Find the work. Follow its owner.

What teams can do

• Secure sign-in kept separate from account, role and session administration
• People, roles, memberships and organisation units
• Multi-factor authentication, passkeys, trusted devices and password security
• Session validation, listing, revocation and lifecycle control
• Tenant-user, platform-staff and invitation administration
• Security events, login-risk analysis and governed overrides
• Linked-user requests with target-person approval

How work moves

1. 01An administrator creates or invites an account, assigns governed membership and follows the account through activation, suspension or closure.
2. 02A user enrols an approved assurance method, establishes a session and can review or revoke trusted-device and session state.
3. 03A linked-user request remains pending until the target user explicitly approves or rejects the relationship.

What teams can do

• Tenant creation, activation, suspension, closure and configuration governance
• Organisation profile and initial-owner administration
• Provisioning and closure-state coordination
• Connection ownership and configuration boundaries
• Purpose-limited internal tenant resolution and lookup
• Platform portfolio and tenant-administration summaries

How work moves

1. 01A platform operator records the organisation and initial owner, then follows provisioning to a terminal tenant state.
2. 02Lifecycle changes coordinate suspension or closure while preserving the owning service’s record of what was requested and completed.
3. 03Connected product areas receive only the organisation facts required for an approved purpose instead of reading the tenant’s full configuration.

What teams can do

• Permission, feature and capability catalogue aggregation
• User, role, platform, facility and resource-scoped assignments
• Effective-access evaluation and current-subject decisions
• Independent second-person approvals, conflict rules and grant history
• Access-review campaigns and governed permission delegation
• Constrained emergency patient access with expiry and review
• Tenant and facility entitlements with numeric limits
• Reviewed import, export, snapshots and bounded decision diagnostics

How work moves

1. 01Catalogues are aggregated, an administrator proposes a scoped assignment, and sensitive changes move through approval and conflict checks before they can become effective.
2. 02A protected action checks the person’s direct rules, role rules, inherited access, product availability and conflict constraints before allowing the work.
3. 03A constrained emergency request can temporarily enable only patient read or urgent-note creation, then expires into mandatory review evidence.

What teams can do

• Full and provisional patient registration
• Privacy-safe patient search, demographics and profile lifecycle
• Identifier definitions, attachment and verification evidence
• Duplicate detection, data-quality queues and case review
• Controlled merge, unmerge and identity reconstruction
• Independent review and approval for birth-fact and high-risk identity corrections
• Governed import, export, profile fields and registration artifacts
• Purpose-specific patient details for connected product areas

How work moves

1. 01Registration searches within tenant scope, selects an existing patient or creates a full or provisional record, then attaches governed identifiers and artifacts.
2. 02Data-quality work identifies a possible duplicate, opens a review case and records a controlled merge or rejection with reconstruction support.
3. 03High-risk demographic or birth-fact corrections move through independent review and approval rather than silently rewriting patient identity.

What teams can do

• Practitioner directory, identifiers, roles and specialties
• Qualifications and versioned credential definitions
• Credential evidence custody and content scanning
• Credentialing cases, review decisions and history
• Facility affiliations, coverage and authority
• Privilege definitions, grants, reviews and expiry
• Booking and template-authority decisions for Scheduling
• Provider catalogue governance and protected imports

How work moves

1. 01A practitioner record is established, identifiers and qualifications are attached, and credential evidence enters a reviewable credentialing case.
2. 02Reviewers record decisions and expiry, then grant facility-specific affiliations or clinical privileges with later renewal and review.
3. 03Scheduling asks Providers whether a practitioner has the authority required for a bookable service or template.

What teams can do

• Facilities, facility relationships and physical hierarchy
• Wards, rooms, beds and structural lookup
• Facility types, reference catalogues and governance profiles
• Clinical service offerings and delivery configuration
• Equipment, external partners and capability evidence
• Readiness snapshots, setup plans and reusable templates
• Facility schedules and owner decisions
• Protected evidence, content scanning and data imports

How work moves

1. 01An administrator establishes a facility and its relationships, then builds the physical structure from wards through rooms and beds.
2. 02Service offerings, equipment, partners and schedules are configured and assessed through readiness snapshots and setup plans.
3. 03Protected evidence and imports pass validation and scanning before becoming part of facility capability records.

What teams can do

• Bookable services and facility/provider authority requirements
• Schedules, exceptions, availability and durable slot holds
• Appointment requests, booking, rescheduling and cancellation
• Recurring series, group sessions and coordinated appointments
• Walk-ins, arrivals, waitlists, offers, queues and tokens
• Booking, queue and forecasting-policy governance
• Operational periods, incidents, timing offers and recovery plans
• Downtime reconciliation, reports and governed imports

How work moves

1. 01An administrator configures a bookable service, authority requirements, schedules and exceptions before availability can be offered.
2. 02An operator or approved channel holds a slot, commits or changes an appointment, then manages arrival, queue and completion state.
3. 03Waitlist offers, operational incidents and downtime work move through bounded timing, expiry and reconciliation paths.

What teams can do

• Encounter and episode lifecycle
• Allergies, diagnoses, problems and observations
• Clinical notes, prescriptions and medication-administration facts
• Clinical order intent and review context
• Care plans, tasks, handoffs and immunisation coordination
• Versioned clinical forms, responses and review governance
• Clinical documents, imports and data-quality correction
• Patient, practitioner and facility reference information

How work moves

1. 01A care team opens an encounter or episode and records clinical facts, notes, forms, tasks and care coordination under the responsible clinical owner.
2. 02Corrections and data-quality work retain the original context while producing an explicit reviewed clinical state.
3. 03Care Workspace users can inspect timeline, task and handoff information; this does not mean every displayed record can be changed there.

What teams can do

• Admission requests and admission decisions
• Inpatient stays and location history
• Bed holds, occupancy and overlapping-stay protection
• Transfer requests and completed movements
• Patient leave and return lifecycle
• Discharge planning and physical-discharge execution
• Census snapshots, rebuild and reconciliation
• Death reports, mortuary custody and governed imports

How work moves

1. 01An approved admission becomes a stay, bed occupancy is protected, transfers and leave are recorded, and discharge completes through explicit states.
2. 02Census snapshots are rebuilt or reconciled against stay and location truth rather than edited as an independent census ledger.
3. 03Death reporting and mortuary custody follow a distinct traceable path without moving clinical-cause ownership into Inpatient.

What teams can do

• Consent policy families, versions and assignments
• Source instruments and effective-consent decisions
• Patient authority and representative chains
• Advance directives and clinical preferences
• Signing ceremonies, finalisation and withdrawal
• Evidence and artifact custody
• Research protocols, consent and re-consent
• Governed imports, reconciliation and consumer drift

How work moves

1. 01A policy family is versioned, reviewed and assigned before an effective-consent decision can be evaluated for a patient and purpose.
2. 02A patient or authorised representative enters a signing ceremony, finalises or withdraws an instrument, and retains linked evidence.
3. 03Authority, advance directives, preferences and research re-consent are reconciled with consuming services and drift is surfaced.

What teams can do

• Data-rights request intake, queue and case lifecycle
• Request-category decisions and owner coordination
• Protected package publication and download
• Disclosure evidence and governed completion
• Privacy restrictions and legal holds
• Patient-subject reconciliation and exception recovery
• Purpose-specific scheduling and product-area details
• Operator work summaries and exception visibility

How work moves

1. 01A request enters intake, is categorised and reconciled to the correct subject before data-owning services receive bounded work.
2. 02Owners return allowed results, Privacy assembles a protected package, records disclosure and completes the case under review.
3. 03Restrictions, legal holds and failed subject reconciliation remain visible for recovery or enforcement rather than being silently bypassed.

What teams can do

• Patient financial accounts and scoped access
• Billable items, price books, charges and estimates
• Invoices, sequences, credit notes and statements
• Online checkout, verified payment-provider updates and reconciliation
• Cashier drawers, sessions, tenders and deposits
• Ledgers, balances, account credits and refunds
• Payment plans, collection cases and recovery work
• Write-off, refund approval and fiscal-document evidence

How work moves

1. 01A patient account receives priced charges, can produce an estimate, then issues sequenced invoices, statements or credit notes.
2. 02A cashier opens a drawer session, records tenders and deposits, and closes against account and ledger evidence.
3. 03Online payment, refund, write-off, plan and collection work move through provider reconciliation and required approvals.

What teams can do

• Seller and legal-entity setup
• Products, prices and published commercial catalogue
• Tenant billing accounts and profile governance
• Subscription lifecycle and recurring authorisations
• Checkout, payments, credits and refunds
• Invoices, credit notes and fiscal sequences
• Commercial documents, templates and artifacts
• Failed-payment recovery, verified payment-provider updates and reconciliation

How work moves

1. 01Platform finance publishes a product and price, establishes a tenant billing account and activates a governed subscription lifecycle.
2. 02Checkout and recurring payment events reconcile into invoices, credits, refunds and commercial account state.
3. 03Failed collection enters dunning and recovery while desired product-entitlement intent is coordinated separately from effective access.

What teams can do

• User inbox, chronology and read state
• Versioned templates, rendering and reusable content blocks
• Email, SMS, push and WhatsApp provider configuration
• Device registration and user preferences
• Scheduled delivery, provider receipts and delivery status
• Resend, replay and provider-feedback handling
• Presence and real-time notification signals
• Tenant policy, digest, rate-limit and provider diagnostics

How work moves

1. 01An originating service requests an allowed message, Notifications selects a versioned template and approved channel, then schedules or delivers it.
2. 02Delivery processing records provider acceptance, feedback and failures, safely tries failed sends again, and keeps inbox history and read state.
3. 03Administrators diagnose providers, replay bounded work and govern templates, preferences, digests and rate limits.

What teams can do

• Audit-event search, detail and entity-change history
• Action, property, exception and actor evidence
• Operational summaries and risk views
• Prepared exports and protected download evidence
• Legal holds and governed retention
• Tamper-evident seal verification
• Archive manifests and behind-the-scenes processing
• Restoration requests and interrupted-work recovery

How work moves

1. 01An authorised operator searches tenant-scoped events, follows entity changes and inspects actor, action, property and exception context.
2. 02A protected export is prepared, retrieved through bounded download evidence and retained under applicable hold or retention policy.
3. 03Archiving and restoration create inventories, verify seals and make interrupted work available for recovery.

What teams can do

• Terminology sources, scopes and licence agreements
• Package intake, scanning, import checkpoints and validation
• Code systems, concepts, designations and relationships
• Value sets, expansion and replacement chains
• Mappings, unit systems and conversions
• Catalogue and tenant-local terminology governance
• Review, publication, artifact and suspension lifecycle
• Consumer dependency, usage policy and drift reconciliation

How work moves

1. 01A terminology package enters intake, scanning, checkpointed import and validation before reviewers can publish an immutable version.
2. 02Administrators build value sets, mappings, units and catalogues, then publish or suspend them under usage and licence policy.
3. 03Care users perform read-only lookup while consumer dependencies and drift are reconciled by governance teams.

What teams can do

• Versioned report definitions, review and publication
• Bounded execution, runs, lineage and freshness evidence
• Protected artifacts, download, revocation and access history
• Saved typed views, schedules and delivery evidence
• Alerts, anomaly evaluation, annotations and approvals
• Measures, formula lifecycle and semantic policies
• Policy-constrained natural-language-to-typed-query preview
• Benchmarks, owner reconciliation and privacy or restore gates

How work moves

1. 01An author versions a report definition, completes review and publication, then runs it against approved reporting data.
2. 02Runs retain data origin and freshness, produce protected report files and can be scheduled, delivered, downloaded or revoked with access evidence.
3. 03A natural-language phrase can preview a report based on published measures for the preceding 30 days; users must confirm the preview, and confirmation does not run the report.
4. 04Alerts and data checks move through annotations and approvals while data freshness and privacy gates remain visible.

What teams can do

• Initial-owner onboarding can wait for completion or expiry and return a clear outcome to tenant administration
• Terminology-source onboarding can coordinate the approved handoff into terminology governance
• Consent-policy review can wait for the responsible review decision and return its outcome
• The responsible product area remains authoritative for every business record and decision
• Waiting, completion and interruption remain distinguishable during a long-running handoff
• Only the three named processes are part of the current product capability

How work moves

1. 01Initial-owner onboarding waits for the owning tenant process to complete or expire, then hands the outcome back without becoming the organisation record.
2. 02Terminology-source onboarding coordinates its approved handoff while Terminology keeps the source record, review state and publication decisions.
3. 03Consent-policy review coordinates the requested review while ConsentAuthority keeps the policy, evidence and final decision.

What teams can do

• Bring related security signals into one reviewed case without treating every alert as an incident
• Declare and classify an incident with accountable ownership and reviewed severity
• Coordinate owner-executed containment while preserving investigation evidence
• Assess possible personal-data involvement and notification duties against approved policy
• Keep an affected tenant informed through bounded status and acknowledgement
• Complete post-incident review, tracked remediation and readiness drills

How work moves

1. 01Related signals would be reviewed and correlated before an authorised person or approved rule could declare an incident; a signal alone would never become a case automatically by implication.
2. 02A declared case would move through classification, reviewed severity, evidence preservation and owner-executed containment without writing directly into another product area.
3. 03Possible personal-data involvement would open a qualified notification assessment whose decision and basis stay reviewable; it would not be recorded as a lawful disclosure.
4. 04An affected tenant could receive approved information and acknowledge it before the case proceeds to review, remediation and closure.

What teams can do

• Practitioner-registry registration and verification
• Facility-registry registration and verification
• Patient identity verification and governed linkage
• Consent-artifact and clinical-bundle exchange
• Claims-transport coordination with the future Insurance owner
• Specification, sandbox and certification-evidence management

How work moves

1. 01Intended registry onboarding would submit practitioner or facility facts, retain external responses and reconcile verification state with the source owner.
2. 02Intended patient exchange would verify identity and authority, assemble a consent-bounded clinical package and record the remote outcome.
3. 03Claims transport would be coordinated with the future Insurance boundary rather than making interoperability the payer-adjudication owner.

What teams can do

• Payer, policy and coverage administration
• Eligibility checks and response evidence
• Cashless pre-authorisation lifecycle
• Claim preparation, submission and status
• Queries, denials, appeals and supporting evidence
• Settlement reconciliation to PatientBilling
• Evidence-selected national gateway, direct payer connections or both

How work moves

1. 01The intended flow would establish coverage, request eligibility and pre-authorisation, then prepare and submit a claim with supporting evidence.
2. 02Queries, additional evidence, denial and appeal would remain explicit payer-case states before settlement is reconciled to patient finance.
3. 03The connection approach would be selected from evidence for a national gateway, direct payer connections or both; no approach has been chosen.

What teams can do

• Licence and renewal register with expiry visibility
• Inspection, finding and response evidence
• Statutory filing calendar and accountable owners
• Organisational incident-to-root-cause-to-corrective-action lifecycle
• Quality indicators derived from owner events
• Evidence packs for accreditation support

How work moves

1. 01The intended licence and filing flow would assign an owner, track due and renewal state, attach reviewed evidence and surface unresolved expiry risk.
2. 02An organisational quality/compliance incident or inspection finding would move through response, root-cause review, corrective action, verification and closure.
3. 03Quality indicators would be calculated from approved product events and reporting data rather than entered as unsupported claims.

What teams can do

• Tenant-published hospital, service and practitioner discovery
• Explainable search and freshness-labelled public facts
• Signed tenant, facility and service booking handoff
• Approved contact check for guest booking
• Secure manage-booking recovery
• Direct-book, request and waitlist commitment clarity
• Anti-enumeration, rate limiting and abuse review
• Channel-safe Scheduling and Notifications integration

How work moves

1. 01A hospital would publish selected facility, service and practitioner facts; Public Discovery would index them with source and freshness labels.
2. 02A visitor would cross a signed tenant/facility/service handoff into Public Booking, complete approved assurance and request a Scheduling commitment.
3. 03Manage-booking recovery, waitlist or request state and abuse review would remain within the public-channel boundary without exposing staff-only systems.

What teams can do

• Order intake and accessioning
• Specimen collection, custody and rejection
• Worklists, disciplines and analyser handoff
• Quality-control and method evidence
• Result review, verification and correction
• Critical-value escalation
• Referral-laboratory handoff and result return

How work moves

1. 01Intended scope follows a specimen from accepted request through collection, custody, processing, review and verified result.
2. 02Referral work would preserve outbound custody and returned-result reconciliation rather than treating an external report as local execution.

What teams can do

• Formulary and medication catalogue
• Prescription intake and pharmacist review
• Clarification and intervention workflow
• Dispensing, returns and cancellation
• Inpatient and outpatient pharmacy operations
• Controlled-medicine evidence
• Pharmacy stock and batch linkage

How work moves

1. 01Intended scope moves a prescription through pharmacist review, clarification, dispensing, return or cancellation.
2. 02Medication supply would link to batch and stock evidence while remaining separate from prescribing and administration facts.

What teams can do

• Imaging-request acceptance and protocol workflow
• Modality worklists and acquisition status
• Contrast and safety checks
• Study, series and imaging-reference management
• Structured reporting, review and verification
• Critical-finding escalation
• Imaging archives and equipment boundary

How work moves

1. 01Intended scope moves an accepted imaging request through protocol, safety, worklist, acquisition and verified report.
2. 02Critical findings and corrected reports would use explicit escalation and versioned acknowledgement.

What teams can do

• Item, store and stock-ledger ownership
• Batch, serial, expiry and recall traceability
• Purchase request and purchase-order lifecycle
• Vendor, goods receipt and quality hold
• Issue, transfer, return and consumption evidence
• Cycle counts, adjustment and reconciliation
• Implant and clinical-consumable linkage

How work moves

1. 01Intended procurement scope moves a request through purchase order, vendor receipt, quality hold and available stock.
2. 02Intended stock scope records issue, transfer, return, consumption, count, adjustment and recall with batch or serial traceability.

What teams can do

• Remote-appointment eligibility and policy
• Video-session provisioning and secure join
• Session lifecycle and participant evidence
• Identity and representative checks
• Teleconsult encounter handoff
• Communication and failure recovery
• Prescription-policy constraints

How work moves

1. 01Intended scope checks remote-care eligibility, provisions a bounded session and records secure participant join and session outcome.
2. 02Failure recovery and clinical handoff would preserve appointment and encounter ownership rather than placing them with the video provider.

What teams can do

• Patient account and representative access
• Appointment viewing and management
• Billing, payment and receipt access
• Protected report and document download
• Prescription and care-instruction visibility
• Communication preferences and notifications
• Privacy-aware family and delegation controls

How work moves

1. 01Intended scope would assure a patient or representative, resolve a purpose-limited relationship and present bounded owner data.
2. 02Appointment, payment, report and communication actions would call their source owners and display confirmed outcomes.

What teams can do

• Rapid and provisional registration
• Triage category, reassessment and deterioration tracking
• Emergency encounter and care-team coordination
• Trauma and resuscitation documentation
• Observation and critical-care transition
• Constrained emergency-access acknowledgement
• Admission, discharge and transfer handoff

How work moves

1. 01Intended scope would move a rapid or provisional registration through triage, reassessment, emergency care and explicit disposition.
2. 02Admission, discharge, transfer or critical-care transition would hand state to existing owners rather than creating another inpatient stay record.

What teams can do

• Procedure request and surgical decision
• Pre-operative assessment and readiness
• Theatre list, room and team coordination
• Safety checklist and pause-state handling
• Anaesthesia and intra-operative record
• Specimen and implant traceability
• Recovery, post-operative orders and disposition

How work moves

1. 01Intended scope would move a procedure request through decision, readiness, theatre coordination, safety pause, operation and recovery.
2. 02Specimen, implant, post-operative order and disposition handoffs would retain their clinical, diagnostic, stock and inpatient owners.