Reference architecture · 10 minute read

Modified Retention is one boundary—not the whole architecture.

This illustrative flow shows the questions a health-tech team must answer around an OpenAI API workload. Modified Retention does not by itself make a workload compliant.

Source review: 22 July 2026Sanitized, fictional example

Illustrative reference flow

Keep PHI movement explicit.

Example: an authorized care-team user requests a draft summary from an application. The organization must validate every boundary and minimize what is sent.

[Authorized user]
       |
       v
[Organization identity] -- deny by default --> [Application authorization]
       |                                              |
       |                                    minimum necessary input
       |                                              v
       |                                      [Prompt assembly]
       |                                              |
       |                              approved endpoint + project policy
       |                                              v
       |                                       [OpenAI API]
       |                                              |
       |                                      generated draft only
       |                                              v
       +------------------------------------ [Human review gate]
                                                      |
                                             approve / edit / reject
                                                      v
                                           [Authorized destination]

Separate control paths: audit events -> security monitoring
                        errors       -> redacted diagnostics
                        incidents    -> response and vendor process

Every arrow is a decision about authorization, minimization, retention, logging, review, and downstream use—not proof of compliance.

Five responsibility layers

Do not collapse contract, configuration, and code.

Contract and BAA boundary

Confirm the organization, eligible service, permitted functionality, endpoint, and contractual terms directly with OpenAI and qualified advisers.

Account and project configuration

Verify Modified Retention provisioning, project inheritance, endpoint-specific storage behavior, feature eligibility, and who can change these settings.

Application architecture

Enforce authorization, PHI minimization, input validation, tool restrictions, output handling, human review, and safe failure behavior.

Cloud infrastructure

Protect secrets, network paths, databases, queues, observability systems, backups, deployments, and the other vendors in the flow.

Operations and oversight

Assign monitoring, incident, change-management, access-review, training, model-evaluation, and vendor-review owners.

Customer decisions

Questions to close before a pilot.

Architecture decisions and evidence
Customer decision	Evidence to collect	Stop condition
Which fields are minimum necessary?	Approved data dictionary and prompt template	Raw record forwarding is still possible
Who may invoke the workflow?	Identity group, authorization test, access review	Shared accounts or ambiguous end-user identity
Which endpoint and features are used?	API inventory mapped to current eligibility and storage documentation	Unreviewed tool, file, search, MCP, or stateful feature
What is logged?	Redacted event schema and negative tests for content leakage	Prompts or outputs reach general application logs
Where is human review required?	Workflow state, reviewer role, reject path, audit evidence	Generated content can become a clinical or customer record automatically
How are incidents handled?	Runbook, vendor contacts, containment test, notification owner	No owner or tested containment path

Official sources

Configuration must match current documentation.

Apply the flow

Map your real system with sanitized facts.

Do not send sensitive information.

Review the Architecture Sprint