Client-side demo of the intended pattern
localStorage). For real-world clinical deployment, upload must run inside your covered-entity boundary with server-side encryption-at-rest, audit logging, BAAs, role-based access, and approved transport. The schemas and analysis demonstrated here transfer to that infrastructure unchanged.
Reference: Carmona & Gillio (2026), An Operating System for Population Health, §5.1 — the FFH Community ROI Engine and its HIPAA-ready Client Configuration workspace. This v2 implements the Hypothesis Lab pattern: which dose of which intervention predicted which saving, for whom.
Encrypt-at-rest key
Passphrase → PBKDF2-SHA-256 (250,000 iter) → AES-GCM-256 key. The passphrase is never stored. The salt + IV are stored unencrypted alongside the ciphertext (they are not secret). If you forget the passphrase the blob on this device is unrecoverable.
Provider data upload
Accepted formats: CSV with headers, or JSON array. Required + optional fields:
patient_id— opaque hash from your EHR (never the raw MRN).enrollment_date— ISO date the patient was enrolled in the FFH program (used to split baseline vs intervention windows).date— encounter date (ISO).encounter_type—ed_visit|readmission|inpatient|office_visit|rx_fill|missed_appt|preventive.encounter_cost— direct cost USD.condition— matches the PHIT condition slug for that patient.rx_filled_pct— optional 0–100, percent of prescribed fills in this window.hh_size,hh_member_ids— household size + comma-separated peer ids.cohort_tags— optional comma-separated cohort labels (e.g.,young_mom,medicaid,rural).
What's in the vault
Locked.
Your own variables (staff time, VBC payments, anything)
Add as many custom dollar levers as you want. Each one has a label, a dollar value, and an "applies to" rule that tells the engine how to multiply it. Use this for things only your practice can quantify — RN minutes saved per avoided ED visit, MD time per readmission, VBC quality-bonus payments, training cost amortized per enrolled member, panel-level shared savings, anything. Custom levers roll into the totals and the aggregate JSON; they also persist in the encrypted vault.
| Label | Dollar value | Applies to | Sign |
|---|
Match · before-vs-after · dose-response
Join utilization with the existing PHIT queue by patient_id. Compute baseline vs intervention windows by enrollment_date. Correlate engagement variables with observed savings. Cohort chips below filter every downstream view.