Healthcare · Multi-Tenant SaaS

Paper intake, replaced by a system that remembers.

A clinic management and patient wellbeing platform for a multi-site behavioral health provider in North America — patient records, a dynamic intake and assessment form builder, four role-scoped portals, passwordless access and an immutable audit trail, running several clinics under one organization from a single deployment, on AWS infrastructure defined entirely as code.

tenancy · clinic as rootscoped
Group Adminall clinics
CLINIC AAdmin · Clinicians
CLINIC BAdmin · Clinicians
Patient portalown records only

every mutation written to the audit log · actor, entity, action

3

Isolated environments — test, staging, production, all as code

4

Role-scoped portals under one organization

30d

Automated zero-downtime database credential rotation

365d

Database audit-log retention

Context

Several clinics, no shared system.

The client operates several clinics under one organization and needed a single system to run day-to-day operations, manage patients across sites, collect structured intake and assessment data, and keep a defensible audit trail for compliance.

Existing tooling was a mix of spreadsheets, paper intake forms and disconnected point solutions — no shared access model, and no dedicated hosting, security or disaster-recovery posture.

What we built

One multi-tenant platform where the clinic is the unit of isolation. Admins onboard a clinic, build their own intake and assessment forms and assign them; clinicians work a caseload; patients complete everything in their own portal. Passwordless login removes password-reset support load, every mutation is audit-logged automatically, and the whole thing runs on AWS across three isolated environments defined entirely as code.

Role hierarchy

Four portals, four sets of permissions.

RBAC with four roles — Group Admin, Clinic Admin, Clinician, Patient — each with its own portal and permissions. Users only ever see patients and data for clinics they belong to.

L1Group AdminOversees every clinic in the organization, onboards new ones, and sets group-wide configuration.
L2Clinic AdminRuns a single clinic: staff, patients, branding, and the reminder behavior for that clinic.
L3ClinicianWorks a caseload from a dashboard of outstanding items and recent activity, assigns forms and reviews submissions.
L4PatientCompletes assigned intake and assessment forms in a self-service portal of their own, with nothing else visible.

What the platform does.

Multi-tenant clinic and role model

Organization, clinic, clinician, patient. Every record is scoped to a clinic, and RBAC with four roles means a user only ever sees data for clinics they belong to.

Patient management

Central records with demographics, status and per-clinic assignment. Tasks and grouping drive bulk actions across a caseload; clinician dashboards surface outstanding items.

Dynamic intake and assessment forms

A form builder for custom forms — sections, field types and validation, configured without code. Assigned per patient, completed in the portal, with supporting document upload.

Passwordless authentication

One-time codes delivered by email, backed by short-lived access tokens. Automatic session refresh, auto-lock after inactivity, and account lockout after repeated failed attempts.

Immutable audit log

Every create, update and delete on clinical data records who, what, when and which record. Security and reminder events land alongside — a foundation for HIPAA-aligned reporting and export.

Automated reminders

Scheduled reminders for outstanding forms and appointments, sent asynchronously so the app stays responsive. Branding and reminder behavior configured per clinic.

Application architecture

A web front end, a REST API, and workers behind it.

Modern web front end

Next.js / React, with light and dark themes across all four role portals.

REST API back end

Django and Django REST Framework on PostgreSQL 17, with role-scoped querysets so data cannot leak across clinics.

Background workers

Celery and Redis run email and scheduled jobs off the request path; transactional email goes through a managed cloud email service.

Frontend

  • Next.js / React
  • TypeScript
  • Light and dark themes

Backend

  • Django / Django REST Framework
  • Passwordless email OTP + short-lived tokens

Data

  • PostgreSQL 17
  • Redis
  • Celery (worker + beat)

Platform

  • AWS ECS Fargate
  • Terraform (infrastructure as code)
  • GitHub Actions + OIDC
  • Managed cloud email

Platform & cloud infrastructure

Hosting built for a compliance review.

Hosted on AWS, with three fully isolated environments defined as Terraform, encrypted managed data services, and monitoring wired for HIPAA-aligned alerting — the same architecture pattern we cover in HIPAA-ready AWS architecture.

Three isolated environments

Test, staging and production, each fully isolated and defined entirely as Terraform, so every change is reproducible and reviewable.

Containerized workloads

ECS Fargate behind a load balancer, HTTPS-only with automatic HTTP-to-HTTPS redirect, and a web application firewall in front.

Segmented private network

A VPC with separate public, application and database tiers across two availability zones, with network flow logs enabled.

Managed data services

Managed PostgreSQL and Redis, both encrypted at rest and in transit with enforced TLS.

Secrets and credentials

A managed, KMS-encrypted secret store — no plaintext credentials — with automated 30-day password rotation on an alternating-user scheme, zero downtime, no app changes.

CI/CD delivery

GitHub Actions with short-lived OIDC credentials, no long-lived cloud keys. Each deploy builds the image, runs migrations, and rolls out across all services.

Backups and disaster recovery

  • Daily automated encrypted snapshots stored in a write-once (WORM) locked backup vault.
  • Multi-AZ production database and redundant NAT gateways; every service holds at least two running instances.

Security and compliance monitoring

  • Account-wide audit logging (CloudTrail), threat detection (GuardDuty), and posture management (Security Hub, Config, Inspector).
  • HIPAA-aligned alarms on privileged and anomalous activity: root-account use, console login without MFA, repeated unauthorized API attempts, IAM policy changes, network security-rule changes, and audit-trail tampering.
  • Database audit logging — connection and disconnection logging, forced TLS, slow-query logging — retained for 365 days.
  • CloudWatch dashboards and composite alarms, so one incident produces one alert; security alerts route separately from operational alerts.

Before and after.

BeforeAfterPaper and spreadsheet intakeStructured digital forms patients complete before their visitNo shared access modelRole-based portals with enforced per-clinic data isolation across all sitesManual, inconsistent follow-upAutomated reminders for outstanding forms and appointmentsNo audit trailComplete, queryable audit log of every change to clinical dataFragmented point toolsOne platform for operations, intake and clinician workflow across the organizationAd hoc single environmentThree isolated environments (test, staging, production), defined entirely as codeManual credential handlingEncrypted secret storage with automated 30-day zero-downtime rotationNo security monitoringContinuous threat detection and HIPAA-aligned audit alertingUnclear recovery storyDaily encrypted backups, immutable backup vault, multi-AZ production database

Regulated software, built to be reviewed.

Tenant isolation enforced in the queryset, an audit trail written on every mutation, and AWS infrastructure defined entirely as code — the things an auditor asks for, built in from the start.