Clinic stacks accrete interfaces the way legacy estates accrete VLANs — quietly, until every upgrade requires a calendar of transforms nobody owns. The expensive mistake is not choosing the wrong framework; it is allowing six products to disagree about patient identity while marketing calls the bundle “integrated.”
Patient ID is the real integration boundary
HL7 v2 feeds and FHIR resources are transport. The invariant is canonical patient identity across scheduling, documentation, orders and results. When booking creates ID-A and the EHR opens ID-B, every subsequent message is repair work. Engineering teams then build nightly jobs that deduplicate, remap and pray — tax paid in latency and audit risk.
Design clinics as one bounded context with explicit subdomains: appointments, encounters, orders, observations, billing events. Publish outward through a FHIR façade where external exchange is required; keep write paths internal to avoid dual-record schizophrenia.
Event freshness beats batch reconciliation
Batch files felt safe in an era of overnight lab runs. Clinicians now expect results while the patient is still on site. Architecture should propagate DiagnosticReport and Observation events as they validate — subscribed by the active encounter service — not uploaded when a cron wakes up. Stale reads are a product defect, not an ops schedule.
The NHS Digital Primary Care trajectory assumes services connect. Private platforms still treating integration as a post-go-live project are shipping technical debt with every release train.
Modular monolith vs integration tax
Microservices fashion encouraged best-of-breed sprawl. Healthcare punishes sprawl: shared concepts — patient, practitioner, location, service request — must stay consistent or safety erodes. A modular monolith on one tenant trades theoretical isolation for operational truth: one transaction boundary for the visit that orders, receives and bills.
Promed HIS implements that pattern clinically — not as slideware. Engineers evaluating platforms should score how many user stories still require a middleware invoice after licence signature. Category overview for readers outside the repo: medical office software; UK deployment context: medical practice management software uk.
Engineering due diligence questions
- Is there exactly one patient UUID per human per tenant?
- Do orders created in the encounter service emit idempotent events consumable by lab modules?
- Are external HL7/FHIR endpoints read-only replicas of internal truth — not second writers?
- Can you replay an encounter timeline for debugging without cross-database joins?
- What is the mean time to add a new order type — hours, not quarters?
Observability should trace encounters, not only HTTP requests. When a clinician reports a missing result, support should answer with an event ID and timestamp — not a shrug about last night’s job.
Versioning clinical concepts without breaking feeds
SNOMED, LOINC and local code sets evolve. Internal models need versioned concept maps with effective dates so historical encounters remain interpretable while new orders use current coding. FHIR terminologies help at the edge; the monolith must own the truth table clinicians rely on in the consultation room.
Contract tests on HL7 and FHIR facades catch partner drift before production does. Treat each outbound profile as a consumer-driven contract — especially when private clinics connect to regional labs and imaging networks they do not control.
Load and tenancy boundaries
Multi-site groups need tenant isolation with shared policy templates — not separate databases per site unless regulation demands it. Idempotent consumers matter when networks flap. Lab adapters should tolerate duplicate deliveries without double-charting results — key on order and accession identifiers, not arrival order alone.
Load tests should simulate morning clinic rush: concurrent bookings, result floods and prescribing checks on shared infrastructure. Latency during those windows is a safety parameter.
Schema migrations on clinical tables should be backward compatible across at least one release — rolling upgrades are normal in busy clinics, not maintenance windows granted quarterly. Feature flags should default safe for clinical paths; experimental modules belong off the critical prescribing route until proven.
Medical office software projects fail in the mapping layer long before they fail in the UI. Fix identity and event flow first; frameworks second. Everything else is colour on the calendar.