← Headway
Complex day at Headway

Contain cross-service access without breaking the next booking peak

You’re the security / reliability engineer. Your team is in the room. Printed Oct 15, 2026.

Containing a possible appointment-data exposure could reopen a fragile deployment boundary.

Patient privacy requires immediate isolation, while booking continuity depends on preserving the service path patients are using.

Who you’d be doing this for

“My appointment kept spinning, and I was scared I’d lose the only time that worked.”

Santiago Herrera · Therapy-Seeking Patient

An insured patient trying to confirm an in-network therapy appointment through the booking flow.

What is at stake

A deployment path may have allowed appointment requests outside their intended service boundary while booking retries are rising. You must weigh immediate privacy containment against the risk of disrupting patient bookings.

Why it isn’t already fixed

Every obvious fix costs something else. That’s the part you’d have to decide.

  • privacy containment vs booking continuity
  • forensic evidence vs rapid isolation
  • targeted control changes vs rollback certainty
  • service isolation vs shared-path stability

Why Headway

In-network booking depends on protected appointment and availability data moving reliably between patient and clinician workflows.

Written with these in mind

incident-minded security engineerreliability engineer with security depthproduct security generalist

Not your kind of problem? 34 more at Headway, or browse every organization.

This is the setup. The work is inside.

Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.

Contain cross-service access without breaking the next booking peak — a live brief for Headway