Spine Design System v2 · Hospital operating platform

ClinicalOperations

One operating language for a whole hospital, not one department.

A role-aware system spanning patient access, emergency and trauma, inpatient and critical care, diagnostics, pharmacy, revenue cycle, supply chain, allied health, facility operations and enterprise governance — without losing identity, ownership or system state.

Indian multi-specialty hospitals100–300 beds29 connected platform modulesDesktop-first enterprise system

Explore the system View clinical patterns

Fictional demonstration data

Hospital OS/Doctor workspace

Connected · Synced

Meera Nair

ALLERGY

42 years · MRN HOS-024718 · OPD-26-08154

Consent active

Location: Internal Medicine · OPD 4Allergy: Penicillin

Safety-weighted work queue

Current shift · 08:00–16:00

03 tasks

Critical potassium result

Critical

Meera Nair · Internal Medicine

Due now · Awaiting acknowledgement

Complete consultation note

Encounter OPD-26-08154

Due 10:45 · Draft saved

Review medication interaction

Amoxicillin · Penicillin allergy

Blocked · Clinical review required

Consultation

Draft

Presenting concern

Fatigue and intermittent muscle weakness for two days.

Clinical note

Review current medication and confirm the critical laboratory result before signing.

Signing safety check

Critical result acknowledgement and medication conflict review are still required.

Identity anchored · Provenance visible

Last saved 10:32:18

System state

All services operational

Shipped components

Platform modules

Accessibility target

RBAC

Contextual access

AUDIT

Ready patterns

System intent

01 / 13

Designed around the moments where healthcare software fails.

The system reduces ambiguity at handoffs, protects clinical decisions and keeps work recoverable when people, processes or technology are under pressure.

Patient contextPersistent

Safety signalsPrioritised

Role ownershipExplicit

System stateRecoverable

Safety is expressed through hierarchy, language, interaction and recovery—not through decorative red.

Ten design principles

A decision framework for every clinical interface.

These principles govern foundations, components, role-based workspaces and every connected journey across the platform — from outpatient care through emergency, inpatient, surgical and enterprise operations.

Identity before action

Patient, encounter, location and care context remain visible before any consequential action.

Safety earns interruption

Critical alerts interrupt the workflow only when immediate clinical attention is justified.

System state stays visible

Users can always understand whether information is saved, syncing, delayed, blocked or offline.

Roles have clear contracts

Each workspace reflects the decisions, permissions and responsibilities of its clinical role.

Workflow before screens

Components support complete care journeys and handoffs—not isolated pages or decorative dashboards.

Provenance is preserved

Clinical information shows its source, author, timestamp and status wherever trust depends on it.

Ownership is explicit

Tasks, exceptions and approvals clearly identify who must act, what is due and what happens next.

Recovery is designed

Interrupted work can be safely resumed without duplicate actions, lost data or hidden system changes.

Access is operational

Keyboard use, readable contrast, safe target sizes and multilingual readiness are system requirements.

Variation is governed

Tokens, components and clinical rules create consistency while allowing controlled product evolution.

Foundations · 02 / 13

A calm visual system for high-pressure work.

Foundations create a shared language across hospital products while preserving the hierarchy required for clinical safety.

Color supports meaning, but text, icons and structure always communicate the state independently.

Color system

Neutral by default. Semantic by exception.

WCAG-aware palette

Neutral foundations

#101C20

Graphite

--graphite

#17262B

Ink primary

--ink-primary

#4A5F66

Ink secondary

--ink-secondary

#F6F8F8

Canvas

--canvas

#EEF2F3

Surface subtle

--surface-subtle

#FFFFFF

Surface

--surface

Interaction

Teal communicates action—not decoration.

#075458

Action

--action

#063F42

Action hover

--action-hover

#08686D

Link

--link

#D9F0F0

Selected

--selected

#6550E8

Focus

--focus

Semantic states

State before style.

Every semantic color has a defined operational purpose and remains paired with explicit language.

Information

Neutral clinical guidance

#155D8D

Success

Completed or confirmed

#176B42

Warning

Review before continuing

#895000

Critical

Immediate safety response

#8C1D27

Restricted

Permission-limited content

#624293

Typography

Clinical clarity

Inter carries interface hierarchy and long-form documentation with a neutral, highly legible voice.

Sentence case reduces visual noise

Uppercase is reserved for short labels, states and navigational eyebrows.

Interface

Inter Semibold

Titles, actions and decision hierarchy

Clinical data

MRN HOS-024718

IBM Plex Mono for identifiers and timestamps

Multilingual

सुरक्षित और स्पष्ट स्वास्थ्य सेवा

Noto Sans Devanagari for Indian language readiness

Spacing rhythm

An eight-point rhythm keeps dense clinical screens predictable without making them feel cramped.

space-1

4px

space-2

8px

space-3

12px

space-4

16px

space-6

24px

space-8

32px

space-12

48px

Control

6px

Panel

8px

Overlay

12px

Layout anchors

Stable regions reduce reorientation.

Utility header

56 px

Global identity, search and system version

Documentation rail

264 px

Stable navigation and portfolio context

Content maximum

1440 px

Readable documentation and product previews

Base grid

8 px

Spacing rhythm across clinical interfaces

Components · 03 / 13

Reusable decisions, not decorative building blocks.

Every example on this page renders the real @naveenkishor305/spine-ui components — not a static mockup. What you see here is exactly what ships to product apps.

Each component includes visible states, operational language and a defined role within the complete workflow.

Actions

One clear hierarchy for every decision.

Primary actions move work forward. Critical actions are reserved for exceptional safety consequences.

Primary

Secondary

Tertiary

Critical

Disabled

Fields and controls

Labels, context and recovery stay visible.

Inputs never depend on placeholder text alone and validation appears beside the decision it affects.

Patient search

Name, MRN or mobile number

Encounter ID

System-generated identifier

Care location

Required for clinical context

Medication dose

Confirm dose before continuing

Patient identity band

Identity remains anchored to every clinical action.

CMP-IDENTITY-01

Meera Nair

PENICILLIN ALLERGYCONSENT ACTIVE

42 years · Female · MRN HOS-024718 · OPD-26-08154

Internal Medicine · OPD 4 · Dr Ananya Rao

Identity verified at 10:28Context preserved across workspace

Semantic feedback

Meaning is communicated through more than color.

Information

A previous consultation note is available.

Success

Critical result acknowledgement recorded.

Warning

Review the medication interaction before signing.

Critical

Potassium result requires immediate clinical action.

Status indicators

Short, explicit and operational.

ConfirmedIn reviewCriticalRestrictedDraft

Status labels describe the current state

They do not replace ownership, due time or the next required action.

Work queue

Safety-weighted rows preserve ownership and urgency.

Updated 10:32

Task	Patient	Owner	Due	Status
Acknowledge critical potassium result	Meera Nair	Dr Ananya Rao	Now	Critical
Complete consultation note	Arjun Menon	Dr Ananya Rao	10:45	Draft
Review discharge medication	Farah Khan	Clinical pharmacy	11:20	In review

Shared primitives · lifecycle & audit

Reused across every operational module.

One process-stage and one audit-trail language, composed differently per domain — a requisition, an asset, a blood product handoff.

Process stage tracker

Requested
Approved
Fulfilled
Closed

Calibrationdue in 6 daysCalibrationoverdue by 2 days

Chain of custody

Blood bank OT 2 runner
Unit 4 packed red cells
09:14 · Witnessed by S. Patel, RN
OT 2 runner Anesthesia team
Unit 4 packed red cells
09:21

Registered
Commissioned
In service
Maintenance due
Under repair
Retired

Fall risk14MUST score0SafeguardingContact precautionsAirborne precautionscontraindicatedWarfarin + AspirinmoderateMetformin + Contrast

Shared primitives · scheduling, dispatch & dashboards

The gaps closed in already-shipped scope.

Scheduling and outpatient-care shipped in v1 without a real slot grid or queue board — every screen faked it with a table. These close that gap.

Provider slot grid

Dr. Rao — OPD 4

Queue token board

A-014Meera Naircalled0 min

A-015Arjun Menonwaiting8 min

A-016Farah Khanin progress

Dispatch board

New1

Ward 4B · Room 412

Assigned1

Biomedical workshop

Verified1

Lab → Radiology

Avg. wait time

12 min

-2.3 min

SLA breaches

Occupied beds

87%

No change

Ranked bar list

Outpatient Care412 requests

Emergency298 requests

Inpatient Wards176 requests

Pharmacy94 requests

Aging receivables ladder

Current$182,000

31–60 days$94,000

61–90 days$41,000

90+ days$23,000

Inventory level gauge

Min 200Max 600

Min 150Max 500

Supplier comparison matrix

	MediTech Supplies	Carewell Distribution	HealthLink Partners
Price (40%)	8	9	7
Delivery reliability (35%)	9	6	7
Compliance (25%)	10	8	9

Hierarchy tree

Timeline

08:02R. Fernandes, Biomedical
Repair ticket opened for infusion pump IP-0231.
08:45R. Fernandes, Biomedical
Diagnosed faulty occlusion sensor.
09:30R. Fernandes, Biomedical
Part replaced, safety-tested, returned to service.

Clinical patterns · 04 / 13

Safe workflows make the next decision unmistakable.

Clinical patterns combine components into repeatable workflows that protect patient context, communicate risk and preserve recovery.

The system adapts to clinical consequence: routine work stays efficient while high-risk decisions deliberately slow down.

Persistent patient context

Identity remains visible through every decision.

Identity verified

Meera Nair

PENICILLIN ALLERGY

42 years · Female · MRN HOS-024718

Encounter

OPD-26-08154

Location

OPD 4

Clinician

Dr Ananya Rao

Context persists across results, orders and documentationLast verified 10:28

Critical result interruption

Interrupt only when delay could cause harm.

The interruption explains the clinical risk, required response and ownership without removing patient context.

Potassium

6.7mmol/L

CRITICAL

Reference range: 3.5–5.1 mmol/L

08:10

4.8

09:05

5.4

10:18

6.2

10:32

6.7

Immediate clinical review required

Confirm the result, assess the patient and document the escalation before leaving this workflow.

Required response

Result reviewed against patient contextResponsible clinician notified

Review before commitment

High-risk actions reveal their consequence first.

Confirm patient
Identity and encounter verified
Review context
Allergy and renal function checked
3
Resolve warning
Dose exceeds the expected range
Sign order
Available after warning resolution

Dose requires confirmation

Prescribed 500 mg exceeds the recommended range for the recorded renal function.

Progressive disclosure

Show enough to decide, then reveal evidence on demand.

Clinical density is managed through hierarchy rather than hiding essential risk or forcing unnecessary navigation.

01 · Level 1

Decision summary

The minimum information required to choose the next action.

02 · Level 2

Clinical context

Trend, reference range, medication and recent history.

03 · Level 3

Source evidence

Full report, audit history and originating laboratory data.

Save and recovery

Clinical work survives interruption.

Consultation note saved

Automatically saved at 10:34

Version 8

Unsaved changes recovered

Text entered before the connection interruption has been restored.

Recovery state remains visible until acknowledged

Permission boundary

Restricted actions explain the path forward.

RESTRICTED

Controlled medication approval required

Your role can prepare this order, but a credentialed prescriber must review and sign it.

The system preserves the prepared order and records the approval request in the audit history.

Emergency & Trauma

One acuity scale, four protocols.

ESI, CTAS, Manchester and ATS all map onto the same five-step scale. Color is never the only signal — the numeral and urgency word are always shown together.

Devika Iyer

Chest pain, diaphoretic · waiting 3 min

ESI 2Very urgentReassessmentdue in 12 min

Ravi Chandran

Closed forearm fracture · waiting 18 min

CTAS 3UrgentReassessmentoverdue by 6 min

Sunita Verma

Sore throat, low-grade fever · waiting 41 min

Manchester 5Non-urgentReassessmentdue in 54 min

Pathway activation

Time-critical pathways interrupt the workflow.

Trauma, stroke, STEMI, sepsis and isolation triggers use the critical tone — distinct from acuity — because the action required is activation, not classification.

Surgical & Critical Care

One genuinely new pattern; the rest is reuse.

Surveying inpatient-care and surgical-critical-care's 43 screens found only the WHO-style three-phase safety checklist needs a new component. Everything else this cluster needs already existed once the cross-cutting primitives were built.

Sign-In
Time-Out
Sign-Out

Time-Out

Team introductions complete

Surgical site and side confirmed aloud

Antibiotic prophylaxis given within 60 min

What this cluster reuses

Deliberately not rebuilt.

ICU severity scoring (SOFA/APACHE) is a numeric score, not a new color scale — it reuses RiskScoreBadge.

SOFA score9

Rapid response and ICU transfer reuse PathwayActivationBanner — same activation semantics as an ED pathway trigger.

Theatre scheduling → SlotGrid (theatres as resource rows)
Ventilator / hemodynamic trends → Timeline
Implant & specimen traceability → ChainOfCustodyTrail
Discharge & closure readiness → ProcessStageTracker

Accessibility · 05 / 13

Accessibility is part of the clinical safety model.

Hospital interfaces must remain understandable and operable across different abilities, devices, environments and levels of urgency.

Accessibility is verified inside complete workflows because clinical risk often appears through context, sequence and state.

Perception and readability

Essential information remains readable under pressure.

Contrast, scale and target size are treated as operational requirements rather than final-stage visual adjustments.

4.5:1

Body-text contrast

Critical information remains readable in every supported state.

44 × 44

Minimum action target

Primary controls remain usable with touch or limited dexterity.

200%

Supported zoom

Content reflows without hiding actions or patient context.

Never

Color alone

Icons, labels and language always reinforce clinical meaning.

Keyboard and focus

Focus follows the clinical decision sequence.

Medication review

Meera Nair · OPD-26-08154

REVIEW

Medication doseEnter the adjusted doseDose exceeds the expected range for the recorded renal function.

Tab moves forward · Shift + Tab moves backward

Patient context
Identity is announced before the active clinical task.
02
Dose field
The visible focus indicator follows the expected reading order.
03
Warning details
The error explanation is connected to the affected field.
04
Review action
The primary action follows the information required to decide.

Errors and recovery

Errors identify the problem and the path forward.

2 issues prevent signing

Correct the highlighted fields. Previously entered information has been preserved.

Work is preserved

Returning to an error never clears validated patient, medication or note information.

Meaning beyond color

Every state combines language, symbol and visual treatment.

READY

Ready to continue

Required information has been reviewed.

ATTENTION

Review before continuing

A decision needs additional clinical context.

CRITICAL

Immediate response required

Delay could result in patient harm.

RESTRICTED

Approval is required

The current role cannot complete this action.

Motion

Animation never blocks a decision.

Reduced-motion preferences remove non-essential transitions while preserving state changes and confirmation.

Time

Time-sensitive states remain controllable.

Sessions warn before expiring, work is preserved and additional time can be requested without losing context.

Cognition

Language explains one decision at a time.

Instructions use explicit verbs, stable terminology and visible consequences instead of relying on memory.

Content and language · 06 / 13

Clinical language reduces hesitation at the point of care.

Interface content helps people understand the current situation, make a safe decision and know exactly what happens next.

Concision never removes essential clinical context, ownership or consequence.

Writing foundations

Every message supports one clear clinical decision.

Name the action

Use specific clinical verbs such as review, acknowledge, prescribe and sign.

Explain the reason

State why information or confirmation is required before asking for it.

Reveal the consequence

High-risk messages explain what could happen if the action is delayed.

Identify ownership

Make the responsible person, role or team explicit at every handoff.

Action-oriented microcopy

Replace generic instructions with explicit guidance.

Avoid

Something went wrong.

Please try again later.

Use

The medication order could not be saved.

Your entered information is preserved. Check the connection and save the order again.

Message anatomy

Risk messages answer four questions in sequence.

What happened

Potassium result is critical

Clinical context

Result: 6.7 mmol/L · Reference: 3.5–5.1

Consequence

Delay could result in cardiac complications.

Required action

Assess the patient and notify the responsible clinician.

Controlled terminology

Stable language makes actions predictable across workflows.

Avoid	Use	Why
Submit	Sign medication order	Names the committed clinical action.
Proceed	Review dose and continue	Explains what must happen next.
Invalid value	Enter the dose in milligrams	Provides a direct correction.
Access denied	Prescriber approval required	Explains the permission boundary.

Language readiness

Translate clinical meaning, not words in isolation.

ENGLISH

Review allergy information before prescribing.

Primary interface language

हिंदी सहायता

दवा लिखने से पहले एलर्जी की जानकारी जाँचें।

Context-preserving assisted translation

Localization rules

Meaning remains stable across languages.

Preserve medication names, units and reference ranges.
Use familiar local terms without changing clinical meaning.
Allow longer translated text without truncating actions.
Validate high-risk translations with clinical reviewers.

Information architecture · 07 / 13

Structure keeps complex hospital work understandable.

Hospital information is organized around roles, patients, encounters and clinical tasks instead of disconnected software modules.

People should always understand where they are, whose information they are viewing and what action comes next.

Product hierarchy

Seventeen modules behave as one connected hospital system.

Modules are grouped by operational purpose while shared patient, encounter and permission models maintain continuity.

Clinical care

Patients
Appointments
Doctors
EMR

Diagnostics

Laboratory
Radiology
Pharmacy

Revenue and access

Billing
Insurance

Hospital operations

Inventory
Assets
Finance
Human resources

System governance

Dashboard
Reports
Administration
Settings

Navigation model

Navigation moves from system to decision.

01
System
Hospital-wide navigation
Provides stable access to modules, work queues, search and alerts.
02
Workspace
Role-specific work area
Prioritizes the tools and information required for the current role.
03
Patient
Persistent patient context
Preserves identity, location and safety information across clinical tasks.
04
Task
Focused decision layer
Shows the information and actions needed to complete one safe outcome.

Contextual wayfinding

Location and patient context remain visible.

Clinical workspace

Meera Nair

UHID 0048217 · Female · 54 years

PENICILLIN ALLERGY

PatientsCurrent encounterMedication review

Active task: Review discharge medication

Encounter OPD-26-08154 · Cardiology · Dr. Arun Rao

Patient identity, active encounter, department and current task remain available without depending on browser history.

Object relationships

Every clinical record connects through a traceable care episode.

PATIENT

Patient

The stable person record

ENCOUNTER

Encounter

A specific episode of care

ORDER

Clinical order

A request for investigation or treatment

RESULT

Result

The verified clinical outcome

Documentation

Notes and observations inherit patient and encounter context.

Financial record

Charges remain linked to the service that created them.

Audit history

Every change records actor, time, object and clinical context.

Role-based architecture

The structure stays consistent while priorities change by role.

Clinician

Patient care

Patients · EMR · Orders · Results

Laboratory

Diagnostic workflow

Worklist · Specimens · Results · Critical alerts

Billing

Revenue cycle

Encounters · Charges · Insurance · Payments

Findability

Search returns objects, not ambiguous pages.

Search patient, encounter, order or result

Patient · Meera Nair · UHID 0048217
Encounter · OPD-26-08154 · Cardiology
Result · Potassium · Critical

External referral · 08 / 13

Referrals remain accountable beyond the hospital boundary.

The referral service coordinates clinical information, consent, authorization, secure exchange and follow-up when care moves to an external organization.

Sending documents is not completion. The loop closes only when the receiving provider acknowledges responsibility and returns the outcome.

Referral workflow

One traceable journey from clinical need to continuity of care.

Identify
Confirm the clinical need for external care.
Prepare
Assemble the minimum referral package.
03Current
Authorize
Verify consent and financial approval.
04
Send
Transfer the referral through a secure channel.
05
Confirm
Receive acknowledgement from the provider.
06
Close loop
Reconcile the outcome into the patient record.

Referral package

Share enough context for the next clinician to act safely.

Referring organization

Aarogya Multispecialty Hospital

Cardiology · Dr. Arun Rao

Receiving organization

Metro Advanced Imaging Centre

Cardiac imaging · External provider

Meera Nair · UHID 0048217

Cardiac MRI · Evaluate suspected myocarditis

Referral reason
Clinical question and requested service
Included
Clinical summary
Diagnosis, treatment and current condition
Included
Investigation results
Relevant laboratory and imaging reports
3 files
Medication list
Active medicines, dose and frequency
Included
Patient consent
Permission to share health information
Required

Consent and authorization

Permission boundaries remain visible before transfer.

Patient consent is required

The referral package cannot be released until consent to share clinical information is recorded.

Insurance authorization

IN REVIEW

Request PA-260184 · Submitted today at 10:31

Patient responsibility

₹2,500 estimated

The patient must be informed before appointment confirmation.

Referral status

Every handoff records time, ownership and the next expected event.

10:18
Referral initiated
Dr. Arun Rao requested an external cardiac MRI.
Owner
Referring clinician
10:24
Clinical package prepared
Relevant notes, results and medication history attached.
Owner
Cardiology coordinator
10:31
Insurance review started
Prior authorization request sent to the insurer.
Owner
Insurance desk
Pending
Receiving provider acknowledgement
Confirmation is required before the referral is complete.
Owner
Referral coordinator

Secure exchange

Interoperability preserves clinical meaning and accountability.

Identity matching

Patient identifiers are verified before information is released.

Minimum necessary data

Only information required for the referral purpose is transferred.

Secure delivery

Documents use an approved encrypted exchange channel.

Receipt confirmation

The receiving organization acknowledges access to the package.

Recovery and escalation

Unacknowledged referrals return to an active work queue.

Acknowledgement overdue

Contact the receiving organization if no acknowledgement is recorded within four working hours.

Escalation path

Referral coordinatorClinical ownerOperations lead

Shared accountability

Each participant knows what they own during the handoff.

Role	Responsibility
Referring clinician	Defines the clinical question and confirms that referral is appropriate.
Referral coordinator	Prepares the package, communicates with the provider and tracks status.
Insurance desk	Confirms coverage, authorization requirements and patient liability.
Receiving provider	Acknowledges the referral, accepts responsibility and returns the outcome.

Role-based workspaces · 09 / 13

Each role sees the same hospital through a different responsibility.

Workspaces prioritize the patients, tasks, decisions and exceptions relevant to the current role while preserving one shared clinical record.

Role adaptation changes priority and available actions. It never changes the meaning of clinical information.

Workspace families

Five role views coordinate one connected care journey.

Each workspace foregrounds different responsibilities while sharing patients, encounters, orders, results, tasks and audit history.

Active

Clinician

Diagnosis and treatment

Consultations, clinical documentation, orders, results and prescriptions.

Nursing

Continuous patient care

Assessments, vital signs, medication tasks and care-team handoffs.

Laboratory

Diagnostic workflow

Specimens, worklists, verification, critical results and acknowledgement.

Billing

Revenue and access

Charges, estimates, insurance authorization, payments and claim queries.

Operations

Hospital coordination

Capacity, queues, escalations, service performance and unresolved work.

Clinician workspace

Priority, patient context and clinical action share one surface.

Cardiology · OPD

Dr. Arun Rao · Clinical workspace

Meera Nair

PENICILLIN ALLERGY

UHID 0048217 · Female · 54 years · Cardiology

Encounter

OPD-26-08154

Location

OPD 4

Active consultation

Assessment and care plan

DRAFT SAVED · 10:34

Clinical summary

Persistent fatigue and intermittent palpitations. Recent potassium result requires immediate review before the treatment plan can be signed.

Working diagnosis

Suspected myocarditis

Next investigation

External cardiac MRI

Potassium result requires acknowledgement

Result 6.7 mmol/L · Reference 3.5–5.1 mmol/L. Review the result and document the clinical response.

Workspace contract

Adaptation never removes safety or accountability.

Role before menu

The workspace begins with the responsibilities of the signed-in role instead of exposing every module.

Patient context persists

Identity, encounter, allergies, location and care team remain visible while tasks change.

Ownership is explicit

Every task identifies who owns it, when it is due and what completes it.

Permissions explain recovery

Restricted actions preserve prepared work and show the correct approval path.

One object, multiple responsibilities

Shared records remain meaningful across role boundaries.

Role	Shared object	Priority	Primary action
Clinician	Potassium result	Clinical consequence	Review and acknowledge
Laboratory	Potassium result	Verification and release	Validate and notify
Nursing	Potassium result	Patient observation	Assess and escalate
Operations	Potassium result	Unresolved critical event	Monitor ownership

Cross-role handoffs

Work moves only when the receiving role accepts responsibility.

Originating role	Handoff event	Receiving role	Completion evidence
Laboratory	Critical result verified	Responsible clinician	Result acknowledged and response documented
Clinician	Medication plan signed	Nursing and pharmacy	Tasks accepted by the receiving roles
Billing	Authorization approved	Clinical coordinator	Blocked service becomes schedulable

Permission boundaries preserve prepared work

When a role cannot complete an action, the system explains the restriction, saves the entered information and identifies who can approve it.

Unaccepted handoffs return to the active queue

Work does not disappear after it is sent. Overdue acceptance remains visible to the originating role and escalates according to clinical consequence.

Queue owner · Cardiology coordinator

System states & recovery · 10 / 13

Every system response must explain what happened and what happens next.

Hospital work cannot disappear behind generic spinners, silent failures or disabled controls. Every state preserves context, communicates impact and supports safe recovery.

State severity follows clinical consequence—not visual decoration or technical implementation.

Semantic state families

Color, language and interruption level communicate one meaning.

Informational

Explain context without interrupting work.

Example

Referral package updated 4 minutes ago.

In progress

Show active processing and expected completion.

Example

Insurance authorization is being reviewed.

Successful

Confirm completion and preserve evidence.

Example

Clinical note signed and added to the record.

Warning

Expose risk while safe continuation remains possible.

Example

Authorization expires within 24 hours.

Critical

Interrupt when clinical or operational harm is possible.

Example

Potassium result requires acknowledgement.

Restricted

Explain why an action is unavailable and who can help.

Example

Clinical approval is required before cancellation.

Recoverable clinical workspace

Interrupted work remains visible, protected and traceable.

Consultation note · Meera Nair

OPD-26-08154

Connection interrupted

Recovery active

Your note remains available in this workspace. It will not be added to the patient record until synchronization succeeds.

Last synchronized: 10:34Unsynced changes: 3Owner: Dr. Arun Rao

Assessment

Clinical note retained during interruption

SAVED IN WORKSPACE

Patient reports persistent fatigue and intermittent palpitations. Critical potassium result reviewed. External cardiac MRI referral remains pending authorization.

Signing is temporarily unavailable

The note cannot be signed until all retained changes synchronize with the patient record.

State matrix

Common states use consistent communication and recovery rules.

State	Trigger	Message	Primary action	Preserve
Loading	Requested information has not returned	Describe what is loading	Wait or cancel safely	Keep surrounding context visible
Empty	No records exist in the current scope	Explain why the area is empty	Offer the correct first action	Preserve filters and role context
No results	Search or filters return zero matches	Repeat the active search scope	Clear or adjust filters	Keep the entered query
Validation error	Entered information is incomplete or unsafe	Place the issue beside its source	Correct without losing work	Retain all valid entries
System failure	The service cannot complete the request	State the impact and recovery status	Retry or route to support	Protect prepared work
Permission blocked	The signed-in role lacks authority	Explain the permission boundary	Request the correct approval	Save the prepared transaction

Recovery contract

Recovery follows one predictable four-step structure.

01
Preserve
Keep valid entries, selections, filters and patient context intact.
02
Explain
State what happened, what was affected and whether clinical work is safe.
03
Route
Identify the person, permission or system responsible for resolution.
04
Recover
Provide a safe retry, alternate workflow or clearly monitored queue.

Empty-state distinctions

An empty surface must explain whether work is absent, complete or restricted.

No results

No patients match “Meera Nair” within Cardiology OPD today.

Work queue complete

All assigned critical-result acknowledgements have been completed.

Access restricted

Medication pricing is available only to authorized billing roles.

Critical states require acknowledgement

Clinical risk remains active until a named owner reviews the event, records the response and completes the acknowledgement.

Never dismiss automatically

Disabled actions require an explanation

The interface identifies the unmet condition, preserves prepared work and shows the role or approval needed to continue.

Never rely on reduced opacity alone

Privacy, access & audit · 11 / 13

Sensitive access must remain purposeful, limited and accountable.

Hospital access is determined by identity, role, care relationship, declared purpose and clinical consequence—not role labels alone.

Restricted information stays discoverable as a protected placeholder so users understand what exists and how to request it.

Access decision model

Permission is evaluated for every sensitive action.

01
Identity
Confirm the authenticated person and active professional role.
02
Relationship
Verify an active care, operational or administrative relationship.
03
Purpose
Match the requested information to a valid work purpose.
04
Scope
Reveal only the minimum information required for the task.
05
Evidence
Record access, decisions, exports and exceptional disclosure.

Restricted-record pattern

Protection does not create a misleading empty record.

Patient record access

ROLE · BILLING EXECUTIVE

Meera Nair

UHID 0048217 · Female · 54 years

Identity verified

Clinical documents

Protected information

Access restricted

Clinical documents exist but are not available to your current role.

Your billing responsibility does not require access to clinical narrative. Relevant diagnosis and procedure codes remain available inside the active claim.

Reason

Minimum-necessary access

Current role

Billing executive

Approval owner

Health information manager

Emergency access

Break-glass access is exceptional, temporary and reviewed.

Emergency access requested

Use only when immediate care requires information that your normal permissions do not provide.

Declared purpose

Emergency treatment

Access duration

30 minutes

The patient, requester, purpose, accessed information, device and expiry time will be recorded for governance review.

Exceptional-access evidence

Every exceptional step creates visible evidence.

11:42:03
Emergency access requested
Dr. Asha Menon
11:42:08
Identity re-authenticated
Hospital identity service
11:42:11
Purpose and patient recorded
Emergency treatment
11:42:12
Temporary access activated
Expires at 12:12

Privacy patterns

Privacy remains visible through behavior, not policy text alone.

Restricted record

Preserve the existence of the record while masking content the current role cannot access.

Explain restriction and escalation path

Privacy veil

Temporarily conceal patient details when the workspace is unattended or externally visible.

Restore only after identity verification

Minimum necessary

Display only the patient, financial or clinical information needed for the active responsibility.

Scope follows role and purpose

Controlled disclosure

Printing and exporting require a declared purpose, appropriate permission and traceable evidence.

Every disclosure remains auditable

Minimum-necessary access matrix

The same record reveals different information by responsibility.

Role	Patient identity	Clinical record	Billing	Export
Reception	Full	Restricted	Summary	No
Clinician	Full	Care context	Status only	Approved documents
Laboratory	Order context	Relevant history	No	Result only
Billing	Full	Minimum necessary	Full	Permission controlled
Administrator	Masked by default	No	Aggregated	Policy controlled

Audit evidence

The record explains who did what, where, why and when.

Time	Actor	Event	Object	Evidence
11:42:12	Dr. Asha Menon	Emergency access activated	Patient record · UHID 0048217	Purpose, duration and device recorded
11:39:48	Ravi Kumar	Discharge summary printed	Encounter · IPD-26-01429	Printer, document version and reason recorded
11:34:17	Neha Shah	Insurance document viewed	Claim · CLM-26-8291	Billing relationship verified
11:28:06	Dr. Arun Rao	Signed note opened	Clinical note · CN-26-4908	Read-only access preserved

Privacy veil protects unattended workspaces

Patient details are concealed after inactivity, manual activation or display-sharing detection. Unsaved work remains protected underneath the veil.

Identity verification required to restore

Disclosure controls travel with the document

Printed and exported records include patient identity, document version, disclosure purpose, timestamp and responsible user.

Export permission does not imply unlimited reuse

Governance & contribution · 12 / 13

Safe consistency requires ownership, evidence and controlled change.

Core components are centrally governed while specialties and encounters extend them through a reviewed contribution model.

Every accepted change includes accessibility, state, audit, localization, versioning and migration evidence.

Contribution lifecycle

Contributions move through one visible, evidence-based path.

01
Define the problem
Describe the user, workflow, risk and evidence behind the requested change.
02
Review the gap
Confirm that an existing component, variant or composition cannot solve it safely.
03
Assign reviewers
Identify the design, clinical, accessibility, privacy and engineering owners required.
04
Specify behavior
Document anatomy, permissions, content, states, provenance and recovery.
05
Verify evidence
Test usability, keyboard behavior, assistive technology and safety-critical paths.
06
Release responsibly
Version the change, publish guidance and provide migration support.

Contribution under review

Review status, ownership and unresolved evidence remain visible.

Critical result acknowledgement pattern

HOS-CONTRIB-024

Proposed addition

Shared acknowledgement behavior for critical diagnostics

Clinical review

Laboratory and imaging products currently use different acknowledgement controls. The proposal creates a shared pattern for ownership, escalation, response evidence and unresolved-risk routing.

Requested by

Diagnostics product team

Accountable owner

Clinical governance

Target version

1.2

Risk level

Clinical safety

Evidence still required

The proposal cannot enter implementation until escalation timing, keyboard behavior and screen-reader announcement rules are verified.

Definition of ready

Design begins only after the problem and risk are understood.

Clear user and workflow problem
Existing-component gap analysis
Permission and privacy model
Required data and provenance
Required interaction and system states
Keyboard and screen-reader behavior
Offline and error behavior where relevant
Analytics and audit requirements where relevant

Definition of done

Completion requires verified behavior—not a polished default state.

Visual and interaction specification complete
Token use documented with no arbitrary values
WCAG 2.2 AA review complete
200% zoom and text-spacing review complete
Keyboard path verified
Error, empty, loading, restricted and offline states covered
English expansion and one Indian-script sample checked
Critical and irreversible workflows reviewed separately

Accountable ownership

Each quality dimension has a named accountable role.

Governance area	Accountable owner	Responsibility	Review condition
Design-system product	System lead	Roadmap, quality threshold and adoption	Every release
Clinical safety patterns	Clinical governance reviewer	Risk, escalation and acknowledgement behavior	Safety-impacting changes
Accessibility	Accessibility lead	WCAG, keyboard, zoom and assistive technology	Components and workflows
Privacy and consent	Privacy or legal reviewer	Minimum necessity, consent and disclosure	Sensitive-data changes
Security and access	Security and IAM owner	Permissions, identity and exceptional access	Access-model changes
Content and localization	Content-design owner	Terminology, comprehension and language expansion	User-facing content
Tokens and components	Design and front-end maintainers	Implementation quality and API stability	Every component release

Review gates

Review depth follows the consequence of the change.

Required

Design review

Pattern fit, hierarchy, density and consistency

Owner · Design-system owner

Required

Content review

Meaning, terminology, action language and localization

Owner · Content designer

Required

Accessibility review

Keyboard, focus, contrast, zoom and assistive technology

Owner · Accessibility lead

Required

Clinical-safety review

Risk visibility, escalation, acknowledgement and closure

Owner · Clinical reviewer

Required

Privacy and security

Access purpose, disclosure, audit and minimum necessity

Owner · Privacy and IAM

Required

Engineering feasibility

Data, performance, integration and implementation risk

Owner · Engineering lead

Change classification

Version impact reflects behavioral and clinical consequence.

Change	Version impact	Example
Documentation clarification	Patch	Clarify usage guidance without changing behavior
New non-breaking variant	Minor	Add a supported compact density or state
Token meaning or component API	Major	Change semantic meaning, anatomy or implementation contract
Clinical, privacy or access behavior	Formal review	Change acknowledgement, disclosure or permission behavior

Deprecation contract

Removal follows a controlled and traceable migration.

01
Mark the pattern
Show that the component is deprecated and explain why.
02
Name the replacement
Provide the supported alternative and migration examples.
03
Track remaining use
Identify products, templates and records still depending on it.
04
Preserve history
Maintain rendering required for signed or exported records.
05
Remove after review
Complete the migration window and final risk assessment.

Template governance

Governed clinical content cannot be silently changed.

Named owner

Every template has an accountable clinical owner.

Version and scope

The effective version and supported encounter are visible.

Controlled rollout

Updates use versioned release and migration rules.

Historical integrity

Signed records retain the template version used.

Personal shortcuts remain separate from governed content

A clinician may create personal convenience text, but it cannot silently alter required fields, safety instructions, consent language or the approved clinical template.

Clinical change is never treated as cosmetic

A wording, color, timing or interaction change can alter clinical interpretation and must receive review proportional to its risk.

Consequence determines review depth

Version evidence travels with the product

Components, templates and historical records retain the version needed to explain behavior, reproduce evidence and support safe migration.

Never overwrite historical meaning

Release & migration roadmap · 13 / 13

Release the system through proven journeys—not a simultaneous visual rewrite.

Hospital OS begins with shared foundations, proves them through outpatient care, strengthens exceptional behavior and then scales across specialties and facilities.

Each release must remain independently adoptable, reversible, measurable and safe for historical clinical evidence.

Controlled release sequence

Capability expands only after the previous safety contract is proven.

Release 01
Weeks 01–08
Foundation
Establish the shared language, safety context and accessible application structure.
Exit gate
Foundation verified before product migration begins
Release 02
Weeks 09–18
OPD core
Validate the system through a complete outpatient journey involving multiple roles.
Exit gate
One complete clinical journey works across roles
Release 03
Weeks 19–28
Safety & resilience
Add the exceptional, degraded and high-consequence behavior required for clinical trust.
Exit gate
Exceptional paths remain safe and recoverable
Release 04
Week 29 onward
Scale
Extend validated foundations across specialties, facilities and governed automation.
Exit gate
Expansion reuses the shared contract without weakening it

Release 01 · Weeks 01–08

Foundation release

Controlled

Charter and principles
Semantic tokens
Application shell
Patient identity-and-safety bar
Core controls and status patterns
Accessibility baseline

Release 02 · Weeks 09–18

OPD core release

Controlled

Role dashboard and task queue
Patient search and registration
Appointment and check-in
Consultation form and signing
Orders and results
Billing and follow-up

Release 03 · Weeks 19–28

Safety & resilience release

Controlled

Critical-event lifecycle
Restricted records and break-glass
Consent and export
Offline draft and merge review
Interface degradation
Reconciliation workflows

Release 04 · Week 29 onward

Scale release

Controlled

Diagnostics and pharmacy depth
Insurance and claims depth
IPD and nursing extensions
Administration and operations
Multi-site configuration
Analytics and governed automation

Migration path

Migration is a clinical change programme—not a component replacement exercise.

01
Inventory current patterns
Identify screens, components, templates, arbitrary values and duplicate behavior.
Owner · Product and design
Evidence · Current-state inventory
02
Map to shared foundations
Translate legacy colors, typography, spacing, statuses and controls into semantic tokens.
Owner · Design-system team
Evidence · Token mapping record
03
Classify workflow risk
Prioritize patient identity, medication, critical-result and irreversible workflows.
Owner · Clinical governance
Evidence · Risk classification
04
Pilot one complete journey
Migrate an end-to-end workflow instead of validating isolated polished screens.
Owner · Pilot product team
Evidence · Usability and safety findings
05
Prepare people and operations
Publish guidance, train affected roles and prepare support and escalation paths.
Owner · Operations and enablement
Evidence · Readiness record
06
Release with rollback
Deploy in controlled stages with monitoring, recovery ownership and a rollback condition.
Owner · Engineering and operations
Evidence · Release decision log
07
Measure real adoption
Track supported-component use, task outcomes, defects and safety guardrails.
Owner · System owner
Evidence · Adoption dashboard
08
Retire legacy behavior
Remove old patterns only after usage ends and historical evidence remains available.
Owner · Product maintainers
Evidence · Deprecation closure

Release readiness gates

A release proceeds only when every consequential dimension has evidence.

Gate	Decision question	Accountable owner	Status
Design-system fit	Does the release use supported tokens, components and documented composition patterns?	Design-system owner	Required
Clinical safety	Are patient identity, critical events, acknowledgement and recovery verified?	Clinical reviewer	Required
Accessibility	Are keyboard, screen-reader, zoom, contrast and language-expansion paths verified?	Accessibility lead	Required
Privacy and access	Are purpose, permissions, disclosure and exceptional access appropriately bounded?	Privacy and IAM	Required
Operational readiness	Are training, support, monitoring, escalation and rollback responsibilities assigned?	Operations owner	Required
Migration integrity	Can historical records preserve their original meaning after migration?	Data and governance	Required

Controlled pilot

A complete clinical cohort is safer than scattered screen adoption.

OPD pilot · General Medicine

SITE 01 · COHORT A

Included journey

Check-in

Consult

Order

Result

Bill

Cohort boundary is explicit

Users, departments, records, support coverage, rollback conditions and observation periods are confirmed before activation.

Decision model

Continue, contain or roll back using predefined evidence.

Continue

Outcomes meet thresholds and no unresolved safety condition exists.

Contain

Limit the cohort while a bounded defect or support issue is corrected.

Roll back

Restore the verified prior path when safety or record integrity is uncertain.

Schedule pressure never overrides a safety, privacy, accessibility or historical-integrity gate.

Release targets

Adoption is measured with quality and safety—not component usage alone.

Critical accessibility defects

Required before production release

Safety-critical workflows reviewed

100%

Clinical review with recorded evidence

Supported-component adoption

≥ 90%

Across newly migrated screens

Unowned migration blockers

Every blocker has an accountable owner

Rollback decision window

Defined

Before the controlled release begins

Historical record integrity

100%

Versions remain identifiable and reproducible

Historical meaning survives migration

Signed records, disclosures and audit evidence retain the component, template and terminology versions needed to explain their original behavior.

Never rewrite completed clinical history

Adoption includes the people carrying the change

Training, support, feedback, local workflow constraints and escalation ownership are part of the release—not activities scheduled after launch.

Operational readiness is product readiness