Overview
I work on a production Electronic Medical Record (EMR) and patient intake platform at Corunit Media Corp, contributing across the Django backend, REST APIs, the JavaScript frontend, and production operations.
The platform supports a clinic's day-to-day work from a patient's first intake form to SOAP notes, appointments, superbills, and the administrative tools around them. My role has grown from frontend development into backend engineering, database design, API development, deployment, and production support.
My contributions
- Developed and evolved features across a full-stack healthcare platform built with Django.
- Built and improved patient intake workflows involving complex patient data structures and forms.
- Developed clinical documentation workflows, including SOAP notes.
- Implemented appointment scheduling functionality.
- Contributed to billing and superbill workflows, authorization forms, invoices, ticketing, and administrative functionality.
- Developed REST APIs with Django REST Framework.
- Implemented authentication and role-based access control.
- Worked on audit logging and data-protection mechanisms.
- Supported data import and migration workflows.
- Investigated and resolved client-reported bugs.
- Participated in production deployment, maintenance, and debugging on AWS.
The problem
A clinic runs on a chain of connected workflows: a patient completes intake, a provider documents the visit, staff schedule follow-ups, and billing turns the encounter into a superbill. When those steps live in separate tools or on paper information gets re-entered, context is lost between roles, and a simple question becomes hard to answer: who changed this record, and when?
The platform brings these workflows into one web application, with access scoped to each user's role and an audit trail around sensitive records.
Who uses it
The platform serves clinic teams with different responsibilities providers documenting care, front-office staff handling intake and appointments, and billing and administrative users working with superbills, authorization forms, invoices, and support tickets. Each group needs a different slice of the same patient record, which makes access control a core design concern rather than an add-on.
At a glance
- Patient intake workflows
- SOAP-note clinical documentation
- Appointment scheduling
- Billing & superbill workflows
- Authorization forms & invoices
- Ticketing & administrative tools
- REST APIs with Django REST Framework
- Authentication & role-based access control
- Audit logging & data protection
- Data import & migration workflows
Architecture overview
A high-level view of the layers I work across. Implementation details are confidential.
5 layers · select a layer for details
-
Users Clinic roles
Providers, front-office staff, billing, and administrative users — each with role-scoped access.
- Providers
- Front office
- Billing
- Admins
-
Interface Web application
HTML/CSS with Bootstrap, and JavaScript for interactive intake, documentation, and scheduling workflows.
- JavaScript
- Bootstrap
- HTML/CSS
-
Application Django + Django REST Framework
Business logic, REST APIs, authentication, role-based access control, and audit logging.
- Django
- DRF
- RBAC
- Audit logging
-
Data Relational database
SQLite in the documented project configuration, with the data layer kept PostgreSQL-ready through the Django ORM and migration planning.
- SQLite
- Django ORM
- Migrations
-
Operations AWS hosting
Production deployment and maintenance involving Nginx, scheduled background tasks, backups, SSL, DNS, and storage.
- AWS
- Nginx
- Backups
- SSL / DNS
Core workflows
- Patient intake — building and improving multi-section intake forms backed by complex patient data structures.
- Clinical documentation — SOAP-note workflows (Subjective, Objective, Assessment, Plan) that give providers a consistent structure for documenting encounters.
- Scheduling — appointment scheduling functionality for managing patient visits.
- Billing — contributions to billing and superbill workflows, along with invoices.
- Administration — authorization forms, ticketing, and the administrative tooling that keeps a practice running.
How the backend and frontend fit together
Django provides the application layer models, business logic, and page rendering and Django REST Framework exposes REST APIs that the JavaScript frontend uses for interactive workflows such as dynamic forms. Layout and components are built with HTML, CSS, and Bootstrap.
Keeping validation and permission checks on the server means the same rules apply whether a request comes from a rendered page or an API call.
Access control and auditability
Healthcare data needs more than a login screen. I implemented authentication and role-based access control so users reach only the records and actions their role requires, and worked on audit logging so that changes to sensitive data are traceable. Alongside this, I contributed to the platform's data-protection mechanisms.
This case study describes the controls I worked on role-based access, audit logging, and security-focused data handling. It is not a claim of compliance certification.
Engineering challenges
Evolving complex patient data
Intake and clinical forms carry deeply structured information, and clinics ask for changes over time. The challenge is extending forms and data structures without breaking existing records or the workflows built on them which puts a premium on careful, backwards-compatible migrations.
Importing and migrating data
Supporting data import and migration workflows means handling records that don't arrive in the shape the application expects. Imports need validation and mapping, and their results need checking before they can be trusted.
Debugging in production
Client-reported bugs rarely arrive with a stack trace. Resolving them means reproducing the user's workflow, tracing it through the frontend, the API, and the database, and shipping a fix without disrupting a clinic that is using the system.
Deployment and maintenance
I take part in production deployment and ongoing maintenance on AWS. That work has involved Nginx, scheduled background tasks, backups, SSL certificates, DNS, and storage along with the debugging that comes with running software people depend on every day.
Technical decisions
- Permissions enforced on the server. Role checks live in the backend, so access rules don't depend on what the interface hides.
- An ORM-first data layer. The documented project configuration uses SQLite; working through the Django ORM and planned migrations keeps the data layer ready for PostgreSQL.
- Auditability as a feature. Audit logging is treated as part of the product, because "who changed this record?" is a question clinics need answered.
What I took away
Working on healthcare software in production has shaped how I build: understand the workflow before writing the model, enforce rules on the server, make changes reversible, and treat every client-reported issue as a chance to make the system easier to reason about.
Gallery
