# From design history to the patient

> Medical devices and healthcare. Device makers keep design, production and complaint records for years. Healthcare software must show who saw a patient's data and to whom it went. Tabellix keeps both on one verifiable record.

## What gets asked: What auditors and privacy officers ask.

A quality audit follows the device. A privacy review follows the person the record is about.

- **The design history.** Every input, output, review and verification for this design, each version as it was approved, and who approved it.
- **The complaint trail.** From the complaint to the investigation, the CAPA and the revised procedure, with nothing missing in between.
- **Access to patient data.** Every view and download of records about a person, by whom and when, including emergency access.
- **Disclosures.** For a patient or a recipient: which records left the organization, which versions, and when.
- **Emergency access.** Why someone opened a record outside their normal access, for how long, and who reviewed it afterward.
- **Supplier versions.** The approved version of each specification and quality agreement, and what each supplier received.

## How Tabellix answers: Each answer, traceable.

- **Design history as linked versions.** Design inputs, outputs and reviews are controlled documents with major and minor versions. Typed links pin each item to the version it refers to, and deactivating a link keeps its history.
- **Complaint to CAPA, in one case.** A complaint is a case record that binds its members in order: the investigation, the CAPA and the revised procedure. Holds, retention and access flow from the case to every member.
- **Access is logged first.** Views and downloads are logged before any content is served. Reads of the personal data held about a person are logged whatever [access logging mode](https://tabellix.dev/privacy-retention/) the deployment sets.
- **Accounting of disclosures.** For a recipient or an item: every version released, through which disclosure, with digests. Each disclosure is a sealed, signed bundle that verifies offline.
- **Break-glass, always reviewed.** Emergency access needs a fresh sign-in and a justification, is time-limited, raises an alert, logs every access with the session, and is reviewed through a built-in record and workflow.
- **Suppliers without seats.** Specifications and quality agreements reach suppliers through expiring, watermarked shares, with an agreement before content and a report of what each one fetched.

## Typical records: Device and patient records, one engine.

The same record layer serves the design team, the complaint unit and the release-of-information desk. Each type is configuration.

| Record | Kind | What it holds |
| --- | --- | --- |
| Design input specification DI-0108 | document | Versioned, reviewed and approved with signatures; linked to the outputs and verifications that answer it. |
| Design review | event record | Attendees, outcome and the document versions reviewed, signed with the meaning "reviewed". |
| Sterilization cycle | event record | Cycle, load, parameters and result sent by the controller through the API; a source reference already captured is not stored twice. |
| Complaint CMP-0311 | case record | Intake, investigation, reportability decision and closure as lifecycle steps; the device history and the CAPA as members. |
| Emergency access review | case record | Opened for each break-glass session: the justification, the records opened and the reviewer's signed conclusion. |
| Release of information request | case record | The request and the records released as a sealed disclosure, with the accounting entry for the patient. |

[Documents, records and the evidence about both](https://tabellix.dev/records/)

## Mapped frameworks

**Controls map to:** ISO 13485, HIPAA.

Product controls map to these regulations and standards and provide evidence for your own validation and audits.

[How the evidence is produced and verified](https://tabellix.dev/trust/)

## Go deeper

- [Privacy and retention](https://tabellix.dev/privacy-retention/): Keep what the law requires and erase what privacy law allows, with the audit trail intact.
- [Security](https://tabellix.dev/security/): Deny by default, hidden existence, policy as code and a hardened platform.
- [Records, not files](https://tabellix.dev/records/): Documents, records and the evidence about both, and what belongs in a system of record.
- [Trust and verifiability](https://tabellix.dev/trust/): A hash-chained ledger, signed checkpoints and evidence an auditor verifies offline.
- [Life sciences and pharma](https://tabellix.dev/industries/life-sciences/): Controlled documents, deviations, CAPA, and training records, designed for 21 CFR Part 11 and EU GMP Annex 11, and built for the human oversight the draft EU GMP Annex 22 expects for generative AI.

## FAQ: Common questions.

### Does Tabellix replace a device QMS or an EHR?

No. It is the record layer underneath them. The QMS, the EHR or the complaint system keeps its own screens and workflows, and keeps its documents, records, signatures, retention and audit trail in Tabellix.

### How is patient data protected?

Every file is encrypted with its own key and checked on every read. Personal data about each person the records concern sits under that person's own key. Users who may not see a record cannot tell that it exists.

### How long are device records kept?

As long as each record type requires, including permanent retention, above a minimum the deployment enforces. When rules overlap the longest period wins, a legal hold blocks disposition, and records administrators approve each disposal.

### Can AI agents work on complaints?

An agent can gather the device history and draft the complaint summary, under the person's own permissions. High-risk actions wait for the person to confirm out of band with a fresh sign-in, and under the regulated preset only named people approve and sign.

### How does a healthcare software vendor embed Tabellix?

Run it on Kubernetes in your cloud or your customer's, with sign-in through your OIDC provider and people provisioned over SCIM. Your product calls one contract over gRPC or REST, and your product name appears on every customer-visible surface Tabellix provides.

## Contact

Tell us what you build and who audits it. We'll show you how Tabellix fits into your product and how it answers your auditors' most common questions.

Contact form: https://tabellix.dev/contact/

---

This page as HTML: https://tabellix.dev/industries/medical-devices/ · [Site guide for language models](https://tabellix.dev/llms.txt)