Building an AI-first EMR where the doctor decides what the AI sees

What the client needed

Most electronic medical record systems are archives. A clinician opens a patient, then works through tabs, forms and prior encounters to reconstruct a history that may span years. The information is present. Retrieving it during a ten-minute consultation is the problem.

The brief was to build an EMR where clinical history could be interrogated conversationally — ask a question, get an answer grounded in that patient's actual record — without weakening access control, and without the AI layer becoming an uncontrolled route to patient data.

An EMR that can answer questions is only useful if you can also prove which records it was allowed to read.

The constraints that shaped the build

The design decision that mattered most

The obvious way to build a clinical AI assistant is to give it broad read access to the record and let it retrieve whatever it judges relevant. It demonstrates well. It is difficult to defend.

We inverted it. The assistant holds no standing access to patient data. A clinician opens the record, ticks the sections relevant to their question, attaches them, and only then asks. The model receives exactly that payload and nothing more.

This costs a few seconds per query. In exchange, three things become true: the clinician always knows what the model saw, the AI cannot exceed the permissions of the person operating it, and every request carries an explicit record of the data that left the system. For anyone evaluating this platform against a data protection standard, that last property is worth more than the seconds it costs.

How the team built it

GegoSoft engineers use Claude Code as standard daily tooling across all projects. On this build it carried the repetitive engineering load: service scaffolding, DTO and validation layers, test coverage, and the API client work between microservices.

What it did not do is decide anything. Architecture, the data-attachment consent model, clinical workflow design and every schema decision were made by the team. All generated code passed normal review before merge. We are specific about this because in healthcare the distinction matters: AI assistance changed how quickly the team wrote code, not who was accountable for it.

Where it stands

The platform runs in production and continues under active development. The same service architecture now underpins the hospital management, pharmacy and AI agent products in the LifeBridge range.

Common questions