Run a Connected Health Record Pipeline Incident Without Guessing at the Data

A developer published a generic runbook for handling data-integrity incidents in connected health record pipelines, emphasizing containment over debugging and strict access controls. The runbook, released in the context of OpenAI's July 2026 Health in ChatGPT announcement, outlines procedures for isolating faults without exposing sensitive payloads.

At 09:14, successful connector jobs drop while queue age rises. At 09:17, dashboard reads remain normal because cached records are still available. Is the source unavailable, authorization revoked, a parser rejecting new payloads, or storage failing? The first operational move should reduce further writes without turning sensitive payloads into debugging material. The news context is OpenAI’s July 23, 2026 Health in ChatGPT announcement. OpenAI says rollout is for eligible logged-in US users 18+ on web and iOS, with supported medical-record and Apple Health connections. It says a dashboard can cover labs, medications, activity, sleep, and other health information, and states connected data and relevant conversations are not used to train foundation models or target ads. Those claims are from OpenAI’s post https://openai.com/index/health-in-chatgpt/ . This runbook is a generic operational artifact, not a description or test of OpenAI’s pipeline. php connector callbacks - admission gate - import queue - parser - record store | | | consent check dead letter freshness index +------ privacy-safe event stream ------+ Track counts and opaque scoped identifiers, not health values. Useful fields include incident id , connector class , grant version , job state , schema version , attempt , queue age seconds , last success at , error class , and payload persisted as a Boolean. Restrict access and retention even for these events. Declare a potential data-integrity incident when any of these conditions appears: a write occurs after a recorded revocation; imported source/version pairs diverge across replicas; parser rejection rises after a schema change; or the freshness index advances without a committed record. Threshold numbers must come from the service’s own baseline and error budget, not this article. First fifteen minutes: Do not paste records into tickets, chat, screenshots, traces, or ad hoc scripts. A debugging shortcut can become a second incident. | Evidence | Working branch | Action | Exit signal | |---|---|---|---| | source timeouts, no parser change | upstream failure | keep imports paused; probe metadata-only health path | bounded successful probes | | one schema version rejects | compatibility fault | quarantine affected jobs by version | parser canary accepts approved fixtures | | revoked grants have writes | authorization fault | stop all writes for connector class | policy check enforced at commit | | commits succeed, index lags | freshness fault | rebuild index from committed metadata | sampled versions converge | | unknown payload persistence | containment gap | isolate worker/storage credentials | write path is demonstrably denied | “Probe” means a preapproved, non-payload health check where the connector supports one; never invent a call against a real provider during an incident. Recovery should be slower than containment: php validate consent snapshot - canary one synthetic/approved fixture - admit a bounded authorized cohort - compare queue age, error class, commit/index versions - expand gradually - replay only jobs whose current grants still permit access This sequence is an unexecuted runbook . Expected signals are labels, not observed output. If a job’s consent cannot be revalidated, discard or quarantine it according to approved policy rather than replaying optimistically. Roll back immediately if stale-grant denials fail, payload writes precede authorization, or error classes broaden. Cleanup includes deleting temporary debug artifacts under documented retention rules, rotating credentials exposed during response, reconciling quarantined jobs, recording affected time ranges, and reviewing whether notifications are required with the appropriate privacy/legal owners. Close only when new imports are authorized, record and freshness versions converge, revocation remains operational, and monitoring covers the initiating failure. No workload was run and no thresholds are universal. This cannot prove connector correctness, source availability, record accuracy, deletion, compliance, or clinical safety. OpenAI says its feature supports—not replaces—medical care and is not intended for diagnosis or treatment. Incident recovery restores a technical pipeline; it does not validate medical meaning. Adapt this template to real retention policy, provider contracts, architecture, and response obligations before use. AI assistance disclosure: This article was drafted with AI assistance and reviewed against the cited primary source.