Security is architecture here, not a feature added later
The system holds highly sensitive health and financial information. That changes how it has to be built: every request authenticated through an API layer, every user limited to what their role needs, and every change to a medical or financial record recorded with who made it and what it replaced.
A cloud stack where the apps never touch the database
Android applications communicate through secured APIs rather than connecting directly to the database. That single decision is what makes access control, audit logging and scaling possible at all.
Section 43 · Concurrent access
Reception, doctors, nurses, billing, pharmacy, laboratory, management and the Ayushman desk all work simultaneously. The same patient record updates across every authorised device in near real time.
Section 42 · Backup & disaster recovery
The nursing home’s data must not depend on a single physical computer.
- Automated daily backup
- Incremental backup
- Encrypted backup
- Off-site backup
- Database recovery mechanism
- Disaster recovery plan
- Backup monitoring
- Restore testing
Web application
Browser portal for reception, billing, pharmacy, laboratory and management.
Android applications
Doctor, nursing and management apps — they never touch the database directly.
Secure API layer
Authenticated APIs are the only way in. Every request is identified and logged.
Application server
Business rules, billing logic, workflow state and permission enforcement.
Cloud database
The single record of truth, encrypted at rest and backed up automatically.
Encrypted object storage
Reports, scans, consent forms and claim documents, stored separately and securely.
Different users see different information
Every action is permission-based. A doctor sees only assigned or authorised patient clinical information; the billing desk sees money, not clinical notes. This is a legal and clinical requirement, not a convenience.
Super Admin
Full system access.
Nursing Home Management
Financial, operational and reporting access.
Doctor
Only assigned or authorised patient clinical information.
Nurse
Nursing and patient-care information.
Reception
Registration, appointment and admission.
Billing
Billing and payment.
Pharmacy
Medicine and inventory.
Laboratory
Investigation and report management.
Ayushman / Insurance Desk
Insurance and PM-JAY workflow.
Accountant
Financial reports and accounting.
Audit trail
Section 39
Extremely important for a healthcare system. Critical medical and financial records get controlled editing and version history — you can always answer who changed what, and to what.
- Who accessed a patient
- Who created a record
- Who edited a record
- What was changed
- Previous value
- New value
- Date / time
- IP / device where appropriate
- Login / logout
- Discharge approval
- Prescription changes
- Billing changes
- Refunds
- Data exports
Security & privacy
Section 40
Treated as a core architecture component, and designed considering applicable Indian healthcare data, privacy and record-retention requirements.
- HTTPS / TLS
- Encryption at rest
- Encrypted backups
- Role-based access
- Strong password policy
- OTP / 2FA for privileged users
- Session management
- Device / session control
- Audit logs
- Automatic logout
- Database access restrictions
- API authentication
- Secure file storage
- Backup retention
- Disaster recovery
- Data export controls
Three focused apps, plus a browser that needs no installation
Rather than one app doing everything badly, each role gets an interface built around what that role actually does in a shift. The exact number of separate applications is finalised during architecture planning.
Doctor App
Clinical care, patient records, prescriptions and discharge.
- Admitted patient list
- Complete clinical record
- Investigation reports
- Prescribe & order
- Discharge summary & sign-off
Nursing App
Vitals, medication, nursing notes and patient care.
- Shift patient list
- Vitals entry
- Medication & injection schedule
- Intake / output
- Shift handover
Management App
Dashboard, revenue, occupancy and reports.
- Live occupancy
- Revenue & outstanding
- Ayushman & claim position
- Department performance
- Daily MIS
Web application · Section 45
Works on desktop, laptop and tablet. No installation required for the standard interface.
- Chrome
- Edge
- Firefox
- Safari
Room kept for AI, with a hard limit on what it may decide
The architecture keeps provision for AI modules that reduce documentation load and sharpen forecasting. Nothing more than that.
AI remains an assistive layer and does not independently make clinical decisions.
The final security architecture follows your answers
Existing network and Wi-Fi infrastructure, current hardware, printers and barcode requirements, and any data migration from your present records all shape the deployment design. The roadmap page lists everything we need confirmed.