openevidence-data-handling

# OpenEvidence Data Handling ## Overview OpenEvidence provides AI-powered clinical evidence synthesis for healthcare professionals. Data types include clinical queries (potentially containing PHI), evidence citations from medical literature, patient-contextualized responses, research paper references, and usage analytics. All data handling must comply with HIPAA (PHI safeguards, minimum necessary standard, BAA requirements), GDPR for EU clinicians, and FDA guidance on clinical decision support. Query data may contain patient identifiers, diagnoses, or treatment details that require de-identification before storage or analytics. ## Data Classification | Data Type | Sensitivity | Retention | Encryption | |-----------|-------------|-----------|------------| | Clinical queries (may contain PHI) | Critical | De-identify within 24h, purge raw in 7 days | AES-256 + TLS, field-level for PHI | | Evidence citations | Low | Indefinite (public literature) | TLS in transit | | Patient-contextualized responses | High (derived PHI) | 30 days max, then de-identify | AES-256 at rest | | Research paper metadata | Low | Indefinite | TLS in transit | | Clinician usage analytics | Medium | 1 year (de-identified) | AES-256 at rest | ## Data Import ```typescript interface ClinicalQuery { queryId: string; clinicianId: string; queryText: string; patientContext?: { age?: number; sex?: string; conditions?: string[] }; timestamp: string; } async function submitClinicalQuery(query: ClinicalQ...