Open source · Small settings, full-size obligations
An electronic health record where safety is a structural property, not a policy.
A single clinic answers to the same certification, privacy, and reporting rules as a thousand-bed system, with a fraction of the staff to meet them. NuffEHR is a full electronic health record for the places carrying that weight with fewer people, on the ONC certification track and built in the open by a practicing nurse.
Not yet certified. Not yet in clinical use. Built to the certification bar from the first migration forward.
One record, sized for
- Independent clinics
- Rural health clinics
- Critical access hospitals
- Small community hospitals
- Emergency departments
- Behavioral health
- Addiction medicine
- Therapy practices
- Pediatrics
Certification scope covers inpatient, ambulatory, emergency, and children's health records. A practice uses the parts it needs and none of the rest.
The premise
Three commitments the code has to keep
Structure over policy
A rule that lives in a style guide is a rule that gets skipped at 3am. In NuffEHR
the constraint lives in the schema: soft-delete instead of DELETE,
row-level security that cannot be created without a policy, an append-only audit
log that blocks its own UPDATE. Wrong states refuse to be written.
Vocabulary before invention
Before designing anything custom, look for the established standard first. Drugs are RxNorm. Allergies and problems are SNOMED. Labs are LOINC with UCUM units. Immunizations are CVX, forecast by an ACIP rules engine. Safety logic reads concept graphs, never free text.
Documented while it is built
Every slice ships with prose a clinical reader can follow: what was built, why the design went that way, and what was rejected. The documentation is not a write-up after the fact. It is the reason the architecture holds together.
Architecture
Five services, one boundary
Protected health information stays inside the deployment. The immunization forecaster runs as a local sidecar rather than a hosted API, and that decision is recorded in the database as a structural flag with a check constraint behind it.
Interface
- React 18 · TypeScript · Vite
- TanStack Query · Zustand
- Tailwind, Soothing Modernist tokens
- No PHI in browser storage
Application
- FastAPI · asyncpg · Pydantic v2
- Typed patient context on every call
- Optimistic concurrency on every write
- PostgREST for read surfaces
Data
- PostgreSQL 18
- OMOP CDM vocabulary, ~138M rows
- Row-level security, deny by default
- MinIO for object storage
Clinical decision support
- HLN ICE 2.56.1 immunization forecaster
- Runs in-boundary, no PHI egress
- CDC CDSi test cases as the oracle
- Forecast provenance ledger per run
Where the 241 standards are enforced
A standard may be enforced at more than one layer. 177 hold at a single layer; 64 span several.
The safety triad
What can go wrong, what defends against it, and what the platform must hold
Three taxonomies that answer to each other. The failure modes are what an EHR can do to a patient. The primitives are the architectural defences. The platform standards are the invariants those defences stand on. Every row cross-references the others. Search all three below.
Nothing matches that filter.
Composition graph
How the 49 primitives depend on one another
Pink marks a primitive that many others depend on. Cutting one of those is not a local decision. It removes the floor several defences stand on.
Learning
The reasoning, written out
NuffEHR is built as a product and taught as it goes. These are real design rulings from the build. Each one is a decision that could have gone another way, with the reason it didn't. Open one.
Documentation
What is written down
The living documents are updated at the close of every working session, so the state of the project and the state of the docs never drift apart.
Demos
See it work
Walkthroughs of shipped surfaces, recorded against synthetic patients. No real protected health information appears in any recording.
Roadmap
All 52 slices, in build order
NuffEHR is built in vertical slices. Each one is a migration plus the API, the interface, and the workflow it enables, taken to something demonstrable. The order is proposed, not fixed; later slices regularly reveal what should have come earlier. Status uses the palette the application uses at the bedside.
Foundation, auth, patient chart, and encounters are through their gates. Clinical foundations is the open one.
Who is building this
One nurse, writing the record he wanted to chart in
NuffEHR is the work of a practicing nurse who got tired of arguing with software at the bedside and decided to find out what it would take to build the alternative properly: full certification scope, real vocabulary, real safety architecture, and documentation a colleague could actually learn from.
If you run a clinic, a critical access hospital, or anything in between, work in EHR safety, or want to use any of this in your own project, get in touch. The taxonomies are meant to be reused.