Ten modules. One deployment. Gates, not editions.
A clinic group activating four modules and a hospital activating ten are running the same deployment with different feature gates. There is no clinic edition, no hospital edition, and no upgrade migration between them — a growing customer flips a gate.
Dashboard
A role-composed landing: what happened overnight, what is waiting on you, what is due — in that order. A work plan, not a wall of charts.
Exceptions across every module, in one aged list
A missing receipt, a clearinghouse reject, an unmatched deposit and a count variance are the same kind of problem to the person who has to clear them — so they live in one queue, aged, assigned, and with the assistant naming the common cause rather than restating the rows.
Every KPI carries its definition
Each tile states how the metric is computed and drills through to the underlying rows. A KPI nobody can trace is a rumour.
Finance & general ledger
Chart of accounts with real dimensions, journals with balance invariants enforced in the database, budgets, and a five-day close.
A ledger that cannot be edited
Append-only journal lines with balance invariants enforced in the database; balances are derived and materialised, never updated in place. Any historical position is reconstructable, which is exactly what a point-in-time audit query needs.
Money never touches a float
Integer minor units with explicit currency and scale, end to end. No floating point anywhere in a financial path — because a rounding artifact in a payment run is a customer incident and an audit finding.
The close as an orchestrated process
A checklist with owners, dependencies and a live progress state, not a shared spreadsheet. Accruals post themselves from dock receipts; reconciliations show who owns what and how old it is.
Payables & procure-to-pay
Three-way match with a stated tolerance policy, exception-only queues, deliberate payment runs, and discount capture that actually gets captured.
Exception-only, by design
A clean three-way match posts without a human. The AP clerk's day is the exceptions list, not a data-entry queue — which is what makes 89% straight-through a realistic target rather than a slide.
No duplicate payment via any path
Duplicate detection runs on the invoice, the payment run and the vendor bank record — not on one of the three. Vendor bank-detail changes are verified out of band before a payment can use them.
Revenue cycle
Eligibility → coding → scrub → claim → denial → cash. The spearhead module, and the one that closes the seam.
835 posting into the ledger, in one transaction
Cash, contractual allowance and denial reserve post against patient A/R together with the claim state update — atomically, reconciled to the penny. This is the row no other platform in the category holds natively.
The denial workspace
A queue organised by reason code, with recoverability scoring so a specialist works the claims worth working. Appeal drafting is AI-assisted and always marked as such — a human click is still outstanding on every one.
Underpayment detection against the contract
Payer contracts are modelled, so a payment that is technically 'paid' but below contracted rate surfaces as a variance rather than disappearing into cash.
Supply chain
Requisitions, POs at contract price, dock receiving with accrual, the item master, vendors and contract compliance.
Off-contract spend caught before the money leaves
Contract pricing is checked at requisition time, not discovered in a quarterly spend report. The buyer sees the on-contract alternative in the same screen where the off-contract line was raised.
The item master is treated as the hard part
Enrichment ships in phase one, not later — because an un-enriched item master makes par automation, contract compliance and recall genealogy all degrade quietly.
Inventory
Stock by location, par levels that replenish themselves, transfers, cycle counts, lot and expiry tracking, and recall response.
A recall answered in minutes, not days
Lot genealogy runs from the dock receipt through every transfer to the point of use, so 'which patients received product from this lot' is a query rather than a project. Target: a complete answer inside five minutes.
Inventory ties to the GL continuously
Movements cost and post as they happen. There is no month-end exercise to reconcile the stock ledger to the general ledger, because they were never separate.
HR & payroll
People, credentials with expiry escalation, and a pay rules engine built for 24/7 clinical staffing rather than retrofitted from an office payroll.
Credentials as tracked obligations
A licence with an expiry date is a scheduled escalation, not a field on a form. The escalation reaches the manager, then the department head, before the lapse — not after someone noticed on a chart audit.
The pay rules engine is the differentiator
Stacked differentials, on-call with callback minimums, charge and float premiums, union step tables, and a retroactive increase that re-derives all of the above. This is precisely where horizontal ERPs fail in healthcare.
Dual control on finalisation
A payroll run is finalised by HR and Finance together, with a variance diff against the prior cycle shown before either signs. One person cannot release pay alone.
Assets
Biomedical registry, preventive maintenance and calibration schedules, work orders, and depreciation booked straight to the GL.
Calibration state is a compliance flag, not a spreadsheet
An infusion pump out of calibration surfaces in the same exception queue as a missing receipt, because to the person accountable for it, it is the same class of problem.
Depreciation posts to the ledger
No monthly journal keyed from a fixed-asset system that lives somewhere else.
Reports & analytics
Governed metrics defined once, role dashboards, an ad-hoc builder over the semantic layer, and scheduled exports. Included in every tier.
The semantic layer is the point
Every metric is defined once and consumed by the dashboard, the report builder and the assistant alike. The assistant and the dashboard cannot disagree, because they are reading the same definition.
Cost per encounter, supply and labour together
The number that requires both halves of the platform — and the reason it does not exist in a product that owns only one of them.
AI assistant
The whole platform, conversationally — a module and a panel on every other screen. Ask, act, confirm, log.
Permission pass-through, not a second door
The assistant's tools are filtered by the caller's role before the model is invoked. It cannot see, say or do anything the signed-in user could not do themselves — and every attempt is in the action log either way.
Figures come from the semantic layer
The model never does arithmetic on retrieved rows. That is the decision that makes an AI answer usable in a board pack.
Purple means a model produced it
Every drafted appeal, proposed code and explained variance carries the purple mark, in every theme. A user must never be unsure whether a human or a model wrote what they are reading.
Admin
Users and roles, org structure, the visual approval canvas, integrations, the audit log and settings.
One approval engine, one canvas
Requisitions, journals, payroll, write-offs and access requests all route through the same engine — which is what makes dual control provable to an auditor in one place instead of six.
An action that cannot be logged does not happen
The audit log is append-only and hash-chained, and it covers the UI, the export, the API and the assistant identically.
Every module, switched on, seeded.
The demo hospital runs all ten with realistic synthetic data, and a role switcher so you can see the same screens as a CFO, then as a storekeeper.
Try the demo hospital