The setting
is a marketplace and software platform that connects patients, health insurers and independent providers of mental health care across the United States. is the software therapists and psychiatric prescribers use to accept insurance and run their practice.
Immediate containment protects patient records, while broad access changes can disrupt scheduled care.
Former-staff access must stop without locking active clinicians out of the records they need during appointments.
Who you’d be doing this for
“I removed her yesterday, and a clinician just asked why she could still see a client chart.”
Fabio Morales · Group Practice Administrator · a character in this brief
Manages staff access for an independent behavioral health group practice using practice-management and billing workflows.
What is at stake
Former staff may still be reaching patient records after removal, with evidence that does not agree on timing. You must weigh fast containment against keeping active clinicians able to deliver scheduled care.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- patient-record protection vs. continuity of care
- centralized control vs. targeted containment
- fast action vs. defensible evidence
- shared-platform safety vs. product workflow access
Why Headway
Group-practice access controls protect the patient records, scheduling, documentation, and billing workflows clinicians run in one connected system.
Written with these in mind
Not your kind of problem? 104 more at Headway, or browse every organization.
Where the organization context comes fromThe postings this brief was written from, and the reporting read before it.
The organization context comes from public information. The situation and characters are written for the brief.
Job postings it was written from
Public descriptions of the work at Headway. They are listed as sources, not as openings. The lines under a posting are its own words, where it meets this brief.
- Senior Security Engineer (Infrastructure) (opens in a new tab)
- Staff Infrastructure Engineer · no longer posted
- Staff-level influence: you drive decisions across team boundaries and raise the infrastructure bar org-wide without requiring management authority to do it
- You will serve as the technical anchor for Headway's compute, networking, and deployment platform, and bring Staff-level influence to an area that every engineer depends on daily.
- Senior Security Engineer (Product) · no longer posted
- Headway’s mission is a big one – to build a new mental health care system everyone can access.
- We’re a Series D company with over $325m in funding from a16z (Andreessen Horowitz), Accel, GV (formerly Google Ventures), Spark Capital, Thrive Capital, Forerunner Ventures and Health Care Service Corporation.
- Senior Software Engineer (Trust Foundations) · no longer posted
- Building for trust is non‑negotiable in our mission of making mental healthcare more accessible and affordable across the US: patients share sensitive information, payers demand demonstrably strong controls, and providers depend on reliable, secure infrastructure.
- You will translate open identity and authorization standards into scalable building blocks; embed privacy‑by‑design and reliability principles into everything we build; and mentor engineers across the company in Trust first thinking.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.
Where similar work appears
Other live briefs connected to this one, and what connects them.
Similar problems at other organizations
Like this one, each of these is about people starting something and never quite finishing it.
An employee received a sensitive result after their access was removed.
You must weigh immediate containment against a recovery cutover that cannot be easily undone.
Eighteen recent investigations would have exposed encounter context unrelated to the incident.
You have to tighten access before launch without slowing recovery beyond what clinicians can tolerate.
Seller documents appeared in unrelated closing queues while scheduled closings remain active.
You have to weigh evidence preservation against immediate containment and closing continuity.
The same setting, from another role
Each is set around Headway’s Headway for Providers, written for a different role. They’re separate briefs, not the same scenario.
New clinicians are missing first appointments after completing early onboarding steps.
You must decide whether AI drafts explanations from evidence or only assembles the evidence for PM review.
Virginia clinicians are unsure whether their enrollment records are complete before January 29.
You must decide which readiness signals prompt action without implying payer approval.
Clinicians are receiving lower payments while claim records still look processed.
You must choose which suspected downcodes can move automatically and which need human review.
Other problems with a similar purpose
In each of these, as in this one, the aim is to engineer data foundations precise enough that the evidence they produce stays credible long after the system changes.
Retailer identifiers and derived features still sit past the retention window in several warehouse and serving copies.
You have to balance privacy risk against deleting records that orders and support still need.
2.7% of encounter records disagree about completion after amendments, and 11% carry classification fields nobody has verified.
You decide what counts as final, because contract baselines will follow your definitions.
A dry run shows 4% of historical transitions map differently under the new model, which changes time-in-stage and funnel reports.
You have to decide which checks must pass before the old contracts are retired.
