A clinic ERP, certified across every module boundary

The problem with modular clinical software

Every module in a hospital system works fine in isolation. The defects live in the seams: a lab order that does not raise an invoice, a prescription that does not reach the pharmacy queue, a billing ledger that disagrees with what was dispensed.

So we certified it the only way that proves anything — by taking one freshly registered patient and walking them through the entire journey in sequence, checking that state carried correctly across each handoff.

• Register → appointment → queue → consultation with vitals and EMR bridge
• Consultation → laboratory order → automatic invoice generation
• Prescription → result entry → billing ledger → pharmacy dispense
• Eleven module boundaries, all verified green for a single patient in one pass

The bugs worth writing down

Invoice numbers were racing. Concurrent requests could generate the same number. We replaced the generation with a self-healing counter and applied it across all five writers, including the in-patient and dental paths that had their own copies. Then we proved it with parallel load rather than assuming.

Patient codes were silently duplicating. Worse than the invoice bug, because there was no unique constraint to surface it — the system was happily issuing the same code twice. Same fix, plus the walk-in registration path that had been missed.

Dates were shifting by a day. Raw PostgreSQL date columns serialised through a server running in a European timezone came back offset, which broke the appointments "today" filter. The correct fix formats in SQL; doing it by slicing strings on the front end just moves the bug.

A PDF export was blank on phones. It rendered perfectly on desktop. The generator was being handed a string source at a width mobile browsers would not lay out. We hit the same class of bug twice, in two different modules, before we recognised the pattern.

What the laboratory module grew into

The lab started as order entry and result capture, and ended up as the most demanding part of the system: a test master with reference ranges, sample accession, a verification chain, formatted reports with their own designer, referral commission tracking, turnaround-time analytics, home collection, and send-out tracking for outsourced tests with the required disclosure on the report.

Two pieces mattered more than the rest. Amendment flow, so a corrected result keeps its history, carries a visible amended marker and forces re-verification. And critical-value acknowledgement, which raises a record automatically when a result falls outside the critical range and prints the communication trail on the report itself.

Commercial and operational

Subscription billing runs on recurring mandates with a renewal path that is proven exactly-once under a deliberate triple webhook race, tested with real money. Expired tenants can still log in — a detail that sounds trivial until you realise the renewal screen is unreachable if the login gate rejects them first.

Sessions can be revoked centrally through token versioning, so a password reset genuinely terminates active sessions rather than leaving old tokens valid until they expire.

Related