Building a HIPAA-Aligned Multi-Facility Patient Management SaaS for a US Senior-Care Group — Next.js + Django + PostgreSQL on AWS

The challenge

SHCA managed dozens of senior-care facilities on a patchwork of Excel spreadsheets, paper shift notes, and three disconnected EMR-style tools — with no single source of truth for any patient. Nurses re-keyed updates across systems every shift, families had no visibility, admins had no way to prove who saw what, and onboarding a new facility meant re-creating the same brittle Excel template all over again.

The ask was uncompromising: deliver a HIPAA-aligned, multi-facility patient-management SaaS that any nurse, doctor, admin, or family member could safely log into on day one — with template-driven clinical notes, role-scoped record access, full audit trails, and the ability to onboard a brand-new facility in minutes instead of weeks. Anything less than 'one record, one log, one source of truth' would have shipped the same fragmentation problem in nicer skin.

Our solution

We built a multi-tenant Next.js + Django + PostgreSQL SaaS hosted on AWS, where every patient lives in exactly one record and every action is observable, auditable, and role-scoped.

The Django backend exposes a Django REST Framework API with a strict tenant boundary — every query is filtered by `facility_id` at the ORM layer, so a nurse from Facility A literally cannot SELECT a patient from Facility B even with a forged URL. JWT-based auth wires four roles (doctor, nurse, admin, family) into per-endpoint and per-field permissions, and a single 'audit_event' append-only log captures every read, write, and export with `(user_id, role, facility_id, patient_id, action, timestamp, ip)` so a HIPAA-aligned audit can be produced for any patient over any window in seconds.

Clinical notes — the highest-value workflow in the product — are template-driven. Instead of free-typing a 20-minute SOAP note, a nurse picks a template, fills only the deltas, and the system serializes a structured note plus a human-readable summary. Voice-friendly text inputs, autosave every 5 seconds, and attachable medication / vitals snapshots cut average note time from 18+ minutes to under 5.

The Next.js front-end ships a single SPA-style UX for every role, with role-aware navigation, optimistic patient updates, and an internal facility switcher for admins who manage multiple sites. Family members get a tightly-scoped portal — they only see the patient they are linked to, and only the fields the doctor approved for sharing.

On the infrastructure side: PostgreSQL on RDS with automated point-in-time recovery, S3 with KMS-encrypted attachments and signed time-bounded URLs (no raw S3 URLs in the wild), CloudWatch + Sentry on every endpoint, automated nightly backup verification, and infrastructure-as-code so a second region can be brought up without ticketing the cloud team.

• Multi-tenant patient records with hard `facility_id` boundary enforced at the Django ORM layer (cross-facility access is impossible, not just unlikely)
• Role-scoped access for doctor, nurse, admin, and family — gated both at endpoint and field level
• Template-driven clinical notes with autosave, attachable vitals/medications, and a human-readable summary stored alongside structured JSON
• Append-only `audit_event` log on every read, write, and export, queryable per-patient over any window — HIPAA-aligned out of the box
• Family portal with doctor-approved field-level sharing, time-bounded signed-URL attachments, and per-patient access scoping
• Multi-facility admin console: onboard a new facility, provision roles, and reassign patients without a code change
• AWS-hardened infrastructure: RDS point-in-time recovery, S3 + KMS encryption, CloudWatch + Sentry, nightly backup verification, infrastructure-as-code