The care pillar
Care delivery
The care pillar is the clinical spine: one identity, one longitudinal record, and the workflows that write to it. It is built before the financing pillar because nothing can be priced until something has been recorded.
What follows describes what the pillar does, what it owes the financing pillar, and — just as importantly — what it does not know.
The record travels with the patient
A health identity that resolves to the same person across facilities, and a longitudinal record carrying conditions, allergies, medicines, encounters, results, referrals and admissions. Released by role, and logged on every open.
The physical card is the offline fallback. It identifies a person; it proves no entitlement. That distinction is deliberate: a card that proved entitlement would become a document people lend each other.
The modules, and the order they are built
Order is set by dependency and by what can be shown. Nothing is built before the record it writes to exists, and within that constraint the earliest modules are the ones that make the platform legible to somebody opening it for the first time.
Patient identity, duplicates and the health card
Longitudinal record
Consultation and encounter
Nursing, vitals and triage
Laboratory
Pharmacy
Referrals
Admissions, beds and discharge
Vaccination
Maternal and child health
Operations and facility analytics
Interoperability gateway
The clinical record is mutable; the financial record is not
A clinical mistake is corrected. A financial figure is never corrected in place.
This is the sharpest difference between the two pillars, and it drives the data model on both sides. A clinical record is corrected when it is wrong, under clinical governance, with the correction visible in the record's history. A financial figure is never corrected in place: the original stands and an adjustment is recorded against it.
Building both under one convention would either make clinical correction impossible or make financial history editable. Neither is acceptable.
Who sees what
A role is defined by the permissions it holds, never by a title in a dropdown. Every screen is built permission-first: the query is scoped before it is written, not filtered after.
| Role | What they do | What they must not see or do |
|---|---|---|
| Registration clerk | Identifies the patient, creates the health identity, issues the card, records the household. | Any clinical content. |
| Nurse | Records vitals and triage, follows admitted patients, reads the shared record. | Prescribing, claim decisions. |
| Doctor | Examines, diagnoses, prescribes, orders, refers, admits, discharges. | Claims, contribution history, settlement. |
| Laboratory scientist | Receives orders, registers samples, validates results. | Unrelated clinical history. |
| Pharmacist | Reviews prescriptions against allergies, dispenses, manages stock. | History beyond safety context. |
| Facility administrator | Manages accounts, permissions, activity and the access log. | Clinical content of any encounter. |
What the care pillar owes the coverage pillar
- Billable service events. Every completed act of care emits an immutable event the financing pillar can price. Clinicians record healthcare; they never construct claims.
- Enough clinical context to justify a decision, behind its own permission. An adjudicator reviewing an unusual claim may need justification, but that access is separate and audited.
- Nothing else. The care pillar does not know tariffs, does not calculate contributions, and does not change behaviour according to a patient's coverage. Care is decided clinically.
An honest limit of that separation
We say it here rather than leave it to be found: a data-protection reviewer will find it, and finding it first is better.
Built for the conditions
Intermittent power, thin connectivity, shared devices, and staff who have never used a clinical system. That is the design centre, not the edge case.
Offline by design
Offline capture is not a degraded mode. Every entity carries a client-generated identifier and a version, so an encounter captured offline reconciles rather than duplicates.
Shared devices
Devices are shared. Sessions are short, switching user is quick, and the access log says who opened what, not which workstation.
The ward's vocabulary
The vocabulary is the ward's, not the software's. A system that needs training before it can be used will not be used.
Talking about the care pillar
If you run a facility or a network and want to go through this pillar in detail, get in touch.