Handling Sensitive Health Data in Rails: Security and Compliance Basics for HealthTech

Building a Rails application that touches health data changes the baseline, not just the checklist. In France that means HDS (Hébergement de Données de Santé) hosting requirements; more broadly it means treating certain fields as categorically different from the rest of your schema, not just "sensitive-ish."

Know which fields actually count

Health data under GDPR isn't limited to obvious fields like a diagnosis. A field that lets you infer health status, an appointment type, a medication name, even certain free-text notes, falls under the same stricter rules. The first step of any compliance review is mapping exactly which columns, across every table, carry that inference risk, because most teams underestimate the list.

Encrypt at the field level, not just at rest

Whole-disk or whole-database encryption protects against a stolen hard drive; it does nothing against a compromised database credential or an overly broad read replica. For genuinely sensitive fields we use Rails' built-in attribute encryption, so the value is encrypted in application memory before it ever reaches a query log, a backup, or a replica.

class PatientRecord < ApplicationRecord
  encrypts :diagnosis_notes, deterministic: false
end

Access needs an audit trail, not just an access control list

Who is allowed to view a record matters less, for compliance purposes, than who actually did, and when. Every read of a sensitive record, not just every write, gets logged with the acting user and a reason code in systems we build for this space, because that log is what an auditor asks for first, and it's the only reliable way to detect an employee browsing records they had no legitimate reason to open.

Hosting is a decision, not a checkbox

HDS certification applies to the hosting provider and to specific contractual and technical commitments, not to your application code. Confirm early, in writing, whether your hosting provider actually holds current HDS certification for the specific services you're using, since a certified provider can still offer uncertified services, rather than discovering the gap during a client's due diligence.

None of this is exotic engineering. It's discipline applied consistently to a smaller set of fields than people expect, which is exactly why it's easy to get partially right and dangerous to leave partially wrong.