Earlier work
Client project
Patient management system
A medical practice, built with a cross-functional team
Software for doctors to manage patients and medical records, built by a team rather than alone. I worked on the front end and the API contract, with role-based access controlling who can see what.
- Built with
- Angular on the front, Node.js behind it, MongoDB for storage, with the API documented in Swagger.
- What was tested
- Role-based access control over patient records, with the API surface documented in Swagger so the team could work against an agreed contract.
How it fits together
- Doctors and staff browser
- Interface Angular
- API contract Node.js, Swagger
- Role check enforced on the server
- Records MongoDB
The problem
A practice needed patient registration and medical records in one system, with a strict rule that not everyone who can log in should see everything. Medical records make access control the first requirement rather than a later one.
What I built
I worked in a cross-functional team on the interface and the shape of the API. Patients, conditions and records are managed through a responsive Angular front end; access is controlled by role so that what a user can retrieve is decided by the server, not hidden by the interface.
Documenting the API in Swagger was what let the team work in parallel without agreeing every field in a meeting.
Hard decisions
Access control enforced server-side. The quicker build hides the controls a user should not have and calls it done. For medical records that is not access control, it is a disguise, and it was worth the extra work to enforce it where the data is.
What I would do next
An audit trail. Knowing who looked at which record, and when, is the thing a practice will eventually be asked for and cannot reconstruct after the fact.