Design a healthcare patient records system with HIPAA compliance.

Patient records: MongoDB with encrypted fields (AES-256); field-level encryption Access control: Redis for session tokens; MongoDB RBAC (role-based field access) Audit trail: Cassandra for immutable audit log (who accessed what when) Search: Elasticsearch on anonymized/tokenized fields only; no PHI in index Backup: encrypted MongoDB dumps to S3; key management via AWS KMS HIPAA: data at rest encry