The Problem
A diagnostic clinic handling orthopedic lab work needed a system to generate and manage lab reports and patient records — but unlike most business software, getting the features working wasn't the hard part. Handling patient health data means HIPAA and GDPR requirements shape almost every technical decision: who can see what, how data is stored, how access is logged, and what happens if something needs to be deleted or exported.
This wasn't a project where compliance could be bolted on after the features were built. It had to be part of the data model and access control from the first decision.
What I Built
Secure Lab Report Generation
Lab results generated and stored in a way that keeps patient data access-controlled at every step, not just at the point of viewing.
Patient Record Management
A structured system for patient records that supports the clinic's actual workflow, rather than a generic records template retrofitted to healthcare use.
Role-Based Access Control
Different staff roles see only the data relevant to their function — a core requirement for both HIPAA and GDPR compliance, not just good practice.
Compliance-Driven Data Handling
Data handling designed around HIPAA and GDPR requirements from the outset — access logging, controlled retention, and the ability to respond to data requests correctly.
What Was Technically Involved
Role-based access control isn't a checkbox feature — it means every query and every view in the system has to respect who's asking, not just whether they're logged in. That constraint runs through the whole application rather than sitting in one "permissions" module.
Built with Laravel on the backend and Vue.js for the interface. Laravel's authorization layer (policies and gates) did most of the heavy lifting for enforcing role-based access consistently across the application, rather than checking permissions ad hoc in individual pages.
What This Proves
This is the project to point to if your system needs to handle sensitive data under real regulatory requirements — healthcare, financial, or anything else where "who can see this" isn't a nice-to-have but a compliance obligation. It's also evidence that I design access control as a foundational decision, not an afterthought — which matters even outside regulated industries, any time a system has more than one type of user.