Healthcare Administration Platform
A role-based hospital management system for managing patients, appointments, doctors, billing, and administrative operations with secure authentication and REST APIs.
This project came from wanting to build something with real-world complexity in how different types of users interact with the same system. A hospital is a good example of that — an admin, a doctor, a receptionist, and a patient all need to use the same platform, but each of them should see and do completely different things. That single constraint ended up shaping almost every design decision I made.
I split the system into four roles — Admin, Doctor, Receptionist, and Patient — each with its own set of permissions enforced through Spring Security and JWT. A patient can't accidentally hit a doctor's endpoint, and a receptionist doesn't get access to things only an admin should touch. Getting this right meant thinking carefully about authorization at the route level, not just checking whether a user is logged in.
The core workflow to get right. Doctors can view and manage their schedules and set their availability, while patients can book a slot, check their appointment history, or cancel if plans change. It sounds simple, but keeping availability accurate in real time, so two patients can't double-book the same slot, took a bit more care than I expected going in.
Holds medical history, prescriptions, diagnoses, and reports, kept structured enough that a doctor can pull up a patient's history quickly without digging through unrelated data.
Rounds it out — generating bills, tracking payment status, recording treatment charges, and keeping invoices tied back to the right patient and appointment.
Every sensitive route sits behind JWT authentication and role-based authorization, and passwords are encrypted rather than stored as-is. It's a fairly standard security setup, but I made a point of applying it consistently across every module instead of treating security as an afterthought bolted on at the end.
MySQL stores patients, doctors, appointments, prescriptions, bills, and users, with the relationships between them mapped out through Hibernate and JPA — a patient has appointments, an appointment ties to a doctor and a bill, and so on. Getting these relationships modeled cleanly made almost everything downstream, queries, validation, the API responses, noticeably easier to reason about.
This was the project where role-based access control really clicked for me, along with a much deeper understanding of Hibernate entity relationships and REST API design. I also pushed myself to write proper unit tests with JUnit and Mockito instead of just testing things manually, which turned out to be one of the more useful habits I picked up from the whole build.