This document identifies exactly which database tables in Cadence contain PHI, which contain PHI-adjacent metadata, and which contain none — and traces how PHI actually moves through the system end to end. It is the field-level companion to the Risk Analysis's asset-level description (Asset 1), suitable as a BAA attachment or auditor exhibit.
migrations/*.sql in the versioned git repo) as of 2026-07-16, not a design document — this reflects what the system actually stores today.| Table | PHI Fields | Category |
|---|---|---|
patients | first_name, last_name, dob, phone, street_address, city, state, zipcode, gender, race, ethnicity | Demographics |
appointments | patient_id (FK), appt_time/date, appt_type, status, close_notes | Visit/encounter data |
patient_notes | patient_id (FK), content (longtext), note_type, contact_datetime | Clinical/contact narrative |
patient_flag_assignments, patient_history, patient_review_alerts | patient_id (FK) plus flag/history detail | Care coordination metadata |
charts | 147 columns — demographics (duplicated from patients at time of chart creation), dispatch/response times, chief complaint, allergies, medical history, current medications, narrative, disposition, billing (payer/policy/HCPCS/ICD-10), crew, consent/signature | Full clinical record (PCR) |
chart_vitals, chart_medications, chart_procedures, chart_interventions, chart_documents, chart_images, chart_destination, chart_denials | chart_id (FK) plus clinical detail specific to each (vitals readings, medication doses, procedure notes, uploaded images/documents) | Chart extensions — inherit PHI via chart_id |
chart_billing_ext, chart_crew_ext | chart_id (FK) plus HCPCS/ICD-10 codes, insurance details, crew certification numbers | Billing/crew extension of a PHI-bearing chart |
note_images | Images attached to a patient_notes entry — may include clinical photos or ID documents | Clinical images |
video_consult_log | patient_id, recipients (phone/email), consent_confirmed_at, duration | Telehealth contact record |
| Table | What it contains | Category |
|---|---|---|
audit_log | Who accessed/changed which resource_id (patient/chart/etc.) and when — required by HIPAA §164.312(b), not itself a PHI record | Access audit trail |
pcr_audit_scores, pcr_audit_sessions | QA review scoring of a chart — references chart_id, contains review commentary that may quote chart content | Chart QA metadata |
sms_log, appt_notifications | Delivery records for SMS/notifications about appointments — phone numbers and appointment references, not clinical content | Communication metadata |
backup_log | Backup job metadata (size, row counts, timestamp) — never the data itself | Operational metadata |
| Tables | Why |
|---|---|
medical_conditions, medications_ref, procedure_types, procedure_categories, procedure_supply_rules, service_types, appt_types | Reference/lookup vocabularies (lists of condition names, medication names, procedure codes) — not tied to any individual patient |
sched_users, user_permissions, password_history, login_otp, login_otp_attempts, active_sessions, api_keys, permission_elevation_requests, tracked_devices | Workforce (EMStool/client staff) account and auth data — not patient PHI, though still sensitive and separately access-controlled |
companies, company_lobs, company_importers, company_user_access | Client organization structure/configuration, not patient data |
inventory_items, inventory_bins, inventory_transactions, unit_inventory, unit_settings, narcotics_items, narcotics_transactions, narcotics_unit_stock, narcotics_count_schedule, device_inspections, facilities | Equipment, supply, and controlled-substance inventory tracking — facility/unit-level, not patient-linked |
eod_reports | Crew shift-level notes (mileage, safety/event narrative) — not linked to any specific patient record |
calendar_todos, day_labels, calendar_shares, recur_series, uhu_targets, page_visits, sys_notifications, idempotency_log, video_call_types | Scheduling metadata, utilization targets, and system/operational bookkeeping |
How PHI actually moves through the system, end to end:
Two narrow paths leave the deployment boundary to a third party, neither carrying clinical content:
See the Vendor Security Register (HIPAA-SEC-012) for the full vendor list and each one's data exposure.
This inventory should be re-derived from the actual schema (not carried forward from memory) whenever a migration adds a new table or column that could plausibly hold patient-identifiable data, and reviewed in full annually alongside the other HIPAA policy documents.