Kinship EHR

The need

A record system for small behavioral health and developmental disability agencies has to keep each agency's clinical and billing data apart, speak their billing codes, and carry the screeners and plan-review cadence their clinicians already use. Kinship is built around those constraints: tenant isolation in the database, a claims engine, and clinical workflows in the core.

What was hard

1. 1

   Database-enforced tenant isolation

   Every request pins a row-level security role for its organization, and about 40 CI guard scripts fail the build on a leak.

2. 2

   Claims engine

   A pure claim state machine, 837P assembly and fourteen billing rules produce claims ready to submit.

3. 3

   Forward-only BAA signing

   Agreement status moves only forward, using compare-and-set writes.

4. 4

   Clinical screeners and plans

   PHQ-9, GAD-7 and C-SSRS screeners are built in, along with treatment-plan review cadence and signatures.

5. 5

   Field encryption and audit

   Sensitive fields use AES-256-GCM encryption, changes go to an audit log, and dictation streams into notes.

6. 6

   Multi-agency identity

   A person who works at several agencies gets an active profile chosen by a pure selection function.

Stack