데이터를 추측하지 않고 연결된 건강 기록 파이프라인 사고 실행

At 09:14, successful connector jobs drop while queue age rises. At 09:17, dashboard reads remain normal because cached records are still available. Is the source unavailable, authorization revoked, a parser rejecting new payloads, or storage failing? The first operational move should reduce further writes without turning sensitive payloads into debugging material.

The news context is OpenAI’s July 23, 2026 Health in ChatGPT announcement. OpenAI says rollout is for eligible logged-in US users 18+ on web and iOS, with supported medical-record and Apple Health connections. It says a dashboard can cover labs, medications, activity, sleep, and other health information, and states connected data and relevant conversations are not used to train foundation models or target ads. Those claims are from OpenAI’s post. This runbook is a generic operational artifact, not a description or test of OpenAI’s pipeline.

Assumed topology and safe telemetry

connector callbacks -> admission gate -> import queue -> parser -> record store
                            |                |           |
                       consent check     dead letter   freshness index
                            +------ privacy-safe event stream ------+

Enter fullscreen mode Exit fullscreen mode

Track counts and opaque scoped identifiers, not health values. Useful fields include incident_id, connector_class, grant_version, job_state, schema_version, attempt, queue_age_seconds, last_success_at, error_class, and payload_persisted as a Boolean. Restrict access and retention even for these events.

Severity and immediate actions

Declare a potential data-integrity incident when any of these conditions appears: a write occurs after a recorded revocation; imported source/version pairs diverge across replicas; parser rejection rises after a schema change; or the freshness index advances without a committed record. Threshold numbers must come from the service’s own baseline and error budget, not this article.

First fifteen minutes:

1. Open an incident channel and assign commander, operator, privacy lead, and recorder.
2. Pause new import admission while keeping revocation and connection-status paths available.
3. Capture queue offsets, deployment identifiers, schema versions, and aggregate error counts.
4. Block automatic dead-letter replay until scope and authorization are known.

Do not paste records into tickets, chat, screenshots, traces, or ad hoc scripts. A debugging shortcut can become a second incident.

Decision runbook

Evidence Working branch Action Exit signal source timeouts, no parser change upstream failure keep imports paused; probe metadata-only health path bounded successful probes one schema version rejects compatibility fault quarantine affected jobs by version parser canary accepts approved fixtures revoked grants have writes authorization fault stop all writes for connector class policy check enforced at commit commits succeed, index lags freshness fault rebuild index from committed metadata sampled versions converge unknown payload persistence containment gap isolate worker/storage credentials write path is demonstrably denied

“Probe” means a preapproved, non-payload health check where the connector supports one; never invent a call against a real provider during an incident.

Recovery sequence

Recovery should be slower than containment:

validate consent snapshot
-> canary one synthetic/approved fixture
-> admit a bounded authorized cohort
-> compare queue age, error class, commit/index versions
-> expand gradually
-> replay only jobs whose current grants still permit access

Enter fullscreen mode Exit fullscreen mode

This sequence is an unexecuted runbook. Expected signals are labels, not observed output. If a job’s consent cannot be revalidated, discard or quarantine it according to approved policy rather than replaying optimistically. Roll back immediately if stale-grant denials fail, payload writes precede authorization, or error classes broaden.

Cleanup includes deleting temporary debug artifacts under documented retention rules, rotating credentials exposed during response, reconciling quarantined jobs, recording affected time ranges, and reviewing whether notifications are required with the appropriate privacy/legal owners. Close only when new imports are authorized, record and freshness versions converge, revocation remains operational, and monitoring covers the initiating failure.

Limits

No workload was run and no thresholds are universal. This cannot prove connector correctness, source availability, record accuracy, deletion, compliance, or clinical safety. OpenAI says its feature supports—not replaces—medical care and is not intended for diagnosis or treatment. Incident recovery restores a technical pipeline; it does not validate medical meaning. Adapt this template to real retention policy, provider contracts, architecture, and response obligations before use.

AI assistance disclosure: This article was drafted with AI assistance and reviewed against the cited primary source.