A hospital operating system
Most hospital software is a set of departments that happen to share a car park. HealthOS is built the other way round: identity, orders, tasks, results, charges and audit belong to the platform, and departments extend it.
Why it is built this way
A nurse charts observations, a doctor orders a test, pharmacy issues a drug, billing raises a charge. In most systems those are four databases and three spreadsheets, reconciled by someone at the end of the month.
In HealthOS they are the same chain. The observation that scores badly raises the escalation. The drug that is given raises the charge. The bill that is not settled holds the discharge. Nothing is reconciled afterwards, because nothing was separate to begin with.
That has a cost: the platform has to be right before the departments are interesting. Identity, events, idempotency, row-level isolation and audit came first, and every module since has inherited them.
It also has a payoff. When a hospital asks what a patient actually cost, or who was warned and when, the answer is a query rather than an investigation.
Non-negotiable rules
These are checked against the repository on every build. A claim without evidence fails the build in the same way a failing test does.
One canonical patient identity across clinical, laboratory, pharmacy, finance and external exchange.
The encounter is the care context; an episode groups encounters over time.
Every clinical intent becomes a structured order; every action becomes a task with an owner.
Every state transition writes an auditable event. Current state and history are both kept.
Clinical data stays structured and coded. Documents are outputs, not the source of truth.
Departments extend one platform instead of keeping their own patient databases.
Interoperability is contract-based and versioned. Internal models never take an external payload's shape.
Safety checks live inside the workflow, not in a report that runs afterwards.
AI may draft, summarise and route. A person remains responsible for every signed record.
Configuration and policy are versioned, approved, traceable and reversible.
The platform keeps working safely when the network, an integration or the power does not.
High-risk actions need two people: a discount, a settlement exception, a controlled drug, a merge.
What is inside
Hospital software is usually sold as finished. This is what is running, what is being built, and what is specified and waiting its turn.
One stay, end to end
A single admission, with the artefacts it produces and the gates it has to pass. Every identifier below is the real format the system issues.
The bed board shows what is available, what is being cleaned and what is contaminated. Admission opens a stay segment; a transfer closes one and opens the next, so the chain of beds is readable months later.
IP-2026-27-00001 No bed, no admissionRoom, nursing, maintenance, linen, resident medical officer, administration, medical care and attendant, each with its own rounding rule and grace period. A component that is priced and unmapped stops the accrual rather than quietly vanishing from the bill.
accrual ledger, append-onlyObservations are immutable once recorded: a correction supersedes, it never overwrites. A reading that was not taken is reported as not taken, never scored as normal.
escalation worklistAllergy and interaction checks run against the governed formulary. A blocking interaction needs a documented override; an unapproved route is refused outright.
RX-2026-000148 Blocked without an override reasonOne transaction: the chart entry, the stock movement and the charge. A high-alert medicine needs a second nurse who is not the one giving it. Correcting a dose reverses the charge it raised.
ward ledger reconciles to balanceThe WHO checklist runs in order, and the database refuses to record an incision until Time Out is complete and confirmed. The theatre journey is append-only; implants are recorded against the patient for recall.
OT-20260924-0001 Enforced in the database, not the formClinical, nursing, room, physical. The bed is not released before the patient is clinically discharged, and nobody leaves with an unsettled bill or an unsigned summary unless a second person approved the exception and said why.
IP-2026-27-00001-DS-01 Signed summary or a documented reasonA signed summary cannot be edited, through the interface or in the database. An amendment supersedes it and the original stays readable, still verifying against its own hash.
sha256:9f2c…Working example
This is the scoring the observation chart applies to every round, with the same thresholds and the same bands. Move a reading and watch what it asks for.
Early warning score
Twelve-hourly observations. Nothing to escalate.
A single reading scoring 3 escalates on its own, whatever the total. The chart records which readings were taken, so a low total from four observations is never mistaken for a well patient.
Exchange
Every adapter is versioned, qualified against a shadow of live traffic before it is trusted, and reversible. An external system going down never takes the clinical transaction with it.
How a hospital goes live
A phase is not finished because the screens exist. It is finished when the gate passes: a complete ambulatory visit with no shadow register, a full admission-to-discharge stay, an order that reaches a result with audit and failure recovery, a clinical event that produces the correct financial state.
Phases run in order because the later ones depend on the earlier ones being true. Charge capture is only trustworthy if the orders were real.
0 Architecture
1 Foundation — identity, locations, audit
2 Core care — OPD, orders, tasks
3 Inpatient — beds, nursing, discharge
4 Diagnostics — order to result
5 Medication — closed loop
6 Procedure — theatre to recovery
7 Finance — billing, packages, claims
8 Operations — supply, facilities, workforce
9 Interoperability — contract tests
10 Intelligence — metrics, governed AI
11 Enterprise scale — multi-site, recovery
Bring HealthOS to your hospital
Most hospitals do not need everything at once. They need beds and billing to agree, or a laboratory that stops losing orders, or a discharge that cannot leave with an unsettled bill. Tell us which one, and we will show you that workflow running.