PT Global Edutipa Informatika (Healthcare) · 2025
Designing a secure RBAC system for an Electronic Medical Records platform
How a flexible, middleware-driven role-based access control system enabled a multi-role healthcare application to keep sensitive patient data secure across all user types.
Problem
A healthcare web platform needed to serve multiple user types — doctors, nurses, admins, and patients — each with completely different views and permissions over the same underlying patient data. A naive implementation would either lock things down too tightly or expose sensitive records to the wrong roles.
Solution
Implemented a layered RBAC system using Laravel middleware and route groups. Each role gets a clearly defined set of permissions, enforced at both the route level and within service layer logic. UI components adapt dynamically based on the authenticated user's role, so sensitive fields simply don't render for unauthorized users.
Architecture
Built on Laravel MVC with a relational MySQL database. Roles and permissions are stored in dedicated database tables and loaded per-request through middleware. Service classes abstract business logic away from controllers, making permission checks consistent and testable. Views conditionally render based on the authenticated role resolved from the session.
Challenges
Permission model that grows without becoming a mess
Adding a new role or permission to a hard-coded permission check is error-prone. Solved by centralizing permission definitions in a single configuration layer, so new roles can be added without touching business logic.
Cross-team requirements with non-technical stakeholders
Healthcare staff needed to explain their workflows for requirements to make sense. Regular collaborative sessions with doctors and nurses revealed use cases that weren't in the initial spec — and prevented building the wrong thing.
Results
4+ distinct roles
User roles supported
Zero post-launch
Unauthorized data access incidents
Ongoing across internship → FTE
Feature development
Lessons Learned
- RBAC belongs in a dedicated layer — mixing permission checks into controllers creates inconsistency and makes audits painful.
- Non-technical stakeholders often have the best insight into where access control matters most. Involve them early.
- A healthcare platform is never really "done" — designing for extensibility from the start is not optional.