Overview

Branded multi-portal sign-in (Web / Home Health / Administrator). The credential is verified server-side by identity-service — default-deny, no user enumeration, deactivated accounts refused — and every sign-in writes a LOGIN audit entry. Federated SSO + MFA step-up are delegated to Keycloak (Phase 8).

Build-status map of the whole platform (this page).

Organization registry, sub-organizations, locations, users + roles (IAM).

Book appointments (conflict-checked, no provider double-booking) and drive the check-in pipeline: Scheduled → Checked-in → Roomed → Completed, or Cancel/No-show. A roomed visit charts into the Encounter. schedule-service behind schedule:read/write.

Real-time 270/271 payer eligibility: copay, deductible, OOP, coinsurance, plan + PA. TX-Medicaid FFS-vs-MCO lane (Rider 32). Deterministic mock 271 offline; live clearinghouse fail-closed. billing-service behind eligibility:check.

Register a new patient into the practice-scoped chart.

All patients of this practice — filter by care manager, practitioner, clinic, POD, or status; select a cohort and open it in APCM, RPM, or Encounter.

CSV / C-CDA / FHIR / manual intake — drag-&-drop or choose a file, paste, pull this EMR's own FHIR export, or fetch a FHIR URL → staged review → human promotes to chart. Nothing auto-writes.

The MyChartWriter-style clinical encounter: classify the visit (class + patient type) → document the clinical sections with an ambient AI scribe → point-of-care HCC panel (recapture/suspect, live RAF) → CMS-2021 E/M engine (MDM or time, with a why-this-level trace) → charge capture → sign. Signing files an immutable chart document (into the Document Center) and drops the visit into the work queue (incomplete / awaiting-sign / signed-unbilled) → superbill. encounter-service behind encounter:read/write/pre-authorize/sign.

The persistent, coded problem list a patient carries across encounters — HCC category + RAF attached from the CMS-HCC V28 catalog. The shared primitive billing dx-pointers, RPM care plans, and HCC recapture all read. patient-service behind problem:read/write.

The chart's filing cabinet in MyChartWriter-style LOINC-coded tabs — the most recent document on each tab, similar ones behind it (Progress Notes, H&P, Consults, Labs, Imaging, Discharge, Referrals, Procedures, Patient Comms, External Records). Wired to the real patient-service DOCUMENTS domain (ChartDocument, table 52): signing an encounter files an immutable chart document here; the viewer renders the note and can distribute (fax/print/portal/email — recorded on the real distribution trail) or archive. FHIR R4 DocumentReference model. default-deny document:read/write/distribute.

Order outpatient labs (LabCorp / Quest via the Health Gorilla aggregator), transmit the requisition through a FAIL-CLOSED gateway (a deterministic offline demo lab when unprovisioned — it never fabricates an order or a result), and pull results back. Results arrive in the STAGING GATE (PENDING) — a clinician reviews abnormal flags and PROMOTES them to the chart; nothing auto-files. lab-service (:4027) behind default-deny lab:order/read/review; lab_orders/lab_results (tables 55-56).

Create → PDMP → sign (EPCS step-up for controlled) → transmit. Incl. DrFirst Rcopia med-history.

Schedule visit, start video room, join, end, click-to-call — Twilio Video/Voice behind ports.

Enroll a patient with a per-patient care plan (default thresholds + 180-day review), ingest device readings scored against THEIR bounds, and work escalation alerts (OPEN → IN_REVIEW → RESOLVED with a disposition + logged minutes). Readings land in the staging gate — a human promotes them; an out-of-range value raises an alert for safety but never auto-charts. The home-health revenue spine + clinic CCM/RTM engine. rpm-service behind rpm:read/enroll, reading:ingest/promote, alert:triage.

Medicare Advanced Primary Care Management (G0556/G0557/G0558): enroll with consent (verbal or written, disclosures documented) + initiating-visit check; the level is DERIVED from the chronic-condition list + QMB status — never hand-picked. Document the month's service elements, attest, and bill exactly one G-code per patient per month. Dashboard mirrors the emrapp CCM Calendar; the billing tab mirrors CCM Billing (Missing information → Eligible → Ready to bill → Billing completed). apcm-service behind apcm:read/enroll/document/bill.

Behavioral Health Integration + the Psychiatric Collaborative Care Model — placed like APCM. Identify the patient (ICD-10 triggers + PHQ-9/GAD-7 ≥10), consent + initiating visit, interactive PHQ-9/GAD-7/AUDIT-C questionnaires that auto-calculate score + severity + a suicide-risk safety flag on PHQ-9 item 9, enroll, then the monthly non-face-to-face documentation → signed encounter note → attest → bill (standalone BHI 99484 or CoCM 99492/99493/99494) after the OIG checklist. bhi-service behind bhi:read/enroll/document/bill.

Medicare IPPE + Annual Wellness Visit with the billable G-code DERIVED from the coverage facts — never hand-picked: record Part B effective date + prior IPPE/AWV history → G0402 (Welcome to Medicare, first 12 months) vs G0438 (first AWV, once per lifetime) vs G0439 (subsequent, 12-month spacing), rationale shown verbatim. Work the visit-type-specific element checklist (42 CFR 410.15), the structured HRA, and the written 5–10-year screening schedule (printable for the patient); add-ons ACP 99497 (modifier-33 cost-share waiver), PAN G0136 (was SDoH pre-2026), depression G0444 (subsequent-only — bundled into G0402/G0438); attest (blocked until every element is documented) → draft the Medicare claim → billed closes the visit. awv-service behind awv:read/plan/document/bill.

Risk-adjustment capture: HCC V28 catalog, RAF accumulation, MEAT-billable gating, quality measures.

Anthropic client (claude-opus-4-8, mock↔live) suggests ICD/HCC codes from a note INTO the staging gate — a human still promotes. Plus an eCQM care-gap panel. ai-service behind ai:suggest/ai:read.

Validates Monitor/Evaluate/Assess/Treat documentation before an HCC is billable (OIG defense); live RAF capture meter over the CMS-HCC V28 catalog.

Dual-lane claims: professional 837P/CMS-1500 (scrub → 837P → submit → 999/277CA → remittance) AND institutional 837I/UB-04 for TX-Medicaid home-health S9110, branching on claim_type. Two fail-closed gates protect the institutional lane: a BAA org-mapping (no signed BAA → no claim) and a 278 prior authorization (no approved auth in effect → no submission). Fail-closed billing identity (NPI/TIN). billing-service behind claim:read/write/submit, payment:post, billing:org-map, auth:read/request.

Practice/clinical/financial reporting and exports.

Practice configuration that extends the Console: Agreements, Picklists, Escalation Protocols, CCM Care Plan templates, Staff Information (per-user credentialing), Auto-Fax routing, and EMR Access (per-user module grants on the IAM users) — seven tabs, each default-deny behind practice:build.

notification-service (event→Twilio SMS) is built on the backend; no management UI yet.

US-Core FHIR R4 export is live on the backend: GET /patients/:id/fhir returns a collection Bundle (Patient + Coverage + RelatedPerson + Consent), default-deny patient:fhir-read, and it's downloadable from the registration face-sheet. Inbound FHIR import is live too: the Intake FHIR tab ingests a Patient or Bundle (upload, paste, pull from this EMR, or fetch from a URL) into the staging gate — a human still promotes. Still planned: a dedicated interop console + subscriptions. C-CDA import already lands in Intake.