🏥 Healthcare Management System (2021)

Career Context: Built in 2021 as a Software Engineer. This project highlights a strong focus on backend security, RESTful API design, strict data compliance (simulating HIPAA regulations), and the powerful adoption of NoSQL databases for flexible, unstructured record storage.

📖 Executive Summary

The Healthcare Management System is a highly secure, high-performance RESTful API built on Node.js and Express. It serves as the backbone for clinic operations, seamlessly managing patient records, doctor scheduling, and appointment bookings. Due to the sensitive nature of medical data, the system is fortified with robust security middlewares, role-based access control (RBAC), and complex data aggregation pipelines for clinic analytics.

🏗️ System Architecture

graph LR
    Client[Frontend / Postman] -->|HTTPS| Express[Express.js Node Server]
    Express -->|Rate Limiter| Auth[JWT Authentication Middleware]
    Auth -->|Helmet & CORS Policies| Routes[Express Routers]
    Routes --> Controllers[Business Logic Controllers]
    Controllers -->|Mongoose Queries & Aggregations| DB[(MongoDB)]
    Controllers --> Cache[Node Server Cache]
    Cron[Node-Cron Background Jobs] --> Controllers
    Controllers -->|Action Logging| Audit[HIPAA Audit Middleware]

Loading

✨ Core Features & Functionality

• Role-Based Access Control (RBAC): Distinct authorization boundaries for ADMIN, DOCTOR, and PATIENT roles. A patient cannot view another patient's records, while a doctor can only view patients assigned to them.
• Mock HIPAA Audit Logging: A custom middleware that meticulously tracks and logs every single interaction with patient data, recording the user ID, timestamp, IP address, and the specific endpoint accessed.
• Complex MongoDB Aggregations: Utilizes advanced Mongoose aggregation pipelines ($match, $group, $lookup, $unwind) to generate intensive analytical reports (e.g., clinic revenue over time, doctor appointment loads) entirely on the database layer.
• Brute Force Protection: Integrated express-rate-limit to heavily restrict login endpoints, thwarting brute-force and dictionary attacks.
• Global Error Handling: A centralized Express error-handling middleware that catches all unhandled exceptions, formats them into a standardized JSON response, and prevents stack traces from leaking to the client in production.

🧠 Design Decisions & Trade-offs

MongoDB (NoSQL) vs. Relational SQL

Medical data is notoriously unstructured and highly variable. A cardiology report requires vastly different data fields than a dermatology report. Using a strict SQL schema would result in heavily fragmented tables or massive columns of null values. MongoDB was chosen to allow a flexible document schema where various patient forms and attachments could be natively embedded into a single JSON-like document.

Aggregations vs. Application Logic

When generating clinic analytics, calculating sums and averages using JavaScript arrays in Node.js would consume massive amounts of server RAM and block the single-threaded event loop. By offloading these calculations directly to the MongoDB engine via aggregation pipelines, the heavy lifting is done by the database, freeing the Node.js server to continue serving concurrent HTTP requests with minimal latency.

JSON Web Tokens (JWT) vs. Session Cookies

Given the modern landscape of decoupled mobile and web frontends communicating with a central API, JWTs were selected over stateful server sessions. JWTs allow the backend to remain completely stateless, making it infinitely easier to scale horizontally across multiple load-balanced servers.

📂 Project Structure

healthcare-management-system/
├── src/
│   ├── app.js               # Express application instantiation & middleware registration
│   ├── config/
│   │   └── db.js            # MongoDB connection logic and retry handlers
│   ├── controllers/         # Core business logic for handling requests
│   ├── middlewares/
│   │   ├── authMiddleware.js # JWT decoding and role checking
│   │   ├── errorHandler.js   # Global exception formatter
│   │   └── hipaaLogger.js    # Medical data access audit logger
│   ├── models/              # Mongoose database schemas
│   │   ├── User.js          # Authentication credentials
│   │   ├── Patient.js       # Patient medical records
│   │   └── Appointment.js   # Scheduling data
│   └── routes/              # Express API route definitions
└── package.json

🚀 Setup & Installation

Prerequisites

• Node.js (v16.x or higher)
• MongoDB (Local instance or MongoDB Atlas cluster)

Local Development

1. Clone the repository and navigate:

   git clone https://github.com/codebyanjani-design/healthcare-management-system.git
   cd healthcare-management-system

2. Install dependencies:

   npm install

3. Environment Configuration: Create a .env file in the root directory and define the following variables:

   PORT=5000
   MONGO_URI=mongodb://localhost:27017/healthcare_db
   JWT_SECRET=your_super_secret_key_here
   NODE_ENV=development

4. Start the server:

   npm start
   # The API will be listening on http://localhost:5000

🧪 Testing Strategy

• Unit Testing: Individual Mongoose schemas are tested for correct validation (e.g., ensuring passwords are automatically hashed before saving).
• Integration Testing: API endpoints are tested using supertest to ensure that unauthorized requests are properly rejected with 401 Unauthorized or 403 Forbidden status codes, and that valid data mutations correctly update the database.

⚙️ CI/CD Deployment Pipeline

The repository leverages a GitHub Actions pipeline (.github/workflows/ci.yml) to enforce code reliability. On every pull request to the main branch, the pipeline automatically installs dependencies and executes the test suite. This guarantees that new feature additions do not accidentally break critical healthcare data pathways or security rules.