
Patient Dashboard
I built the staff side of our patient platform: one row per patient.
- 1 chart intakes, estimates and consults
- 100% Right chart chosen in a blind test
Case study
I built the staff side of our patient platform: one row per patient, every document one click away, and a live read only mirror of the practice management system that the estimator and capacity planner read through.
- 1 chart intakes, estimates and consults, all on one chart
- 100% Right chart chosen in a blind test of the record matcher
- ~4 in 5 Intake surveys that link to their chart on their own
- 38 Findings from an eight lens adversarial review, run before the matcher could write
Every system built for the practice named a patient differently: the intake survey by response id, the estimator by its own number, the consult grader by Zoom meeting, the experience survey by email. The Denticon id was optional, typed by hand, and joined nothing. Offices had three spellings, nightly smoke tests sat among real intakes, and the experience report PDF was in storage all along, but the dashboard could not open it.
Two Cloud Run services from one image. The dashboard, behind Google sign in limited to the company domain, holds no Denticon credentials; a sync service that serves no pages holds them. Webhooks and three scheduled jobs keep a Firestore mirror of offices, providers, patients and appointments current, and a registry API with one secret per caller serves it to the estimator and the capacity planner. Profiles join every record on the Denticon id at read time.
The vendor API has no patient search, so the mirror is the only patient index there is. It also drops unknown query parameters silently and returns the whole table with a 200, so a parameter is allowed only once it is proven to change totalCount. The record matcher went through an adversarial review, ran in shadow mode, and refuses when unsure. A person's decision always wins: each link write is a transaction that decides again on fresh documents, and every link is versioned, audited and undoable. A journey step with no linked chart reads unknown, never no.
Started in June 2026 and rebuilt around the Denticon API in September; production reads were proven on 29 September and v0.24.0 shipped on 5 October. Once the sync ran on a timer the mirror went from six days behind to 2.6 minutes behind on the staging copy, the matcher picked the right chart every time in a blind test, about four in five intakes link to their chart on their own, and the capacity planner reads the registry every minute.
- Two Cloud Run services from one image: the dashboard holds no vendor credentials, and the sync service that holds them serves no pages.
- Only query parameters proven to change totalCount are allowed, because the vendor drops unknown ones silently and still answers 200.
- A freshness report that starts from the cursors it expects, so a missing one shows as the worst status instead of vanishing.
- Record matcher kept in shadow mode after an adversarial review (38 findings that collapsed to 4 critical and 11 high defects), lifted only for rules that were measured.
- Registry API with one secret per caller, so revoking one consumer never blinds another.
- 77 vendor API operations transcribed and tested, 18 webhook subscriptions across three offices, and 1,000+ tests.
- Caught a sweep that reported green while all 18 of its calls failed, and secrets that carried a hidden Windows carriage return.
- Next.js 15
- TypeScript
- Firestore
- Cloud Run
- Cloud Scheduler
- Cloud Storage
- Cloud Build
- GitHub Actions





















