Secure-Audit-MD

SecureAuditMD is a medical-grade, multi-tenant compliance checklist and audit monitoring platform, HIPAA regulations (CFR Title 45) under a Zero-Trust security, hardened data, and AI safety gates

Comment

SecureAuditMD - SaaS PWA Compliance & Audit Platform

SecureAuditMD is a medical-grade, multi-tenant compliance checklist and audit monitoring platform engineered to meet strict HIPAA regulations (CFR Title 45) under a Zero-Trust security model, hardened data pipelines, and AI safety gates.

1. Zero-Trust Architecture Diagram

The system guarantees physical separation of databases per clinic using a schema-per-tenant isolation driver, backed by client-side local-first buffering and server-sealed cryptographical verification:

graph TD
    %% Define Styles
    classDef client fill:#1E293B,stroke:#3B82F6,stroke-width:2px,color:#fff;
    classDef server fill:#0F172A,stroke:#10B981,stroke-width:2px,color:#fff;
    classDef db fill:#31102F,stroke:#EC4899,stroke-width:2px,color:#fff;

    %% Client Tier (PWA Tablet)
    subgraph PWA_Client["PWA Tablet Context (Locked Workstation Mode)"]
        UI["React UI (PWA Client)"]
        WebAuthn["WebAuthn Authenticator (Face ID / Touch ID)"]
        Queue["Encrypted IndexedDB Queue (WebCrypto AES-GCM)"]
        SessionKey["Session-Bound Key (Cleared on Logout)"]
        CryptoClient["Asymmetric Digital Signature Engine (ECDSA P-256)"]
    end

    %% Backend Tier (Secure HTTPS Endpoint)
    subgraph Express_Backend["Express HTTPS Server (Port 8443)"]
        Router["Dynamic Router / Controller"]
        AuthInterceptor["Asymmetric Signature & License Validator"]
        ServerTime["Server UTC Timestamp Generator"]
        AISafety["HIPAA-Compliant AI Inference Gateway"]
        PDFGen["AES-256 PDF Encryption Engine"]
    end

    %% Database Tier (Isolated Schemas)
    subgraph Database_Layer["Database Storage (Schema-per-Tenant)"]
        MasterDB["master.db (Global SaaS Subscriptions)"]
        DBPool["LRU Connection Pool & Idle Sweeper"]
        TenantDB1["tenant_clinic_9999.db"]
        TenantDB2["tenant_clinic_8888.db"]
    end

    %% Connections
    UI -->|1. WebAuthn MFA PIN Challenge| WebAuthn
    UI -->|2. Buffer check items offline| Queue
    SessionKey -->|AES-GCM Encryption key| Queue
    Queue -->|3. Signed payload hash| CryptoClient
    CryptoClient -->|4. Push signed JSON payload + SPKI Public Key| Router
    Router -->|5. Verify ECDSA signature & tier| AuthInterceptor
    AuthInterceptor -->|Lookup subscription| MasterDB
    AuthInterceptor -->|6. Overwrite with server UTC| ServerTime
    ServerTime -->|7. Query / Write DB| DBPool
    DBPool -->|Isolated file descriptors| TenantDB1
    DBPool -->|Isolated file descriptors| TenantDB2
    UI -->|8. Request AI summary| AISafety
    AISafety -->|9. JSON Schema response validation| UI
    UI -->|10. Download encrypted PDF report| PDFGen

    %% Apply Styles
    class UI,WebAuthn,Queue,SessionKey,CryptoClient client;
    class Router,AuthInterceptor,ServerTime,AISafety,PDFGen server;
    class MasterDB,DBPool,TenantDB1,TenantDB2 db;

2. Core Pillars of the Security Model

🛡️ Zero-Trust SaaS Design (HIPAA PHI Isolation)

  • Schema-per-Tenant database Driver: The backend dynamically mounts isolated SQLite instances (tenant_<clinic_id>.db) per clinic, preventing cross-tenant leakage.
  • Minimum Necessary Workstation Lock: Tablet interfaces boot in Locked / View-Only Mode. Full settings, dashboards, and BAA panels are hidden until verified via native WebAuthn (Face ID / Touch ID) or hashed PIN credentials.
  • Clean Sweep Logoffs: Triggering logout or the 10-minute inactivity timer immediately wipes the client's sessionStorage and returns the Clear-Site-Data: "*" header from the backend to sweep the browser cache.

⚙️ Pipeline Hardening (Audit Integrity)

  • Encrypted Local Storage (IndexedDB + WebCrypto): Offline event queues are stored in IndexedDB encrypted at-rest using AES-GCM. The 256-bit encryption key is derived dynamically and held in transient memory (sessionStorage) only during active staff sessions. When logged out, the key is destroyed, locking all offline data.
  • Asymmetric Signature Stamping (ECDSA P-256): Checklists are cryptographically signed using a device-specific P-256 key pair. The private key is flagged as non-extractable and held inside the browser's cryptographic sandbox. The backend verifies the SPKI public key signature against the raw payload natively via crypto.verify, ensuring non-repudiation.
  • Server-Controlled Time Stamper: The backend sync controller intercepts payloads and overwrites client-submitted timestamps with the server's absolute UTC time before database writes.
  • Transport Security: The backend forces self-signed HTTPS certificates on port 8443 with helmet headers to secure the local pipeline.
  • SQLite Connection Pool (LRU & Sweeper): Database connections are managed via a dynamic Least Recently Used cache (cap: 20 active connections) with a sweeper that closes and unloads idle file handles after 5 minutes, preventing file descriptor exhaustions and concurrency lock timeouts.

🤖 AI Safety and Gating (Premium Tier)

  • HIPAA-Compliant AI Gateways: Enables live routing of analyses to private self-hosted SLMs, Azure OpenAI with BAA, or AWS Bedrock zero-data-retention (ZDR) endpoints via AI_GATEWAY_URL and AI_GATEWAY_KEY configuration. Falls back to a local secure deterministic rule-based analysis parser if no endpoint is configured.
  • Structured JSON Schema Output: AI API calls enforce strict response schemas (response_format: { type: "json_schema" }) to eliminate parsing crashes and prevent prompt injection escapes entirely.

3. Production TLS & Reverse Proxy Setup (Caddy)

Modern web browsers enforce security guidelines that restrict Service Workers (offline sync / PWAs) and WebAuthn APIs (biometrics) on insecure hosts or endpoints with untrusted self-signed certs.

To run the application with full biometric capabilities without paid certificates, terminate TLS via a local reverse proxy like Caddy (which automatically provisions internal certificates and installs them into your machine's trusted certificate store):

Caddyfile Configuration Example:

Create a file named Caddyfile in your root directory:

# Map local domain for PWA installation & biometrics trust
secure.auditmd.local {
    # Reverse proxy frontend dev server
    reverse_proxy / http://localhost:5173

    # Route backend endpoints to HTTPS port
    reverse_proxy /api/* https://localhost:8443 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

Steps:

  1. Run caddy trust to add Caddy's local CA to your operating system's trust store.
  2. Run caddy start to launch the reverse proxy.
  3. Map 127.0.0.1 secure.auditmd.local in your hosts file (C:\Windows\System32\drivers\etc\hosts).
  4. Access https://secure.auditmd.local to test the application with trusted local SSL, enabling biometrics, service workers, and PWA installation prompts.

4. How to Run Locally

See walkthrough.md for full credentials, pre-seeded testing keys, and step-by-step startup logs to compile and run the PWA.

Built With

Share this project:

Updates