For multi-facility operators
Each context independent. Every boundary explicit.
Independent operating context
Separate tenancy, access and data boundary
Independent operating context
No visibility by proximity
Written relationship only
No group layer by implication
The multi-facility question
Connection cannot mean assumed visibility
Multiple facilities can use a consistent architecture while retaining independently defined tenancy, access and data boundaries. This site does not assume a relationship between those contexts.
Organisational proximity does not create access. Tenant-owned information remains in its tenant context. HMS does not assume that one facility rule applies to every kind of information; the responsible operating boundary decides when facility scope is required.
Boundary charter
Consistency without assumed visibility.
A common operating standard can make boundaries easier to understand. It does not merge the contexts, establish access between them or create a group-wide operating surface.
Independent boundary 01
Each context stands on its own
Facility structure, affiliations and records stay with the context that owns them.
Independent boundary 02
Tenant isolation sits below the screen
Tenant-owned data stays tenant-scoped. A facility boundary applies only where the responsible part of the operating model requires it.
Independent boundary 03
Identity and access are not shared by implication
Any identity or access relationship between contexts needs separate design and written scope.
Independent boundary 04
No hidden group-level promise
No shared clinical record, consolidated reporting, network-wide view or group console is represented.
For technical reviewers · ownership and boundary proof
How the multi-facility model is drawn
The safe model resolves tenant context for tenant-owned data and applies facility scope only where the owning model, query or policy requires it. Organisational proximity does not create access.
Each context stands on its own
Facility structure, affiliations and records remain within the owning context. No parent tenant or group hierarchy is implied.
Tenant isolation sits below the screen
Shared EF infrastructure filters tenant-owned rows by tenant. Facility scope remains specific to the owning model, query or policy.
Identity and access are not shared by implication
Any relationship between independently scoped contexts requires separate design and written scope; this page does not represent a shared identity or cross-tenant grant model.
No hidden group-level promise
The model does not represent a shared clinical record, consolidated reporting, a network-wide view or a group console.
Keep scope explicit
A conversation can compare operating contexts without treating them as one tenant.
Review each facility boundary on its own terms.
We will use your context questions, then state plainly what the demonstration and written engagement scope can cover. No cross-context relationship is assumed.