Six layers, and a request has to satisfy all of them.
What the browser talks to
A server-rendered application covering the whole clinical and administrative surface, sitting behind a reverse proxy that terminates TLS. It is the only tier anything outside can reach.
Deciding what you may see
Every route names the permission it requires. Before a query reaches a domain module it has already been cut down to the caller's branch and role, so there is no path where a general login stands in for authorisation.
Where the work happens
Each clinical or administrative domain is its own module, owning its own services, rules and screens. A module never reaches into another module's tables, which keeps a fault in one from becoming a fault in all of them, and lets new domains be added without disturbing what is already running.
How modules talk to each other
An order placed, a result verified, a charge raised: these travel as durable events rather than direct calls. Dashboards and projections stay consistent without one module being able to stall another.
The record itself
One relational record of truth behind a typed data layer, reachable only from the application tier. A patient moving from emergency to intensive care to discharge stays on a single continuous encounter.
Knowing what happened
Activity is recorded append-only, so history is added to and never quietly rewritten. Sensitive records, medico-legal cases among them, carry SHA-256 hash chains, which means an altered history is detectable rather than merely unlikely.
The interesting part is what happens when a check fails.
Your security people should be in the room early.
Not at the end, signing off something already built. These are the six conversations we expect to have with them.