Open source · Small settings, full-size obligations

An electronic health record where safety is a structural property, not a policy.

A single clinic answers to the same certification, privacy, and reporting rules as a thousand-bed system, with a fraction of the staff to meet them. NuffEHR is a full electronic health record for the places carrying that weight with fewer people, on the ONC certification track and built in the open by a practicing nurse.

Not yet certified. Not yet in clinical use. Built to the certification bar from the first migration forward.

One record, sized for

  • Independent clinics
  • Rural health clinics
  • Critical access hospitals
  • Small community hospitals
  • Emergency departments
  • Behavioral health
  • Addiction medicine
  • Therapy practices
  • Pediatrics

Certification scope covers inpatient, ambulatory, emergency, and children's health records. A practice uses the parts it needs and none of the rest.

The premise

Three commitments the code has to keep

Structure over policy

A rule that lives in a style guide is a rule that gets skipped at 3am. In NuffEHR the constraint lives in the schema: soft-delete instead of DELETE, row-level security that cannot be created without a policy, an append-only audit log that blocks its own UPDATE. Wrong states refuse to be written.

Vocabulary before invention

Before designing anything custom, look for the established standard first. Drugs are RxNorm. Allergies and problems are SNOMED. Labs are LOINC with UCUM units. Immunizations are CVX, forecast by an ACIP rules engine. Safety logic reads concept graphs, never free text.

Documented while it is built

Every slice ships with prose a clinical reader can follow: what was built, why the design went that way, and what was rejected. The documentation is not a write-up after the fact. It is the reason the architecture holds together.

Architecture

Five services, one boundary

Protected health information stays inside the deployment. The immunization forecaster runs as a local sidecar rather than a hosted API, and that decision is recorded in the database as a structural flag with a check constraint behind it.

Interface

  • React 18 · TypeScript · Vite
  • TanStack Query · Zustand
  • Tailwind, Soothing Modernist tokens
  • No PHI in browser storage

Application

  • FastAPI · asyncpg · Pydantic v2
  • Typed patient context on every call
  • Optimistic concurrency on every write
  • PostgREST for read surfaces

Data

  • PostgreSQL 18
  • OMOP CDM vocabulary, ~138M rows
  • Row-level security, deny by default
  • MinIO for object storage

Clinical decision support

  • HLN ICE 2.56.1 immunization forecaster
  • Runs in-boundary, no PHI egress
  • CDC CDSi test cases as the oracle
  • Forecast provenance ledger per run

Where the 241 standards are enforced

A standard may be enforced at more than one layer. 177 hold at a single layer; 64 span several.

The safety triad

What can go wrong, what defends against it, and what the platform must hold

Three taxonomies that answer to each other. The failure modes are what an EHR can do to a patient. The primitives are the architectural defences. The platform standards are the invariants those defences stand on. Every row cross-references the others. Search all three below.

    Composition graph

    How the 49 primitives depend on one another

    Theme 1: Data substrate as safety substrate Theme 2: Action and state integrity Theme 3: Identity, access, and tenancy Theme 4: Interaction and rendering Theme 5: AI safety Theme 6: Audit, governance, and feedback Theme 7: Defensive defaults and dependencies Theme 8: Population safety and quality infrastructure #1 OMOP vocab as substrate #2 Concept_id safety logic #5 Temporal record-fidelity #47 Reporting from source-of-truth #4 Freshness/ staleness #6 Typed clinical actions #10 Device-state as clinical #28 Hallucination guardrails #45 CDS architecture #46 Risk-score as typed fact #49 Equity-aware design #3 Content provenance #11 Structured clinical reasoning #27 AI advisory-only with sign-off #29 Source attribution (HTI-1) #30 Prompt-injection defense #7 Optimistic concurrency #8 Business-logic state machine #9 Closed-loop ack #23 Confirmation discipline #33 Audit log as safety surface #35 Near-miss capture #41 Fail-safe defaults #12 Server-side input validation #13 Typed patient context #15 Typed encounter context #16 Typed episode context #17 RLS + tenancy structural #18 No silent context switches #19 Async-action cancellation #20 Consent-aware data flow #21 Defensive rendering #22 Stateless UI (no browser PHI) #14 Typed clinician context + AAL #37 Break-glass discipline #39 Governance-as- architecture #24 3 AM commitments #25 Inclusive interaction design #26 Use-error analysis #31 Human-AI team as eval unit #32 Model-change protocol (PCCP) #34 Override audit (no silent dismiss) #36 Pattern detection on audit stream #38 Replayable user-action log #40 Incident-feedback loop / PMS #48 Operational ↔ analytical flow #42 SOUP / dependency risk mgmt #44 ePHI flow mapping #43 Vendor substitutability

    Pink marks a primitive that many others depend on. Cutting one of those is not a local decision. It removes the floor several defences stand on.

    Learning

    The reasoning, written out

    NuffEHR is built as a product and taught as it goes. These are real design rulings from the build. Each one is a decision that could have gone another way, with the reason it didn't. Open one.

    Documentation

    What is written down

    The living documents are updated at the close of every working session, so the state of the project and the state of the docs never drift apart.

    Demos

    See it work

    Walkthroughs of shipped surfaces, recorded against synthetic patients. No real protected health information appears in any recording.

    Roadmap

    All 52 slices, in build order

    NuffEHR is built in vertical slices. Each one is a migration plus the API, the interface, and the workflow it enables, taken to something demonstrable. The order is proposed, not fixed; later slices regularly reveal what should have come earlier. Status uses the palette the application uses at the bedside.

    Migrations applied 10 of 38
    Milestone gates closed 4 of 33

    Foundation, auth, patient chart, and encounters are through their gates. Clinical foundations is the open one.

      Who is building this

      One nurse, writing the record he wanted to chart in

      NuffEHR is the work of a practicing nurse who got tired of arguing with software at the bedside and decided to find out what it would take to build the alternative properly: full certification scope, real vocabulary, real safety architecture, and documentation a colleague could actually learn from.

      If you run a clinic, a critical access hospital, or anything in between, work in EHR safety, or want to use any of this in your own project, get in touch. The taxonomies are meant to be reused.