Pillar 05 · Discharge-coordination layer
Every release from a jail, a psychiatric facility, a foster placement, or a military separation requires a warm handoff: bed reserved, behavioral-health appointment scheduled, MAT bridge prescription active, Medi-Cal eligibility confirmed, first check-in date set. Today five different systems hold those facts and they don't talk to each other. This screen is the reconciliation layer that catches the handoff before the person falls.
Every record on this screen would be PHI in production. Access is role-based, enforced at the database level, and audit-logged. Below is the visibility matrix.
| Role | Full PHI? | Scope | Audit |
|---|---|---|---|
| Assigned case manager | Full | Their own caseload only | Every read logged · attributed · retained 6 years (HIPAA minimum) |
| Other case managers | Redacted | DC-ID + status only · no clinical detail | Aggregate view; individual lookups blocked at the row level |
| HHS Director · oversight | Break-glass | Full read on review · drill-in requires explicit reason code | Auto-notification to record owner · flagged for quarterly audit |
| Sheriff release deputy | Metadata | Release event + status · no clinical PHI, no MAT detail | Logged · facility-scoped |
| BH Discharge Coordinator | Population-scoped | BH discharge events full detail · reentry/foster as aggregate | Logged · BH-population-scoped |
| JPA Board · supervisor offices | Aggregate | County rollups · no individual records | Pre-aggregated views; no row-level PHI access path |
| Partner staff (shelter · library) | Their users | Users they themselves verified at Tier 2 · no discharge events | Logged · partner-org-scoped |
| The user themselves | Full | Their own record · export and deletion rights per HIPAA | Self-access tracked separately; user can see their own audit log |
| Public · unauthenticated | None | This page is DEMO MODE · no real PHI exposed publicly | n/a |
| DV-survivor records | Separated · VAWA | Never joined into HMIS or discharge workflow · Comparable Database operated by FJC under 24 CFR §578.103(b) · FJC navigator + survivor only | Separate audit log · VAWA 34 U.S.C. §12291(b)(2) + FVPSA 42 U.S.C. §10406(c)(5) + VOCA |
The discharge-coordination layer joins PHI from covered entities (county Behavioral Health, jail medical contractor, hospital discharge planners) with non-PHI coordination data. Guardians of Solano is not a HIPAA Covered Entity — we operate as a Business Associate to Solano County HHS and partner CEs (45 CFR 164.500(c); HITECH Act). Production deployment requires the controls below; alpha is built against seeded demonstration data only.
BAA templates are drafted and ready for execution with every covered entity before any PHI flows: Solano County HHS (BH discharge), Solano Sheriff (jail medical via WellPath), Partnership HealthPlan (DMC-ODS), Bitfocus Clarity HMIS Lead. No PHI moves until BAAs are signed. Renewed annually thereafter.
TLS 1.3 in transit. AES-256 at rest. Encryption keys managed via Supabase Vault. PHI columns isolated from non-PHI columns at the schema level. No PHI in URLs, logs, or analytics events.
Role-based access enforced at the database via Postgres Row-Level Security (RLS) policies in Supabase. Application code never sees PHI it isn't authorized to read; the database returns zero rows for unauthorized roles. Independent penetration test scheduled prior to first live county data flow.
Each entry records actor, subject record, action (read/write/export/print), timestamp, source IP, device fingerprint, and outcome. Append-only and hash-chained; admins cannot edit history. Retained 6 years per 45 CFR 164.316(b)(2); 10 where Medi-Cal/CalAIM contracts require longer. Users can request their own access log.
HHS Director or designate can read records outside normal scope only with an explicit reason code; access auto-notifies the record owner, logs the override, and surfaces on the quarterly compliance review board (convenes upon first county BAA execution).
SUD records received from DMC-ODS providers (CalAIM Justice-Involved Reentry, Partnership HealthPlan) are handled under 42 CFR Part 2 as amended February 16, 2024 (compliance deadline February 16, 2026 — now in force). Single written TPO consent meeting §2.31 form requirements; SUD counseling notes segregated behind separate consent; every redisclosure logged with the Part 2 prohibition-on-redisclosure notice propagated.
Users can request their own full record export and (where state retention rules allow) deletion. Deletion of PHI-marked rows follows HIPAA retention requirements; users see the retention schedule before confirming.
DV survivor records live in a Comparable Database operated by the FJC / SafeQuest under 24 CFR §578.103(b) — Guardians of Solano is the software vendor, not the data controller. Confidentiality governed by VAWA 34 U.S.C. §12291(b)(2) (formerly §40002(b)(2)), FVPSA 42 U.S.C. §10406(c)(5), and VOCA. No joins to HMIS, no aggregation to County, no cross-workflow queries. Accessible only to authorized FJC navigators and the survivor; survivor-initiated shares require written, time-limited, revocable consent logged in the audit trail.
Any suspected breach triggers automated containment, user notification within 60 days per HIPAA Breach Notification Rule, and reporting to HHS OCR. Tabletop exercises run quarterly.