Hacker News Reader

In my experience, US healthcare, that box can be checked at later stages, namely deployment to production. It's a choice to add it earlier.

View on HN

If it is for checking a box, sure. If it is part of a process that aspires to deliver projects with quality and with somewhat predictable release dates, that seems way too late, imho.

And a great way to end up leaking customer data from a SQL injection or other error that could have easily been caught during a more piece-wise analysis and vetting of the related code nearer to time of writing.

Sadly it often is box checking, code review or not. I'm only stating that there is no requirement in US healthcare that I'm aware of that requires approvals before merging code. Maybe that's not true in other industries. But most regulatory frameworks that I'm aware of are flexible, ambiguous, on implementation details by design.

If you find that outcomes are the same by making approvals optional at that stage, then do so with accompanied justification.

Reply on news.ycombinator.com