Your database just went down at 3 AM. As you're scrambling to restore service, you panic, wondering if the backup encrypted that table with protected health information. If not, you're staring at a HIPAA violation that could cost millions. Compliance failures are expensive. GDPR fines alone cost organizations more than €6.7 billion in 2025. Data breach costs went up by an average of $137,000 per incident. In spite of these stakes, only 49.51% of development teams implement secure coding standards, and a mere 25.49% integrate security into their CI/CD pipelines. cost organizations cost organizations more more than €6.7 billion in 2025 than €6.7 billion in 2025 average of $137,000 per incident average of $137,000 per incident 49.51% of development teams implement 49.51% of development teams implement The gap between what regulations require and what teams build is an architectural problem. Compliance can't be bolted on after launch. It rewrites your service map and changes how you model data. Some regulations even decide which APIs can talk to each other. The Code GDPR, HIPAA, and PCI DSS Wrote For You If your architecture includes isolated data services or centralized audit logging, you might think those were brilliant engineering decisions. They were, but regulations wrote that code before you did. GDPR GDPR Europe's General Data Protection Regulation gives users the right to be forgotten, which sounds simple until you realize "forgotten" means purging data from 15 microservices within 30 days. the right to be forgotten the right to be forgotten Data minimization rules improve architecture. You can only collect what's necessary and keep it as long as needed. You're back to normalized schemas with foreign keys pointing to a single source of truth. The constraint makes deletion feasible. Consent becomes a service. Every time your recommendation engine wants to access viewing history, it checks the current consent status. Users revoke consent, and data access stops within seconds. The architecture comes out of these constraints. HIPAA HIPAA Healthcare data doesn't get to live with your other data. Protected Health Information (PHI) needs isolated services with their own security posture. That column in your users table marked "medical_conditions"? Not good enough. HIPAA wants a separate infrastructure. PHI-handling services run in dedicated VPCs. They sit behind API gateways that demand multi-factor authentication. Your on-call engineer getting paged at 2 AM still needs to pull out their phone for that second factor before accessing patient records. Every PHI access generates an audit log that is immutable and lives for seven years. Five years from now, when an auditor asks about a 2025 access, you will produce that unaltered record. The audit infrastructure has to be where you start. Then there's encryption. Data at rest needs AES-256 with proper key management. Data moving between services needs TLS 1.3 at a minimum. But the part teams may forget is database backups. Compromised backups don't get a pass just because they're "old data." needs TLS 1.3 at a minimum needs TLS 1.3 at a minimum Building for HIPAA improves security everywhere. PCI DSS PCI DSS Payment card industry standards turn your infrastructure into concentric circles. At the center sits the Cardholder Data Environment, which is a fortress that handles card numbers and nothing else. Card data doesn't ever appear in application logs. Your developer who just added console.log(request.body) to debug a payment issue? They just created a compliance violation. The same goes for that Sentry error that helpfully captured the full request payload. You'll find card data concerns where you might not expect them. For example, your logging middleware needs to scrub before writing, and exception handlers can't just JSON.stringify(error) and ship it to your observability platform. Session management stops being a UX conversation because automatic timeouts become mandatory. You don't design a payment system and then make it PCI compliant. You let PCI DSS design the system. What Compliant Healthcare Architecture Looks Like in Practice Picture building a patient portal that handles Protected Health Information. Your Patient Data Service can't coexist with other services. It needs isolation, which includes separate infrastructure and access patterns. Route PHI requests through an API Gateway that validates authentication first. This makes it architecturally impossible to expose PHI through a forgotten endpoint. Encryption is architected in at every layer, from data at rest to temporary processing files. Compromised storage shouldn't reveal readable PHI. MFA happens at the gateway, not in the application code. Any request touching PHI validates the second factor before proxying downstream, which means that backend services don’t implement their own PHI access checks because the gateway already enforced them. MFA happens at the gateway Audit logging becomes infrastructure. Stream every PHI access event to S3 with write-once-read-many protection enabled. Once written, these logs can't be modified even by administrators with root access. They sit there for seven years as HIPAA mandates. Automate deletion workflows. When a patient requests data deletion, each service purges its records, invalidates its caches, and marks its backups for early deletion. The entire chain completes within 30 days or monitoring alerts fire. This architecture costs more upfront. Compare this to retrofitting compliance into an existing system after it's already serving patients. That retrofit touches every service, requires database migrations under regulatory deadlines, and risks downtime for production systems that people are depending on. Building From Compliance Forces Better Systems Compliance is a blueprint that forces you to build better systems. You'll architect for compliance eventually. The choice is doing it proactively while it's cheap, or retrofitting it later after technical debt has compounded. When you boil it down, compliance-driven architecture is building secure software that takes care of the end user. Architecture Diagram ┌─────────────────────────────────────────────────────────────┐ │                     Patient Portal (Web)                     │ │                  (WCAG 2.1 AA Compliant)                    │ └────────────────────────┬────────────────────────────────────┘ │ ┌──────────▼──────────┐ │   API Gateway       │ │ - Auth (MFA)        │ │ - Rate Limiting     │ │ - Audit Logging     │ └──────────┬──────────┘ │ ┌──────────────┼──────────────┐ │              │              │ ┌─────────▼────────┐ ┌──▼───────┐ ┌───▼─────────────┐ │  Patient Data    │ │  User    │ │  Analytics      │ │  Service         │ │  Mgmt    │ │  Service        │ │  (HIPAA Scope)   │ │          │ │  (De-identified)│ └─────────┬────────┘ └──────────┘ └─────────────────┘ │ ┌─────────▼────────────────────────────────────┐ │       PHI Database (Encrypted at Rest)       │ │  - Separate VPC                              │ │  - Encrypted backups                         │ │  - 7-year audit logs                         │ └──────────────────────────────────────────────┘ ┌──────────────────────────────────────────────┐ │     Centralized Audit Log Store (S3)         │ │  - Immutable                                 │ │  - 7-year retention                          │ │  - Compliance reporting                      │ └──────────────────────────────────────────────┘ Compliance requirements drove the architecture from the start. Your Compliance Architecture Checklist Before your next sprint planning: ● Identify which data is subject to regulation (GDPR, HIPAA, PCI DSS) ● Design deletion workflows that cascade across all storage systems ● Centralize authentication and audit logging at the API gateway. ● Encryption at rest and in transit ● Integrate security scanning (SAST/DAST) into the CI/CD pipeline. ● ADRs for architectural decisions and audit trails

This story contains AI-generated text. The author has used AI either for research, to generate outlines, or write the text itself. 

The is an opinion piece based on the author’s POV and does not necessarily reflect the views of HackerNoon.

How Compliance Requirements Shape Modern Software Architecture

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

01/06/2018: Biggest Stories in the Cryptosphere

10 Things I Did To Increase CloudTrail Logs Security

10 Important 409a Valuation Compliances to Know

3 Real-World Use Cases of Blockchain Smart Companies

3 Solutions for Sharing and Managing Your Zoom Recordings

3 Ways to Share and Manage Zoom Recordings

01/06/2018: Biggest Stories in the Cryptosphere

10 Things I Did To Increase CloudTrail Logs Security

10 Important 409a Valuation Compliances to Know

3 Real-World Use Cases of Blockchain Smart Companies

3 Solutions for Sharing and Managing Your Zoom Recordings

3 Ways to Share and Manage Zoom Recordings

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps