The setting
is a marketplace and software platform that connects patients, health insurers and independent providers of mental health care across the United States. is the software therapists and psychiatric prescribers use to accept insurance and run their practice.
Refreshed sessions are failing at the boundary between reliable access and least privilege.
Clinicians need records during care, while the authorization path must continue to prevent access beyond their own patients.
Who you’d be doing this for
“My next client was waiting while I signed out twice just to open the worksheet from their last session.”
Lotanna Quaye · Licensed Clinical Social Worker · a character in this brief
A solo clinician who opens session documentation and attachments between appointments.
What is at stake
Valid clinician attachment requests are failing after a session refresh, interrupting access to session materials. You have to restore the flow without weakening the boundary around patient records.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- clinician continuity vs. least-privilege enforcement
- narrow recovery vs. shared-platform change
- fast restoration vs. authorization review
Why Headway
Clinical documentation is part of the daily practice workflow for independent mental health clinicians using the platform.
Written with these in mind
Not your kind of problem? 104 more at Headway, or browse every organization.
Where the organization context comes fromThe postings this brief was written from, and the reporting read before it.
The organization context comes from public information. The situation and characters are written for the brief.
Job postings it was written from
Public descriptions of the work at Headway. They are listed as sources, not as openings. The lines under a posting are its own words, where it meets this brief.
- Senior Security Engineer (Infrastructure) (opens in a new tab)
- Staff Infrastructure Engineer · no longer posted
- Build the Terraform self-serve platform with guardrails so engineering teams own their standard infrastructure changes and Reliability Engineering reviews only the non-standard ones.
- Senior Security Engineer (Product) · no longer posted
- Headway’s mission is a big one – to build a new mental health care system everyone can access.
- Since then, we’ve grown into a diverse, national network of over 60,000 mental healthcare providers across all 50 states who run their practice on our software and have served over 1 million patients.
- Senior Software Engineer (Trust Foundations) · no longer posted
- Building for trust is non‑negotiable in our mission of making mental healthcare more accessible and affordable across the US: patients share sensitive information, payers demand demonstrably strong controls, and providers depend on reliable, secure infrastructure.
- Scale our identity rails - Design and evolve multi‑tenant authentication & authorization services that handle millions of sessions daily with high availability expectations.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.
Where similar work appears
Other live briefs connected to this one, and what connects them.
Similar problems at other organizations
Like this one, each of these is about people starting something and never quite finishing it.
Employees with refreshed eligibility records are signing in and returning to enrollment instead of entering the benefit.
You need to weigh a fast session fix against the access controls that protect covered-member access.
Approved clinical requests are failing after a new access policy, despite the model working in notebooks.
You have to restore the application path while keeping the governed catalog locked down.
Authorized report requests are failing at 1.8% after session refreshes.
You must weigh a contained guardrail against an IAM rollback in one release window.
The same setting, from another role
Each is set around Headway’s Headway for Providers, written for a different role. They’re separate briefs, not the same scenario.
New clinicians are missing first appointments after completing early onboarding steps.
You must decide whether AI drafts explanations from evidence or only assembles the evidence for PM review.
Virginia clinicians are unsure whether their enrollment records are complete before January 29.
You must decide which readiness signals prompt action without implying payer approval.
Clinicians are receiving lower payments while claim records still look processed.
You must choose which suspected downcodes can move automatically and which need human review.
Other problems with a similar purpose
In each of these, as in this one, the aim is to remove a real security exposure while keeping the everyday workflow people depend on running smoothly.
Staged testing shows a 0.6% session failure rate on older mobile versions before an irreversible authentication cutover.
You need to close the token exposure without locking members out of liquidity and repayment flows.
One authentication mode has a confirmed flaw and has to be off in every managed workspace within 21 days.
You have to sequence migration and enforcement so exposure closes without breaking data delivery.
Valid workspace members are looping through sign-in despite appearing in the right SSO groups.
You have to restore access while preserving the permission boundary administrators rely on.
