–3 high-impact exchanges (e.g., discharge summaries to insurers; civil registry to health benefit authority; imaging to specialty provider).

  • Identity & access wiring. Integrate OIDC/OAuth2 with your IAM/IdP; enable step-up authentication for elevated actions; map roles to ABAC controls.

  • Event streaming. Send signed audit events to SIEM; build dashboards that correlate envelope actions with identity/device posture.

  • BTN exercises. Run tabletop + live BTN drills on controlled datasets to validate incident response and public-communications templates.

Phase 3 — Scale & Assure

  • Expand coverage. Add providers, agencies, and vendors; codify reusable policy sets (treatment, payment, operations; statutory requests; research with ethics approvals).

  • Automate attestations. Generate scheduled reports for DPO/CISO, processors, and regulators (GDPR Art. 30 records; HIPAA audit; NIS2 oversight).

  • Retention & erasure orchestration. Drive deletion/archival per schedule and legal holds; when full deletion isn’t lawful (e.g., medical record retention), default to neutralised or sealed states with strict re-open workflows.

  • Cross-border control. Enforce Chapter V GDPR transfer rules, SCCs/adequacy limits, and jurisdictional geo-fencing at the envelope.

Reference patterns by use case

  • Clinical care (FHIR-native).

    • Request: treating clinician queries medication list for current episode.

    • Envelope: checks treatment purpose + clinician role + device posture → releases minimal meds subset; logs signed event.

    • BTN: if request originates from untrusted app or fails attestation, payload is neutralised.

  • Claims & payments.

    • Request: payer verifies encounter details for adjudication.

    • Envelope: releases coded, necessary fields only (e.g., diagnosis/procedure codes, dates, totals), masks notes; binds to payment purpose; logs event for HIPAA audit.

  • Public health / registries.

    • Request: authorised disease surveillance pull; civil birth registry feeds immunisation register.

    • Envelope: releases de-identified/aggregated data where possible; if identifiable is required, enforces statutory mandate and geo limits; all exports get proof records.

  • Research & secondary use.

    • Request: ethics-approved cohort extraction.

    • Envelope: applies consent flags, opt-outs, and governance approvals; favours synthetic/de-identified sets; all disclosures carry use-limited licences and callbacks for revocation.

  • Citizen portals & subject rights.

    • Request: individual requests access or correction.

    • Envelope: authenticates citizen; releases a human-readable view plus a structured extract; logs event; triggers downstream correction workflows.

Security controls that matter in practice

  • ABAC with purpose claims (not just RBAC).

  • Just-in-time keys and per-record cryptographic material.

  • Device posture checks (managed device? encrypted storage? screen-cap guard?).

  • Rate-limits & anomaly detection for bulk pulls.

  • Geo-fencing & data residency at envelope and transport layers.

  • Tamper-evident logs with cryptographic chaining and external timestamping.

  • Separation of duties for KMS/HSM operations and policy administration.

Request More Information

Outcomes, Governance & Assurance

What success looks like

  • Lower breach impact. If data is exfiltrated, it’s neutralised and non-reusable—materially reducing harm, notification scope, and regulatory exposure.

  • Measurable compliance. You can demonstrate GDPR/HIPAA/NIS2 controls with signed evidence rather than screenshots and policy PDFs.

  • Operational trust. Clinicians, clerks, insurers, and caseworkers get faster, minimal, purpose-bound access—reducing delays and over-sharing.

  • Vendor accountability. Third parties operate under the same envelope rules; you gain proof of proper handling across processors and sub-processors.

  • Citizen confidence. Transparent audit trails and narrow disclosures restore trust in digital health and public services.

Governance model

  • Policy board. DPO/CISO, clinical governance, records management, and legal agree the purpose catalogue, release rules, and retention schedules.

  • Change control. Any new flow or data category enters a lightweight data protection impact pathway: purpose mapping → risk scoring → envelope policy update.

  • Regular drills. BTN and incident simulations with agency/provider/vendor participation; lessons learned feed back into rulesets.

  • Independent assurance. Optional third-party attestation of PastWipe configurations and evidence trails; map to ISO/IEC 27001, NIST 800-53, and local health-records acts.

Answering regulator & auditor questions—proactively

  • “Show lawful basis and purpose for this disclosure.” → Envelope event includes purpose claim, legal basis/mandate reference, and released fields.

  • “Prove data minimisation.” → Diff between source record and disclosed subset; automated policy justification.

  • “Who accessed this patient/record and why?” → Immutable, signed audit events, filterable by subject, purpose, role, timeframe.

  • “How do you prevent cross-border leakage?” → Geo-fenced keys, transfer controls tied to SCCs/adequacy; events show jurisdiction at access time.

  • “What happens if a vendor is breached?” → BTN revokes cryptographic material; vendor copy becomes non-reusable; report lists affected minimal slices, not entire databases.

Procurement & risk checklist

  • Standards alignment: FHIR, IHE, DICOM; OAuth2/OIDC; eIDAS-compatible signatures; NIS2 operational expectations.

  • Key management: In-country KMS/HSM, key-split and escrow; customer-owned keys where required.

  • Evidence pipeline: SIEM/SOAR integrations; immutable storage; reporting for DPO/HIPAA audits; API for regulator read-only access if mandated.

  • Data lifecycle: Retention schedules; legal holds; verifiable erasure or sealing; subject-rights workflows.

  • Resilience: High availability; fail-safe policy enforcement; graceful degradation that defaults to safe minimal releases or deny.

  • Optional RepSec: For multi-party ecosystems that want shared semantics and portability of controls.

Getting started (typical first steps)

  1. Discovery workshop (2–3 hours). Map top 5 flows (health + public records). Identify quick wins for envelope enforcement and BTN.

  2. Technical spike (2–4 weeks). Integrate OIDC/OAuth2, wrap a FHIR or registry extract, stream evidence to SIEM, run a BTN drill.

  3. Pilot sign-off. Validate with compliance and clinical/records leadership; agree the purpose catalogue and retention timers.

  4. Scale plan. Prioritise agencies/providers/vendors; formalise governance cadence and audit pack.

What you can do next

  • Book a demo to see envelope enforcement on a real FHIR/registry flow.

  • Request the solution brief for Health & Records (architecture diagrams, policy catalogues, audit examples).

  • Contact Sales to scope a pilot that fits your compliance and residency requirements.

Selected resources (for your teams)

Request More Information