One workspace, not six systems, built department by department the way a real trust is structured. Every feature below is built and running today — this isn’t a roadmap page.
Departments
Every department runs like its own mini-organisation.
Scenario. A cardiology ward and a termination-of-pregnancy clinic share the same trust — but should never share a patient list.
A department tree built from the national treatment-function code list, with its own patients, staff, rota, worklists, day board and wards.
Every department gets a confidentiality class: standard, restricted, or statutory. Sexual health, HIV, gender identity and fertility services are statutory by default and cannot be lowered by anyone, in the product.
Own caseload by default. A department can open itself up to all its own staff for wards where that fits; an organisation-wide role sees every standard department, but never a restricted or statutory one.
The effect. A clinician outside the confidential service can search by NHS number and learn only that a match exists — never the department name, never the record. Nobody browses their way into a service they have no reason to be in.
Patient safety alerts
Alerts that stay useful instead of becoming noise.
Scenario. A patient has a "risk to staff" flag from three years ago, raised at a different site, that nobody has looked at since.
Three tiers: interruptive (blocks an unsafe order until acknowledged), banner (always visible, never blocks), and a quiet suggestion tier that reminds without a pop-up or sound.
Governed categories — safeguarding, risk to staff — need written criteria on screen, a required care plan, a linked incident report, and come up for review every 3–6 months.
A temporary flag for extreme risk lapses automatically if not confirmed within two business days. Other departments can challenge a flag; only the department that raised it, or the patient safety lead, can clear it.
Safety leads can create, retire and re-tier categories themselves — nothing needs an engineer.
The effect. A stale or biased flag cannot just sit there forever, and no single department can unilaterally erase another's safety concern. Every raise, challenge, and clearance is audited.
Referrals
Referrals with a paper trail, not a phone call.
Scenario. Surgery refers a patient to cardiology, marked urgent, with a question about pre-op clearance.
Ticket-style triage and assignment — new, in triage, assigned, accepted, in progress, completed — exactly like assigning a Jira ticket, with comments, watchers and a full activity history.
The request is frozen the moment it is sent: an edit creates a new version, never overwrites the last one. Treatment-safety alerts always travel with it and cannot be left out.
Shared records are linked, not copied, so a correction reaches the receiver automatically — and if a shared record changes after acceptance, the receiver gets a notification, not a stale copy.
A referral can leave the organisation entirely as a FHIR message shaped like the NHS Booking and Referral Standard, with every version kept in an immutable log at both ends.
The effect. Nobody argues six months later about what the referral actually said. A patient referred to another department, or another trust, carries their allergy and safety alerts with them automatically.
Prescribing safety
Catches what a name-only check misses — and a junior doctor can't override it alone.
Scenario. A patient with a recorded penicillin allergy is about to be prescribed amoxicillin. Another, on warfarin, needs something for a sprained ankle. A third stopped an MAOI five days ago.
The drug is picked by clicking a result from the pharmacy's own list — never typed free text — so what gets prescribed is always a real, known drug.
Allergy and interaction checking by real active ingredient and BNF drug class, not just the drug name — amoxicillin is recognised as a penicillin even though the words don't match, and a combination product is checked by what's actually in it.
An allergy or contraindication match is a hard stop for everyone else. Only a Medical Consultant can approve it past, and only with a written reason that's kept on the record.
Some drugs are flagged consultant-or-middle-grade-only; junior doctors are refused before the order is even created. Only medical staff can prescribe at all — never administrative or paramedical.
In-patient, out-patient, and a separate drug chart for what was actually administered: paramedical staff record doses given, medical and administrative staff see it read-only.
Every edit to dose, route, units, or dates is kept as a readable history — who changed what, and when — and the out-patient list feeds straight into the discharge letter.
The effect. The amoxicillin order is blocked before it happens, for anyone below a consultant. The warfarin order comes back with "avoid the combination — use paracetamol instead." A combination antibiotic is still caught by its real ingredients even if its brand name gives no hint.
UK drug data
The whole UK drug roster, not a short list someone typed in.
Scenario. Pharmacy wants to add a drug to the formulary and doesn't want to hand-type its name, form, and generic ingredient and hope they got it right.
Every UK medicinal product from NHS dm+d — generic substances, products, and branded items — searchable by name when pharmacy adds a drug.
Real NHS-published BNF chapter/section codes and real active ingredients per product, not a short hand-curated list: an allergy or class match can be caught even when it isn't one of the common cases anyone thought to add by hand.
A BNF monograph link is suggested for each drug, and pharmacy can check it's correct, add a short plain-language description, and send it for a medical clinician's sign-off before it's treated as reviewed.
The effect. The formulary a clinic actually uses is built from the UK's own drug data, not from whichever examples got typed in first — and the extra coverage can only catch more real conflicts, never fewer.
Clinical scoring & coding
The numbers a chart needs, calculated, not just typed in.
Scenario. A nurse records a full set of observations. A clinician closes an encounter and needs to code the diagnosis.
NEWS2 is calculated server-side from the recorded vitals, following the Royal College of Physicians' published scoring table — a figure typed in by hand is kept for audit only, never used for escalation.
A single very abnormal vital is flagged as a red trigger even when the total score looks unremarkable, exactly as the NEWS2 rules require.
ICD-10 diagnosis coding on every encounter, format-checked on save, with the free-text description always kept alongside the code.
The effect. A wrong score sent from a device or typed in error can no longer silently under-call a deteriorating patient, and every episode carries a real, checked diagnosis code for reporting.
The rest of what runs a shift
Everything above, plus the day-to-day tools that keep everyone moving.
Departments & confidentiality
A department tree from the national code list, three confidentiality classes with a legal floor that cannot be lowered, and cross-department search that reveals nothing but "a match exists."
Patient safety alerts
Three tiers, editable categories, a governed-flag policy for safeguarding and risk-to-staff flags with mandatory review — and measurement of which quiet suggestions actually get acted on.
Referrals
Ticket-style triage and assignment, an immutable version history, linked (not copied) shared records, and a FHIR-based framework for referring to another organisation entirely.
Prescribing safety
BNF-class allergy and drug-interaction checking with a recommendation for each hit, aware of recently stopped medication and documented washout periods.
Clinical scoring & diagnosis coding
Server-calculated NEWS2 from recorded vitals, and ICD-10 diagnosis coding on every encounter.
Notifications
In-app notifications for referral activity and changed shared records, with an email channel for people who aren't signed in — never carrying patient detail, only what to go and look at.
Cross-organisation exchange
Export a referral as a FHIR message bundle to another organisation, import one you receive, and resolve a held message when the patient can't be matched automatically — nothing guessed.
Day boards & wards
Live department lists with triage colour, bed/location, and handoff context, plus ward occupancy and bed moves — every department, not just one, always current.
Theatres
Theatre sessions, cases, and pre-procedure prep packs with consent and safety checks that block booking until the patient is actually ready.
Rota
Coverage gaps and fairness scores surface as suggestion cards with a reason and a confidence score — apply a fix in one click instead of untangling a spreadsheet.
Pharmacy
A real formulary with dosing and contraindications, stock levels, and dispense-against-order, searchable against the full UK dm+d drug roster with a BNF link and clinical review per drug.
Diagnostics & imaging
Imaging orders tied to the patient chart, with reports on file the moment they’re back — no separate system to check.
Communication
Ward messages that become tracked, assignable tasks instead of getting lost in a chat thread, plus escalation rules by role and specialty.
Governance
Subject access request exports, break-glass emergency access with a full audit trail, and audited patient-portal links — the parts of running a clinic that regulators and patients both care about.
Worklist
Every clinical step due today, per patient, with one click into the record. Mandatory steps (consent, documentation) block completion until they’re actually done.
Patient records & consent
Patient charts, consent templates, and recorded consent instances live together — no more chasing a signed form that exists in three different places.
Data-core interoperability
Standards-based FHIR in and out — Patient, Encounter, AllergyIntolerance, Observation, MedicationRequest and Flag resources, all read-only, audited, and claiming no profile conformance we haven't validated.
My Tools
Phrases, macros, and shortcuts for the notes clinicians write every day — small, but it adds up across a shift.
Patient registration
One form captures demographics, GP and next-of-kin details alongside the basics. Registration is checked against NHS Number, not name and date of birth, and opens the existing record instead of creating a duplicate.
Mobile & voice
A phone-ready layout throughout, and voice dictation for clinical notes in any browser that supports it — speak a note instead of typing it on shift.
None of this is claimed without evidence
Every control above links back to real code, a real test, or a stated gap — the same honesty rule behind our compliance tracker. See what's implemented, what's in progress, and what still needs external sign-off.