What this is. What this isn't.

The Solano-specific arithmetic

How Guardians of Solano fits the existing stack

We layer above the operators already doing the work. Data flows into Bitfocus Clarity (HMIS), not the other way. We do not displace contracts, EHRs, or coordinated-entry processes.

HMIS interoperability is the floor. We'd work with Housing First Solano (Bitfocus Lead) and CAP Solano JPA (HMIS Lead / CoC Collaborative Applicant) to scope the integration before any pilot data flows.

Privacy and statutory architecture

HIPAA architecture (PHI from covered entities)

Guardians of Solano is not a HIPAA Covered Entity. When Guardians of Solano operates as a Business Associate to a Covered Entity, all PHI handling will be governed by signed Business Associate Agreements and we will be directly liable under 45 CFR 164.500(c) for the Security Rule and applicable Privacy Rule provisions (per the HITECH Act, 78 FR 5566).

• Business Associate Agreements — templates ready for execution with every covered entity before any data flows: Solano County HHS, Solano Sheriff (jail medical via WellPath), Partnership HealthPlan (DMC-ODS), Bitfocus Clarity HMIS Lead. No PHI moves until BAAs are signed. Renewed annually thereafter.
• Minimum necessary, enforced at the database via Postgres Row-Level Security policies in Supabase. The application code never sees PHI it isn't authorized to read; the database returns zero rows for unauthorized roles.
• Encryption: TLS 1.3 in transit, AES-256 at rest, keys managed via Supabase Vault. PHI columns isolated from non-PHI columns at the schema level. No PHI in URLs, application logs, or analytics events.
• Audit log: every PHI read and write records actor, subject record, action (read/write/export/print), timestamp, source IP, device fingerprint, and outcome (success/deny). Append-only and hash-chained; admins cannot edit history. Retained 6 years (HIPAA minimum, 45 CFR 164.316(b)(2); 10 where Medi-Cal/CalAIM contracts require). Users can request their own access log.
• Break-glass oversight access requires an explicit reason code, auto-notifies the record owner, logs the override, and surfaces on the quarterly compliance review. HHS Directors do not have ambient access to all records — every elevation is recorded.
• Right of access · right of deletion: users can export their own full record and (subject to state retention rules) request deletion. PHI-marked records follow HIPAA retention requirements; the user sees the retention schedule before confirming.
• Incident response: suspected breach triggers automated containment, user notification within 60 days per the HIPAA Breach Notification Rule, and reporting to HHS OCR. Tabletop exercises run quarterly.

42 CFR Part 2 architecture (SUD treatment records)

SUD treatment records received from DMC-ODS providers (e.g., Partnership HealthPlan, CalAIM Justice-Involved Reentry) are handled under 42 CFR Part 2 as amended February 16, 2024 (compliance deadline February 16, 2026 — now in force). We obtain a single written treatment-payment-operations consent meeting §2.31 form requirements, segregate SUD counseling notes behind separate consent, log every redisclosure, and propagate the Part 2 prohibition-on-redisclosure notice. Part 2 records are flagged at the row level and never join HMIS or general-care workflows.

VAWA architecture (domestic-violence survivor data)

• Comparable Database operated by Family Justice Center / SafeQuest, not Guardians of Solano — per 24 CFR §578.103(b), the victim-service provider operates the Comparable Database; Guardians of Solano is the software vendor, not the data controller. Data conforms to VAWA confidentiality (34 U.S.C. §12291(b)(2), formerly §40002(b)(2)), FVPSA (42 U.S.C. §10406(c)(5)), and VOCA. Never in shared HMIS.
• No aggregation to County or any cross-agency dashboard: Guardians of Solano does not transmit DV-survivor data — identified or aggregated — to County HHS, HMIS, or any cross-agency dashboard. The FJC retains sole custody. (NNEDV Safety Net: in small populations, even ethnicity + age + ZIP can re-identify survivors.)
• No cross-workflow queries: the discharge-coordination, reentry, BH-discharge, and homelessness workflows cannot query the DV database. Schema separation is enforced at the database boundary, not the application layer.
• Safe-at-Home / Address Confidentiality Program participants are address-suppressed at the schema level. Solano enrolling agencies are FJC, the DA Victim Unit, and SafeQuest.
• Access: authorized FJC navigator + the survivor only. Any survivor-initiated share requires written, time-limited, revocable consent logged in the audit trail (VAWA / FVPSA §10406(c)(5) standard). Separate audit log. Separate retention.

Dignity floor (non-negotiable, structural)

• Tier 0 emergency resources require no account, no ID, no phone number. Structural design, not policy.
• HMIS Universal Data Elements conform to FY 2024 HMIS Data Standards (effective October 1, 2023). Guardians of Solano is not an HMIS; data flows into Bitfocus Clarity (the Solano HMIS) as the system of record via the JPA's standard integration path, not around it.
• Individual user data is never shared with law enforcement, immigration enforcement, or any agency that could use it adversarially. In the entity charter, not just the privacy policy.
• No emergency resource is ever gated by tier, verification, abuse-flag status, or behavior history.

See it operationalized: The full role-based visibility matrix and HIPAA compliance posture are demonstrated on the discharge-coordination dashboard. Ten roles, each with explicit PHI-access scope, audit treatment, and row-level access controls.

The engine behind this surface

Solano's first surface is homelessness coordination. The same data joins and reporting infrastructure also serve justice-involved reentry (Solano committed $3.5M to CalAIM-Reentry; no county-side tool exists today), behavioral-health discharge (Beck Campus doubles CSU capacity in 2028), foster-youth aging out, DV-survivor transition, and veterans in transition. We mention this so the integration architecture isn't scoped as homelessness-only — the schema decisions made in the Solano pilot determine what adjacent surfaces can be added without re-engineering. Solano homelessness gets all our attention until it works.