Built so mistakes are refused, not found later

Messaging consent is stored with when it was given, and messages are skipped for anyone without it.

UHID, visit, bill and prescription numbers come from one counter per facility, so two desks can never issue the same number.

The activity log shows who registered, edited or opened a file, and when.

The waiting-area screen carries token numbers, doctor and room only. No patient name leaves the system.

Token numbers are issued in sequence for each department and reset at local midnight.

When a doctor starts a consult the visit shows as taken, so a second doctor does not open the same patient.

Signing makes the clinical note immutable. Corrections are written as a new note, so the original stays on record.

The note is saved two seconds after the doctor stops typing, so a power cut does not lose a consult.

A drug's schedule (H, H1 or X) travels from the catalogue onto the prescription line and on to the pharmacy counter.

The pick takes the earliest expiry among batches still in date. An expired lot is never offered.

A shortfall stops the line and states how many units are short, in place of selling into negative stock.

The bill is held until the prescription or prescriber is recorded against the line.

A goods receipt will not take in a batch that is already past its expiry date.

An issue moves a named batch out of central and the same batch into the ward. Quantities always reconcile.

A ward or theatre consumption posts to the patient's bill when it is recorded, not at discharge from memory.

Occupied, cleaning and blocked beds cannot take a patient.

The day close can be run again for the same date and posts nothing twice. The admission night is charged; the discharge day is not.

A manager can run the close by hand for today or an earlier date, and the report states the date it ran for.

Each change of state is logged with who made it, and transfers keep the full history of where the patient has been.

Every scheduled dose ends as given, held, refused or missed. None stays blank.

The chart will not accept held or refused without one.

Planned windows may not overlap for a theatre or for a surgeon. The clash is named by booking number.

All seven sign-in items of the WHO checklist must be ticked, each with who ticked it and when.

The five sign-out items and a signed surgery record are both required. A signed record cannot be edited.

If no theatre tariff exists for the room, anaesthesia and payer class, completion stops. The system never guesses a price.

The bill must be clear, or the patient's share collected and the payer's share approved.

An override needs a reason and is stored with who gave it and the figures at that moment.

The discharge summary cannot be edited once signed.

After any discount or reversal, each GST rate's taxable value times its rate equals the tax shown.

Interim bills are titled as such and carry no invoice number. The number is issued once, at settlement.

A discount cannot exceed the charges, or with its tax, the balance.

A wrong line is reversed by a new line. The original and the correction both stay on the bill.

A bill with a payer share cannot be settled until that share is approved and the patient's share is collected.

The insurer can never be shown as owing more than the bill.

Writing off a shortfall is limited to managers, needs a reason and is kept in the audit trail.

A result that fits no order, or more than one, stays unmatched until the bench attaches or discards it with a reason.

A repeated message is recognised by its contents and applied only once.

Each lab system has its own key, with an optional signed timestamp, and a wrong key is turned away.

A head-office user is locked to their group. A branch outside it does not appear at all.

Each branch has its own database. The console reads across them and merges nothing.

Daily rollups state the date they ran for and refuse a date that has not happened.

The dates or parameters used are returned with the result.

Sensitive actions are written to an audit trail where each entry is linked to the one before it.