Multi-tenant software has one unforgivable failure mode: tenant A seeing tenant B’s data. In healthcare, that’s not a bug report, it’s a breach. So we designed against it from the ground up.
Scoping is central, not per-query
Every tenant-scoped record carries its organisation, and that scope is enforced centrally, not left to each developer to remember a filter on every query. Relying on manual discipline is exactly how one hospital ends up seeing another’s patients; we don’t rely on it.
“Not found”, never “not allowed”
Ask for a record that belongs to another organisation and the answer is 404, not found, not 403. That’s deliberate: a 403 leaks that the record exists. Cross-tenant lookups reveal nothing at all.
Roles within a hospital
Inside a hospital, access is further narrowed by granular, per-hospital roles, so staff see only what their role allows. Separation between hospitals and separation within a hospital are handled as first-class concerns, because they are.