What does a compliance-ready build include?

“The table above lists five requirements: access control on every route, audit logging of who saw which record and when and why, encryption in transit and at rest, retention and deletion rules per data class, and business associate agreements covering every subprocessor that touches PHI. Each is far cheaper built in than retrofitted.”