One clinic can never see another's patients
Every patient row belongs to a clinic, and the clinic always comes from the logged-in user, never from the request. A test logs in as clinic B and tries clinic A's patients; it must get "not found".
Case study · Health data
Medical records for small family clinics
An EMR for solo and small family medicine clinics in the Philippines. Health data is sensitive personal information under the Data Privacy Act (RA 10173), so every design decision starts from one rule: patient-data safety beats speed.
- Role
- Sole engineer, building with Claude Code; a practicing family doctor reviews clinical screens
- Users
- Doctor, nurse, front desk and clinic admin
- Stack
- Java 21, Spring Boot 4, PostgreSQL 18, Flyway, Thymeleaf + HTMX, OpenPDF, Docker, AWS
- Status
- In active development: 49 merged pull requests
The problem
A small family clinic needs a handful of things done well: find the right patient quickly, write the consult, and print a prescription or medical certificate that a pharmacy or an employer will accept. Systems built for hospitals are too big for that. A clinic system also can't cut corners on privacy, because one leaked chart is a breach under the law.
What it does
- Front desk: patient registration, search, appointments, payments, and Excel/CSV import from old records.
- Nurse: vitals before the consult, with BMI labelled using the Asia-Pacific classification.
- Doctor: SOAP consults with ICD-10 diagnoses, allergies always in view, signing and addenda.
- Printouts: prescriptions, medical certificates, lab and X-ray requests and referral letters as PDFs on the clinic's own paper, with the doctor's letterhead, e-signature and a control number.
- Admin: staff accounts and roles, merging duplicate patients, and undoing records registered in error.
Key decisions
The app's database login can't erase history
The app connects with a database login that can read and add rows but can't delete them or change the audit tables. Migrations run in a separate step as the owner, so even a SQL injection bug can't wipe the record.
Two-step login without an abandoned library
Doctors and admins use an authenticator app. The popular Java TOTP libraries hadn't had a release since 2020, so I wrote the check in about 60 lines of plain JDK code and tested it against the official RFC 6238 test vectors.
PDFs made on the server
Browser printing adds headers and margins that differ on every PC. The server makes the PDF at the clinic's paper size, so it prints the same everywhere, and every print is logged.
How I know it works
I build this project with Claude Code. The repository holds the rules the agent must follow (patient-data safety, coding standards, testing, database changes), and the agent doesn't decide clinical behavior: unclear medical or product questions come back to me and the doctor. The checks below apply to every change, whoever wrote it.
- Integration tests run against a real PostgreSQL database in Docker (Testcontainers), not mocks.
- CI builds and tests every pull request, with static analysis that fails the build on any warning.
- Every change that touches patient data, logins or the database gets a separate privacy and security review before it merges.
- Nightly backups are encrypted, and there's a written restore drill to prove they can be restored.
- A practicing family doctor checks the clinical screens and printouts before they count as done.
- Only fake data, anywhere: tests, demos and these screenshots use generated patients.
Where it runs
One server in AWS Singapore with an encrypted disk, no open SSH port (Session Manager instead), HTTPS through Caddy, and deploys from GitHub Actions. A copy with fake data runs behind Cloudflare Access for testing.
Need something like this?
I build systems where the data has to stay safe, and I'm open to full-time roles.
Email me Next: Security Operations Manager →