This patch tightens web authentication so valid sessions are less likely to be cleared during token refresh, and account changes reset cached data more cleanly. It also adds a documented HIPAA implementation plan that states enablement is still planned and recommends synthetic patient data until the required agreements, controls, and review are complete.
October 3, 2026
Highlights
Web sessions now survive token refresh more safely, which reduces incorrect sign-outs.
Login, logout, and auth changes now clear cached query data to prevent one account's data from lingering into another session.
Release checks now cover the web app's auth refresh path before shipping.
The deployment runbook now documents how to recover a verified production publication receipt without redeploying.
A new HIPAA implementation plan sets explicit guardrails: HIPAA enablement is not complete, and synthetic patient data should be used for now.
Changelog
Screenshots