Customer story
CareBridge Health — How a HIPAA-leaning monorepo team wired patient-record paths into a per-PR audit trail a compliance officer can replay.
deployment 2026-06-15 · ~700K LOC monorepo
logo placeholder · no customer asset shipped yet
The team
Who CareBridge Health is, and what they own.
CareBridge Health is a regional health-system integration platform; the platform team owns a single TypeScript and Go monorepo that runs the patient-record ingestion service, the partner connector layer, and the audit-export job out of one workspace. Their HIPAA-leaning reviewer asks for the same seven per-PR fields a regulated fintech reviewer asks for — a sandbox run hash, a cosign signature over the commit, an SBOM hash diffable against the lockfile, and an approver chain replayable from a single record id — with the additional posture that a patient-record path cannot be merged without a second reviewer sign-off, signed at each handoff, and verifiable after a quarterly key rotation.
Team shape
Six engineers across one time zone plus a rotating partner-engineering cohort; one platform lead, one staff engineer, and the rest split across ingestion, partner connectors, and the audit-export surface. Night-shift on-call is a shared pager, not a single engineer — overnight routing went through whichever engineer had the cleanest handoff that week.
Monorepo shape
One Go module and one pnpm workspace under a single GitHub organisation; one protected main branch; one CI identity (a GitHub App); one Bazel cache. The team merges roughly 35 PRs a week, of which roughly a third touch a dependency boundary that crosses a partner connector.
Compliance shape
HIPAA-leaning reviewer asks for the seven per-PR fields on every patient-record path; SOC 2 Type II in flight with the same evidence pack shape. Quarterly evidence pack due each quarter, with a separate run book for patient-record paths that mandates two-reviewer sign-off and a sandbox replay before merge.
Before Driftlock
What the week looked like before the watcher ran.
Before Driftlock, an overnight Dependabot or OSV advisory meant the on-call engineer opened a laptop, read the advisory, drafted a remediation PR by hand, waited for CI, and self-reviewed their own diff at 02:00. If the advisory hit a patient-record path, the same engineer also had to record the seven per-PR fields by hand in the HIPAA spreadsheet — and the spreadsheet was already three advisories behind by morning. The two-reviewer sign-off a patient-record path required was sometimes honoured on paper and sometimes stitched in after the fact, with the second reviewer rarely seeing the diff.
Monorepo upgrades were a second, quieter tax. When Go, Bazel, or the TypeScript toolchain moved forward, the platform team ran a manual upgrade sprint every eight weeks: rebase the long-running partner branches, re-pin the toolchain in the lockfiles, re-run the heavy validation suites, and re-emit SBOMs by hand. Each sprint took roughly three days of one engineer's time and landed zero patient-facing PRs; the per-PR record the HIPAA reviewer asked for was reauthored from memory the morning after, with the signature column duplicated from the previous row.
Implementation
How the wiring landed in a week.
Driftlock shipped into CareBridge's monorepo as a single Helm + Terraform deployment in the team's existing EKS cluster, sitting behind the same egress policy as the patient-record ingestion service. The platform team pointed the watcher at four signal surfaces, onboarded the cosign key into their existing KMS, and let the sandbox mount the monorepo's Bazel cache so reruns reused the team's own test evidence. The rollout week ended with the platform lead, the compliance lead, and the HIPAA-leaning reviewer replaying one PR together — the reviewer opened the run id, verified the two-reviewer sign-off list, diffed the SBOM hash against the lockfile, and asked one follow-up about a partner-connector test fixture.
- GitHub App installInstalled as the same GitHub App identity that opens PRs today; no new identity introduced, no shared credentials moved, and the second-reviewer sign-off rule rests on the same GitHub identity stack the team already trusted.
- CI identityBound to the team's existing CI identity via OIDC; the sandbox reuses the same token so a reviewer reads one signing line on every commit, and the second-reviewer sign-off attaches at the same handoff without a separate approval flow.
- On-call pager ingestionThe watcher reads the team's on-call pager webhook and turns each overnight incident into a Triage-verdict PR; severity-3 incidents auto-merge on a second reviewer sign-off, severity-1 and -2 patient-record paths stay reviewer-gated end-to-end.
- Monorepo upgrade pinA pinned subscription on Go, Bazel, and TypeScript advisories; the watcher opens a single upgrade PR per release line and pins the lockfile in the same commit, with the patient-record path gated by a second-reviewer sign-off at the same handoff.
- Signing-key onboardingThe customer KMS-resident cosign key onboarded on day one; rotation runs on the HIPAA-leaning reviewer's quarterly cadence, with the Rekor claim payload keeping older signatures verifiable across rotations — a requirement the reviewer called out explicitly before the trial week started.
What changed
Three numbers the regulator and the platform team now share.
Each number has a stated unit — the same tone discipline the comparison and governance pages use, so a reader cross-checking the stats against the rest of the site reads the same shape.
Mean time to merge dependency advisories
2.8 hours
From a Dependabot or OSV advisory opening to a merged, signed PR — down from roughly 14 hours when the on-call engineer picked it up overnight, with a second-reviewer sign-off attached before merge.
Weekly PRs shipped without human triage
11 PRs / week
Go, Bazel, and TypeScript upgrade PRs the watcher opens and the platform team approves in batch; previously cost three days of one engineer per quarter, with the per-PR record reauthored from memory the morning after.
Audit questions answered in a single click
91 %
Of the HIPAA-leaning reviewer's evidence-pack questions answered by replaying the run id against the team's own storage tier — no Driftlock-managed control plane in the loop, and the patient-record path's two-reviewer sign-off chain attaches to the same row.
In the engineer's words
“The first week we ran Driftlock, the HIPAA-leaning reviewer opened the run id, replayed the sandbox, read the two-reviewer sign-off list attached to the same row, and asked one follow-up — about a partner-connector test fixture, not the audit trail or the second review. That is the moment we realised the patient-record path no longer needed a separate review channel.”
Platform Lead · CareBridge Health
fictional placeholder attribution · swap with the named customer before launch
See it on your stack
Run the same trial against one of your real monorepos.
Driftlock ships into your VPC, points at two of your existing watchlist surfaces for ten days, and signs every audit-linked PR with your cosign key in your KMS. The trial ends with a walkthrough of the same per-PR record the regulator replays here.