POST-MORTEM #112
.NET, Next.js, PostgreSQL
A Next.js front end called a .NET API that trusted the role sent by the browser. Patient and clinician screens were the same session with fields hidden in the client. Appointment reminders included clinical detail.
Next.js for the two portals, ASP.NET Core for the API, PostgreSQL for the record. No claim of a HIPAA certification.
Two applications of the same record, not one view with a CSS hide. The API decides the role from the session. Reminders carry a time and a link, not the clinical note.
ASP.NET Core policies split patient, clinician, and staff. Opening a document writes who did it. The Next.js portals only render what that policy already returned.
A patient token requesting a clinician route is rejected. A clinician token cannot list another clinic’s records. The reminder payload was checked for the visit reason and did not contain it.