HealthHub

Everything here sits behind authentication, but authentication was never the hard part. Authorisation was. A health record has more than one legitimate reader: the patient, possibly a family member, a practitioner but only for their own patients and only while that relationship exists. Every one is a different rule, and the failure mode is not an error page, it is one person seeing another person's medical history. So access checks live with the data rather than in each route handler. A route that forgets to check is a bug you find in review if you are lucky and in production if you are not, and with this data there is no acceptable version of the second.