Acceptance Criteria Template: Jira for Healthcare
Healthcare acceptance criteria must verify clinical safety, HIPAA compliance, and PHI handling alongside functional correctness. A story that works correctly but exposes PHI in logs or allows unauthorized access to medical records has failed its acceptance criteria even if every functional test passes.
This template adds healthcare-specific acceptance criteria patterns to Jira stories.
Template sections
5 sections covering the complete acceptance criteria workflow.
PHI Handling Verification
Every story touching patient data must include acceptance criteria verifying PHI is handled correctly: encrypted at rest and in transit, not logged in plaintext, not cached in browser localStorage, and not included in error messages or stack traces. These criteria must be tested as part of QA, not assumed.
AC: Patient name and DOB encrypted at rest (AES-256) and in transit (TLS 1.3). PHI not present in application logs (verified by log audit). PHI not stored in browser localStorage or sessionStorage. Error responses do not include PHI fields. API responses for patient data require authentication token with patient-scope permission.
Tips
- Create a standard PHI handling checklist in Jira to attach to every patient data story
- Include log auditing as a QA step: grep logs for known test patient data
- Test error responses to verify no PHI leaks in error messages
- Verify browser developer tools show no PHI in localStorage/sessionStorage
Clinical Safety Criteria
Stories affecting clinical workflows must include safety-specific acceptance criteria: correct units displayed (mg vs mcg can be fatal), appropriate warnings for dangerous values, and clinical decision support accuracy. These criteria should be written or reviewed by clinical subject matter experts, not just engineers.
AC for medication dosing display: doses always shown with unit (mg, mcg, mL, units). Warning displayed for doses exceeding maximum recommended per FDA drug labeling. Decimal point always visible (0.5 mg, never .5 mg). Tall-man lettering for look-alike drugs (DOPamine vs DOBUTamine). Clinical review sign-off required before story is marked Done.
Tips
- Have clinical SMEs write or review clinical safety acceptance criteria
- Include unit display requirements with specific formatting rules
- Test with look-alike drug names and similar-sounding medications
- Require clinical sign-off as a Jira workflow gate for clinical stories
HIPAA Access Control Criteria
Acceptance criteria must verify role-based access following the HIPAA Minimum Necessary standard: each role sees only the PHI necessary for their job function. Test with multiple user roles and verify each sees the correct data subset. Include break-the-glass emergency access testing.
AC: Primary physician sees full patient record. Specialist sees referral reason and relevant history only. Billing staff sees demographics and billing codes only. All access logged with role, timestamp, and records viewed. Break-the-glass access: any user can access any record in emergency by providing written justification, logged and reviewed within 24 hours.
Tips
- Test access controls with each clinical role persona, not just admin and user
- Verify audit logging captures the specific records accessed, not just "patient record accessed"
- Include break-the-glass testing as an acceptance criterion
- Test that access restrictions cannot be bypassed via API calls
Interoperability Validation
Stories involving data exchange must validate compliance with healthcare data standards: FHIR resource validation, HL7 message formatting, and DICOM conformance. Include validation against the applicable implementation guide profiles and test with data from real EHR systems.
AC: Patient data export validates against US Core FHIR R4 profiles. FHIR resource validator returns zero errors. HL7 v2 ADT messages parse correctly from Epic and Cerner test feeds. CCDA document passes ONC certification test suite. Data round-trip: export from our system, import into test EHR, verify data integrity.
Tips
- Run FHIR resource validation against implementation guide profiles automatically
- Test with real HL7 messages from partner EHR systems, not just synthetic data
- Include data round-trip testing (export/import/verify) in acceptance criteria
- Document which implementation guide profiles each story must conform to
Audit Trail Verification
Healthcare acceptance criteria must verify that all PHI access and modifications are captured in an immutable audit trail. Test that the audit trail contains sufficient detail for HIPAA investigations: who accessed what, when, from where, and why. Verify that audit logs cannot be modified or deleted.
AC: Every PHI access event logged with fields: user_id, role, patient_id, data_elements_accessed, timestamp, IP_address, session_id. Log entries are immutable (append-only table, no UPDATE/DELETE permissions). Audit log query supports: search by patient ID, search by user ID, search by date range. Retention: 6 years per HIPAA requirement. Log integrity: SHA-256 hash chain for tamper detection.
Tips
- Verify audit logs are append-only with no UPDATE or DELETE permissions
- Test audit log search by patient, user, and date range
- Include log integrity verification (hash chain) in acceptance criteria
- Verify retention period is configured correctly per HIPAA requirements
Copy-paste template
# Acceptance Criteria — Healthcare (Jira) ## Functional Criteria - [ ] [Standard functional AC] ## PHI Handling - [ ] PHI encrypted at rest and in transit - [ ] PHI not in logs, localStorage, or error messages - [ ] PHI access requires authenticated session with appropriate scope ## Clinical Safety - [ ] Units displayed correctly - [ ] Warnings for out-of-range values - [ ] Clinical SME sign-off ## Access Control - [ ] Each role sees only authorized data - [ ] Access logged with full detail - [ ] Break-the-glass tested ## Audit Trail - [ ] All PHI access logged - [ ] Logs are immutable - [ ] Retention configured per HIPAA
Frequently asked questions
Generate instead of filling in templates
Connect your tools, and Vantage generates the content using real product data. Free to start.
Free to start. No credit card required.