Context
This issue tracks privacy and clinical-safety findings from the Claude Code privacy-clinical-safety-reviewer read-only review of the MedicalCare pilot.
No code was modified by the review.
Critical findings
1. Patient names may be sent to AI from visit improvement flow
RecordAudio.jsx sends raw therapist transcription text to the AI improvement endpoint. If the therapist includes a patient name in the note, that name may be sent to the external AI service.
Recommended next step:
- Move the AI privacy warning above the
Improve with AI action.
- Add a pre-send confirmation or name/identifier warning before sending text to AI.
- Consider server-side preprocessing in
/api/ai/improve-visit.
2. No per-patient photo/video consent enforcement
Video and Motion Review entry points can be opened without a recorded per-patient consent state.
Recommended next step:
- Add
videoConsentGiven and videoConsentDate to the patient record.
- Show consent status in the patient header and video section.
- Disable video launch buttons until consent is confirmed.
High findings
3. Patient data is stored in plaintext localStorage
Patient records and clinical data are stored in browser localStorage and backup localStorage keys.
Recommended next step:
- Add visible pilot/onboarding notice explaining that data is stored locally on the device.
- Warn against shared/public computers.
- Do not claim encryption or legal compliance until implemented.
4. Report AI scrubbing does not remove patient names
toDeidentifiedVisit removes emails and long numbers, but not patient names or therapist names.
Recommended next step:
- Rename the function or improve its behavior.
- Add a confirmation before report generation: "These notes will be sent to AI. Have you removed patient names?"
5. Patient full name is passed to MaddVideo in URL query parameters
The video module receives patientName in URL params. URLs may appear in browser history, logs, analytics, and screen sharing.
Recommended next step:
- Pass only
patientId and therapist id in the URL.
- Resolve display name internally where possible.
6. Video iframe pre-grants camera and microphone permissions
VideoPanel.jsx uses allow="camera; microphone; ..." without a MedicalCare-level consent gate.
Recommended next step:
- Gate opening the video panel behind recorded video consent.
- Only allow camera/microphone after consent is confirmed.
7. AI draft state is not visually explicit before saving
After AI improvement, the textarea is replaced with AI-improved text and can be saved without a strong review prompt.
Recommended next step:
- Add a visible banner: "AI draft - please review before saving."
Medium findings
8. PrivacyGate may not reappear for already-logged-in users after text changes
The app already uses a versioned privacy acceptance key. This should be intentionally incremented when pilot privacy wording changes.
Recommended next step:
- If PrivacyGate text changes, increment the acceptance key version.
9. AI privacy notice appears below the Improve with AI button
The warning is easy to miss because it appears after the action.
Recommended next step:
- Move the warning above the button or show a first-use confirmation.
10. Report placeholder exposes live patient name in UI
The report placeholder uses actual patient name and patient id.
Recommended next step:
- Replace live placeholder data with generic placeholder text.
Recommended implementation order
- Add video/photo consent field and gate video actions.
- Fix AI flows: warning placement, AI draft banner, pre-send confirmation.
- Remove patient full name from video URLs.
- Fix report placeholder and report AI warning.
- Add localStorage/device privacy notice for pilot users.
- Version PrivacyGate if wording changes.
Scope rule
Do not solve all items in one large PR. Split into small focused branches, preferably:
fix/privacy-video-consent-gatefix/ai-privacy-warning-and-draft-statefix/remove-patient-name-from-video-urlfix/report-ai-privacy-copy
Notes
These are product privacy and clinical safety risks, not legal determinations. Avoid claims such as HIPAA compliant unless verified separately.
Context
This issue tracks privacy and clinical-safety findings from the Claude Code
privacy-clinical-safety-reviewerread-only review of the MedicalCare pilot.No code was modified by the review.
Critical findings
1. Patient names may be sent to AI from visit improvement flow
RecordAudio.jsxsends raw therapist transcription text to the AI improvement endpoint. If the therapist includes a patient name in the note, that name may be sent to the external AI service.Recommended next step:
Improve with AIaction./api/ai/improve-visit.2. No per-patient photo/video consent enforcement
Video and Motion Review entry points can be opened without a recorded per-patient consent state.
Recommended next step:
videoConsentGivenandvideoConsentDateto the patient record.High findings
3. Patient data is stored in plaintext localStorage
Patient records and clinical data are stored in browser localStorage and backup localStorage keys.
Recommended next step:
4. Report AI scrubbing does not remove patient names
toDeidentifiedVisitremoves emails and long numbers, but not patient names or therapist names.Recommended next step:
5. Patient full name is passed to MaddVideo in URL query parameters
The video module receives
patientNamein URL params. URLs may appear in browser history, logs, analytics, and screen sharing.Recommended next step:
patientIdand therapist id in the URL.6. Video iframe pre-grants camera and microphone permissions
VideoPanel.jsxusesallow="camera; microphone; ..."without a MedicalCare-level consent gate.Recommended next step:
7. AI draft state is not visually explicit before saving
After AI improvement, the textarea is replaced with AI-improved text and can be saved without a strong review prompt.
Recommended next step:
Medium findings
8. PrivacyGate may not reappear for already-logged-in users after text changes
The app already uses a versioned privacy acceptance key. This should be intentionally incremented when pilot privacy wording changes.
Recommended next step:
9. AI privacy notice appears below the Improve with AI button
The warning is easy to miss because it appears after the action.
Recommended next step:
10. Report placeholder exposes live patient name in UI
The report placeholder uses actual patient name and patient id.
Recommended next step:
Recommended implementation order
Scope rule
Do not solve all items in one large PR. Split into small focused branches, preferably:
fix/privacy-video-consent-gatefix/ai-privacy-warning-and-draft-statefix/remove-patient-name-from-video-urlfix/report-ai-privacy-copyNotes
These are product privacy and clinical safety risks, not legal determinations. Avoid claims such as HIPAA compliant unless verified separately.