Nomercy Hospital has both an outpatient clinic and inpatient services (for patients who need to be admitted overnight). While most nurses are assigned to either the outpatient or inpatient department, they may shift to the other department as needed to cover staffing needs. Nomercy has contracted you to build a new medical records system, which will include electronic health records for patients. They have gathered the following requirements for the new records system.

• Every patient has an electronic health record. This record contains a patient's basic medical facts (blood type, allergies, etc), immunization records, prescription records, and histories of visits and referrals.

• Doctors may attach notes (as separate files) to a patient's record.

• Patients can login to view their records online at any time.

• Doctors can view or edit health records from either work or home.

• If a patient is admitted as an inpatient, the staff attending to the patient gain view and update access to the patient's health record.

• Doctors can mark some notes or comments as sensitive, to be seen only by hospital personnel (not patients).

• Patients may add comments to a doctor's notes (such as adding explanation of an observed medical condition), but may not delete any of the doctor's remarks.

• A patient may designate other individuals (such as a spouse) to have access to their health record.

• Patients may request that their health records be sent to other medical establishments (for second opinions or alternative treatments).

• Access to medical records must comply with HIPAA and Massachusetts laws on medical data privacy. In particular
  • Patients may challenge any portion of the record they deem inaccurate
  • Mental health data need not be shared with insurance companies
  • Only a patient's doctor may view genetic data (such as DNA profiles) unless the patient gives explicit written permission

• While a patient is a member of a gym affiliated with Nomercy, the gym trainers may enter comments in the patient's record, including current weight, prescribed exercise plans, and fitness progress reports. The web interface to health records should contain a section of fitness recommendations as maintained by the gym.