A private hospital network operating across multiple cities (name withheld under NDA)
MediCore EHR Platform — an internal delivery codename, not a commercial product name.
The problem
The network was running different systems per site with no shared patient identity, so a patient seen at two hospitals existed as two unconnected records. Clinicians worked around it manually, which is exactly as safe as it sounds.
Audit logging existed only as application logs mixed into general telemetry on a short retention. Reconstructing who had viewed a given patient record, when, and from where was not possible.
Constraints we had to design within
- Clinical operations could not pause for migration.
- Shared ward workstations used by many staff per shift, which constrains session and logoff design.
- Partner laboratory and billing systems on HL7 v2 that would not migrate on the client's timeline.
Approach
The PHI access log came first
A separate append-only PHI access log was built in the first sprint: who viewed which record, when, from where, under what access justification, in a store the viewer cannot alter. This is the technical safeguard that most often fails assessments, and reconstructing it after the fact is not possible — only rebuilding forward is.
FHIR as a translation layer
Rather than modelling clinical workflow natively in FHIR resources — which are shaped for exchange, not for transactional workloads — we built a domain-appropriate internal model with a FHIR translation layer at the boundary. Mapping tests were treated as first-class tests, because a silently dropped code system produces an observation that looks correct and means something different.
HL7 v2 and FHIR in parallel
Partner systems migrate on their own schedules, so both interfaces run concurrently rather than treating v2 as decommissioned. Designing for that coexistence from the start avoided a second integration project later.
Session design for shared workstations
Automatic logoff was calibrated against actual ward usage patterns. A timeout that clinicians route around with a shared login is worse than a longer one they comply with — the safeguard has to survive contact with the workflow.
Engineering notes
FHIR resources as the domain model, not an export format
The common error in healthcare integration is building an internal record model and mapping to FHIR at the boundary. That holds until the standard needs something the internal model has no room for — provenance, coded observations, the granularity of a care-team relationship — and the gap is then closed under deadline.
Letting the interoperability standard inform the domain model from the start costs more in early design and considerably less across the life of the system. It also means an external integration request is a configuration exercise rather than a project.
Audit logging sized as a primary feature
Under HIPAA the access log is not infrastructure, it is evidence. It has to be append-only, because a log the writing system can amend proves nothing, and it has to be queryable by patient and by time window, because that is the axis an investigation actually uses.
Both properties are cheap at design time and painful to retrofit onto a live system carrying years of history. The retention policy was set as a product decision with clinical and legal input rather than as a database default.
Minimum necessary access enforced structurally
The HIPAA minimum-necessary principle is frequently implemented as a policy document and a training slide. Enforced structurally, it means role and care-relationship checks sit in the data access layer rather than in each screen, so a new interface cannot accidentally widen access.
Break-glass access is provided deliberately — clinicians need it — but it is loud rather than silent: separately recorded, attributed, and surfaced for review rather than buried in a general log.
Outcome
Patient identity is unified across sites. PHI access is fully reconstructible for audit and has been exercised against real queries.
Laboratory and billing integrations run over FHIR where partners support it and HL7 v2 where they do not, without a separate adapter per partner.
Figures above are drawn from delivery records held under NDA and are pending independent confirmation. Where a figure cannot be evidenced it will be removed rather than qualified.