HITRUST & HIPAA PHI
The failure mode is never a decision to leak — it is a log line somebody added while debugging.
PHI in the places nobody audits
Protected health information leaks through ordinary, well-intentioned code: a patient identifier interpolated into a log line for a support ticket, a record rendered into an exception message, a payload attached to an error report.
COODDEE scans for PHI-shaped fields reaching those sinks and refuses the card. The point is to catch it at the commit rather than in an incident review.
The model boundary
An agentic coding engine handles a second risk an ordinary scanner does not: the code and fixtures it reads can be transmitted to a third-party model provider.
The Regulated tier answers that with a private model gateway and zero outbound telemetry, so a repository containing PHI fixtures can be worked on without its contents leaving the enclave. The engine also refuses to dispatch to a vendor the operator did not explicitly select.
Tenancy is the control
Row-level security keyed on the organisation, per-tenant credential scoping and per-tenant memory addressing are the same mechanism applied at three layers. Under HIPAA, one covered entity's data reaching another's workspace is the incident — so isolation is structural rather than a filter applied on read.
HITRUST CSF certification is awarded to an organisation's assessed environment. COODDEE supplies control implementation and evidence inside that environment; it does not carry a certification on your behalf.