Essential Metadata Fields (Healthcare + Finance)
Most compliance capabilities should be driven by metadata, not paths. This document defines the minimum metadata fields required for HIPAA and FINRA compliance.
Minimum Metadata (Frontmatter + Index DB)
Identity Fields
| Field | Type | Description |
|---|---|---|
doc_id | UUID | Stable unique identifier |
title | string | Document title |
description | string | Brief summary |
language | string | ISO language code (en, es, etc.) |
Classification & Sensitivity
| Field | Type | Description |
|---|---|---|
security_classification | enum | public, internal, confidential, restricted, PHI, PCI |
contains_phi | boolean | Contains Protected Health Information |
contains_pii | boolean | Contains Personally Identifiable Information |
contains_financial_account_data | boolean | Contains financial account data |
Regulatory Mapping
| Field | Type | Description |
|---|---|---|
regulations | string[] | Regulation codes: ["HIPAA-164.316", "GDPR-32", "SEC-17a-4"] |
jurisdiction | string[] | Jurisdictions: ["US", "EU", "BR"] |
Lifecycle & Retention
| Field | Type | Description |
|---|---|---|
document_type | enum | policy, sop, work_instruction, clinical_protocol, product_disclosure |
status | enum | draft, in_review, approved, effective, obsolete |
effective_date | date | When document became/becomes effective |
review_due_date | date | Next required review |
expiry_date | date | When document expires |
retention_category | string | Mapped to policy table (e.g., HIPAA-6Y, SEC-7Y) |
retain_until | date | Computed: destroy after this date |
Ownership & Context
| Field | Type | Description |
|---|---|---|
owner | string | User ID of document owner |
responsible_role | string | Role title (e.g., "Data Protection Officer") |
business_unit | string | Organizational unit |
product | string | Related product |
process | string | Related business process |
system | string | Related IT system |
Versioning
| Field | Type | Description |
|---|---|---|
version | string | Semantic version (e.g., "3.2.1") |
supersedes | UUID | Previous version doc_id |
superseded_by | UUID | Next version doc_id |
change_reason | string | Why this version was created |
Access Policy Hints
| Field | Type | Description |
|---|---|---|
allowed_roles | string[] | Roles permitted access |
allowed_groups | string[] | Groups permitted access |
need_to_know_tags | string[] | Fine-grained access tags (e.g., "oncology-team") |
YAML Frontmatter Example
---
doc_id: "550e8400-e29b-41d4-a716-446655440000"
title: "HIPAA Privacy Officer Policy"
description: "Defines the role and responsibilities of the Privacy Officer"
language: "en"
# Classification
security_classification: "confidential"
contains_phi: true
contains_pii: true
contains_financial_account_data: false
# Regulatory
regulations:
- "HIPAA-164.316"
- "HIPAA-164.530"
jurisdiction:
- "US"
# Lifecycle
document_type: "policy"
status: "effective"
effective_date: "2025-01-01"
review_due_date: "2027-01-01"
expiry_date: null
retention_category: "HIPAA-6Y"
retain_until: "2031-01-01"
# Ownership
owner: "user-123"
responsible_role: "Privacy Officer"
business_unit: "Compliance"
facility: "Hospital-A"
# Versioning
version: "3.2"
supersedes: "550e8400-e29b-41d4-a716-446655440001"
superseded_by: null
change_reason: "Annual review update"
# Access
allowed_roles:
- "privacy_officer"
- "compliance_team"
- "legal"
need_to_know_tags:
- "hipaa-policies"
---
Mapping to Database
This frontmatter maps cleanly to:
- YAML frontmatter in each Markdown file
- Normalized relational or graph store for querying