Dr. Salik Memorial Hospital
Full-stack hospital management system in live production use: 9-role staff portal, patient portal, OPD/IPD workflows, billing, lab, pharmacy, and a bilingual public website.
The Problem
Dr. Salik Memorial Hospital in Karachi was managing patient records, appointments, lab results, prescriptions, and billing through a mix of paper files and disconnected spreadsheets. Clinical staff had no unified view of a patient's history, billing was error-prone, and there was no way for patients to access their own records or results remotely.
My Role
Full-stack engineer and product owner. Designed the full data model, role-based access system, and workflow logic across all 9 staff roles. Built and deployed every layer (database schema, API routes, auth, UI) and shipped it to production at drsalikmemorial.com.
Core Features
9-Role Staff Portal
Role-based access for Super Admin, COO, Receptionist, Doctor, Nurse, Pharmacist, Lab Technician, Accountant, and Store Manager. Each role sees only the workflows relevant to their function. No shared screens, no permission leakage.
OPD / IPD Visit Management
Full lifecycle management for outpatient and inpatient visits: registration, triage, clinical notes, diagnoses, vitals, electronic orders, edit/cancel with audit history, and discharge summaries.
Lab, Pharmacy & Billing
Lab requests flow from doctors to technicians with result entry, reference ranges, and printable result sheets. Prescriptions route to pharmacists for dispense tracking. Billing generates itemised bills, processes payments, issues receipts, and handles refunds.
Patient Portal
Patients log in with their MR number and phone OTP to view visits, diagnoses, lab results, prescriptions, and bills. They can download medical summaries, request appointments, prescription refills, and submit feedback.
Live Queue & Audit Trail
Live queue management per department with server-side audit logging capturing every sensitive action (user, timestamp, IP address, and user-agent), with an approval workflow for critical edits.
Bilingual Public Website
Public-facing site in English and Urdu with live queue wait times, doctor directory, services and fee schedule, department hours, and emergency one-tap call and WhatsApp buttons.
Screenshots
Tech Stack
Architecture Overview
Next.js 16 App Router with server components and server actions handles both the frontend and API layer with no separate backend service. Drizzle ORM manages a strongly-typed schema on Neon Serverless Postgres with row-level patterns for multi-role data isolation. NextAuth v5 handles session management with role claims embedded in the JWT. All mutations go through server actions with Zod validation before hitting the database. The audit log writes on every sensitive mutation using a database trigger + server-side middleware, capturing IP and user-agent from request headers. Vitest covers unit and integration tests for billing calculations and role-permission logic.
Impact
Live in production at drsalikmemorial.com, actively used by hospital staff. Eliminated paper-based patient record management. Gave patients direct access to their medical history for the first time. Reduced billing reconciliation from hours to minutes with automated receipt generation and payment tracking.
What I Learned
Building for a clinical environment requires stricter correctness guarantees than typical web apps: a wrong bill or missing lab result has real consequences. Invested heavily in Zod schema validation at every boundary and comprehensive test coverage for billing logic. Also learned that role-based access in a multi-role system is better modelled as a permission matrix at the query level than as UI-layer guards alone.