Healthcare CRM for patient relationships, appointments, and coordinated follow-ups

Project overview

The client — a healthcare organization we refer to here only as a confidential multi-location group — operates outpatient clinics, diagnostic collection points, and a central patient coordination desk. Clinical teams document encounters in a licensed EMR that the organization does not intend to replace. What was missing was a relationship layer: when a patient calls about lab results, when front desk staff reschedule a specialist visit, when billing needs context on a promised payment plan, or when marketing asks whether a contact opted into SMS reminders. Those workflows lived in notebooks, shared inboxes, and informal WhatsApp groups.

Leadership engaged Web6 from Surat to build a healthcare CRM scoped to coordination, not clinical charting. We were clear in the first workshop: this system would not store diagnoses, prescribe medications, or substitute for regulated medical records. It would manage patient identity at the CRM level, appointment intent and status, follow-up tasks, communication consent, internal notes visible by role, and structured handoffs to the billing team. Clinicians would see only what they need for continuity — upcoming visits, assigned follow-ups, and patient-requested callbacks — without duplicating the EMR chart.

The eighteen-week engagement ran from discovery through phased rollout across three pilot clinics and the central desk. A team of six — product lead, two Laravel engineers, one React engineer, QA, and DevOps support — delivered the core platform on Laravel and React with PostgreSQL, Redis for queues and session acceleration, Docker for reproducible environments, AWS for application hosting and backups, and Cloudflare for WAF, TLS termination, and rate limiting at the edge.

Outcomes were measured in operational reliability, not fabricated revenue claims. Missed follow-up callbacks dropped because tasks had owners and due dates. Front desk staff resolved routine inquiries faster with a single patient timeline instead of searching three tools. Billing rework from incomplete handoffs fell because every escalation carried structured fields the finance team had asked for in discovery. The managing director described the CRM as "the glue between our EMR and the patient experience we want to deliver."

Engagements like this are delivered through Web6 custom healthcare CRM .

Business and operational challenges

Patient inquiries arrived through multiple channels — phone, walk-in, website form, and occasional referrals from partner physicians — but no single queue showed ownership. A front desk agent might promise a callback while a colleague, unaware, told the same patient something different on WhatsApp. Without a shared timeline, supervisors learned about problems only when complaints escalated. The organization needed a CRM that respected healthcare sensitivity while still being fast enough for busy reception counters.

Role boundaries were non-negotiable. Front desk staff should schedule and log communications but must not see clinical notes reserved for treating physicians. Clinicians needed follow-up context without wading through billing disputes. Administrators required aggregate reporting and user management without accessing individual clinical free-text unless policy allowed. The prior attempt to stretch a generic CRM failed because its permission model treated "manager" as god-mode — unacceptable for patient trust and internal policy.

Consent and communication preferences were scattered. Some patients opted into SMS appointment reminders on paper forms; others revoked marketing calls verbally; a few had guardian-mediated consent for pediatric accounts. Marketing and front desk teams could not reliably answer "can we text this number?" Auditors asked for proof of who changed a consent flag and when. Spreadsheet trackers were error-prone and offered no immutable history.

Billing handoffs were the silent productivity drain. When front desk negotiated a payment plan or flagged insurance pre-authorization pending, finance staff often received incomplete context in email threads. Disputes reopened because the CRM-of-sorts did not link the patient record to ticket numbers, promised amounts, or the staff member who made the commitment. Leadership wanted structured escalation objects — not free-form email alone.

• ✓ Fragmented inquiry handling across phone, walk-in, and web
• ✓ Strict role separation: front desk, clinicians, admin
• ✓ Consent tracking with audit history
• ✓ Structured billing handoffs with accountable owners
• ✓ Multi-location visibility without EMR replacement
• ✓ Access logging for accountability and review

Goals and success criteria

Product goals centered on a unified patient CRM profile: demographics and contact paths the organization owns, appointment requests and confirmations, follow-up tasks with due dates and assignees, consent records per channel, internal notes tagged by visibility role, and billing escalation tickets with required fields. Front desk users needed a dashboard that answered "who called today, what is overdue, and what is waiting on billing?" Clinicians needed a filtered view of their panel's follow-ups without administrative noise.

Security and compliance-aligned goals — framed as organizational policy rather than marketing certification claims — included comprehensive access logs (who viewed which patient record, when, from which location), consent change history, session timeout on shared devices, and export controls for admin reports. We documented data retention rules with the client's legal counsel; Web6 implemented configurable retention windows and soft-delete patterns for CRM objects while keeping audit rows append-only.

Integration goals were deliberately modest. Phase one synchronized patient identifiers and basic demographics from the EMR on a nightly batch where API access existed; phase two added a lightweight webhook for new registration events at two pilot clinics. Billing continued in the organization's existing finance system; the CRM produced structured handoff payloads and status tracking, not invoices.

Success criteria excluded revenue promises. Stakeholders wanted measurable reductions in missed follow-ups, faster median time to resolve routine front desk inquiries, fewer billing disputes caused by missing context, and user adoption above eighty-five percent at pilot sites within sixty days. Training completion and weekly active users by role would gate expansion to remaining locations.

Discovery and research

Discovery began with three days on site across two clinics and the central desk. Web6 shadowed front desk shifts — not to capture patient data, but to map workflow timing: how long a typical rescheduling call took, how staff searched for prior interactions, where they switched to paper. We interviewed two senior clinicians, the billing supervisor, and an administrator responsible for staff accounts. Everyone agreed the EMR was the wrong tool for relationship coordination; the disagreement was how much clinicians should see without opening the EMR itself.

We ran a role-mapping workshop producing four primary personas: Front Desk Agent, Clinician, Billing Coordinator, and System Administrator. For each persona we listed allowed actions, forbidden actions, and example screens. Clinicians could create clinical-visibility follow-up tasks but could not edit marketing consent. Billing coordinators could read handoff tickets linked to patients they served but could not browse unrelated patient marketing preferences. Administrators managed users and locations but accessed patient detail only through audited break-glass flows defined with the client.

Technical discovery covered existing infrastructure: on-premise EMR vendor constraints, acceptable cloud regions, backup expectations, and clinic network profiles. We reviewed a sample anonymized export to understand identifier formats and which fields could sync without crossing into clinical document territory. Parallel spikes validated Laravel Sanctum token patterns for React SPA auth, Redis-backed job queues for SMS reminder dispatch, and PostgreSQL row-level scoping by clinic location.

Competitive review included horizontal CRMs and healthcare-specific suites. Horizontal tools failed the role model; heavyweight suites tried to replace the EMR. The client chose custom development with Web6 because the workflow was specific to their clinic mix and because they wanted ownership of consent and audit logic rather than adapting to a US-centric product roadmap.

System architecture

The platform follows a modular monolith pattern — Laravel 11 API and domain services behind a React single-page application — deployed as Docker containers on AWS ECS with managed RDS PostgreSQL and ElastiCache Redis. Cloudflare sits in front for DNS, WAF rules, bot management, and DDoS protection. This shape kept operational complexity manageable for a six-person delivery team while allowing clear module boundaries inside the codebase: Patients, Appointments, FollowUps, Consent, BillingHandoffs, AccessLogs, and Admin.

Authentication uses Laravel Sanctum with SPA cookie-based sessions for staff browsers and optional token rotation for future mobile clients. Every API request passes through middleware that resolves the authenticated user, their role, assigned clinic locations, and effective permission set computed from role plus location scope. Patient list endpoints never return unscoped results — a front desk user at Clinic A cannot query Clinic B patients unless explicitly granted multi-site access.

The data model treats Patient as the CRM anchor entity with external EMR identifier stored as an opaque foreign key. Appointments link to patients with status machines (requested, confirmed, completed, cancelled, no-show) and assignee fields for staff ownership. FollowUp tasks carry priority, due_at, visibility enum (front_desk, clinical, billing, admin), and completion metadata. Consent records are versioned: each change appends a row with channel (SMS, voice, email, WhatsApp), granted boolean, source (form, verbal logged, import), and actor user id.

Access logging is synchronous on read for patient detail views and asynchronous batched for list screens where volume is high. Each log entry stores user id, patient id, action (view, export, update, consent_change), IP address, user agent hash, and clinic context. Administrators query logs through filtered reports; logs are append-only with database triggers rejecting updates or deletes — retention jobs archive cold partitions rather than erasing history silently.

• ✓ Laravel modular monolith + React SPA
• ✓ PostgreSQL with clinic-scoped queries
• ✓ Redis queues for reminders and sync jobs
• ✓ Append-only access and consent audit trails
• ✓ AWS ECS + RDS; Cloudflare edge protection
• ✓ EMR identifier sync — not chart replacement

User experience by role

Front desk UX optimizes for speed and clarity on shared workstations. The home screen shows today\'s appointment queue, unread patient callbacks, and overdue follow-ups color-coded by age. Patient search accepts phone number, name fragment, or EMR id; results open a timeline unifying calls logged, appointments, consent status, and open billing tickets. Creating an appointment uses a guided form with required reason for visit category — not clinical diagnosis — and optional clinician preference. Session timeout prompts appear after configurable idle minutes with a clear re-auth modal so the next staff member cannot continue as the previous user.

Clinician UX is deliberately calm. The default route lists follow-ups assigned to the logged-in provider with filters for today and overdue. Patient detail for clinicians hides marketing campaign notes and billing negotiation text unless flagged as clinically relevant by an administrator policy. Completing a follow-up captures outcome enum ( reached, left message, reschedule needed, referred to ER ) and optional short note stored with clinical visibility. Clinicians cannot bulk-export patient lists or edit consent — reducing accidental policy violations during busy rounds.

Billing coordinator screens center on handoff tickets: queue views sorted by SLA age, required fields highlighted before submit, and patient context sidebar showing front desk promises extracted from structured fields rather than scraping free text. Status transitions ( open, awaiting documentation, resolved, disputed ) trigger notifications back to creators when information is missing.

Administrator UX covers user provisioning, location management, role assignment, report exports, and read-only access log search. Break-glass patient access, when enabled, requires reason entry and generates high-visibility audit events reviewed weekly by the client\'s privacy officer.

Delivery process

Weeks 1–3 focused on discovery, role matrix sign-off, data model, and design prototypes tested with three front desk agents. Weeks 4–7 built core patient profiles, appointment flows, and access logging. Weeks 8–11 added follow-up tasks, consent versioning, billing handoffs, and EMR identifier sync. Weeks 12–14 implemented admin reporting, SMS reminders, and hardening. Weeks 15–16 pilot at two clinics with daily feedback. Weeks 17–18 expanded to a third location and central desk; training materials and runbooks delivered.

Fortnightly demos included role-switching live walkthroughs — the same patient record viewed as front desk versus clinician to prove separation. UAT sign-off required billing and privacy stakeholders to execute scripted scenarios including consent revocation and access log review. Go-live used a feature flag per clinic so rollback did not require database restores.

Privacy officer joined sprint ten review specifically for break-glass access and export watermarking — two requirements that would have been expensive retrofit if deferred. Clinician training emphasized " coordination notes are not clinical charts " to prevent scope creep into EMR territory; nursing staff who tried to paste diagnosis text received gentle policy reminders and UI validation on note categories.

Public website and intake alignment

While the CRM was the core deliverable, Web6 coordinated with the client's marketing site so web form submissions created patient inquiry records with source attribution. Structured fields on the public contact and appointment request forms mapped to CRM entities, reducing re-keying at front desk. Canonical patient-facing URLs remained on the organization's existing domain; the CRM lived on a staff subdomain behind Cloudflare access policies.

We advised on privacy copy for web forms — clarifying what data the CRM stores versus what flows to the EMR — without providing legal advice. Form spam protection used Cloudflare Turnstile and rate limits at the API ingress.

Public appointment request forms use minimal field sets — name, phone, preferred location, visit category — mapped to CRM entities without collecting clinical history that belongs in EMR intake. Marketing team received a one-page data flow diagram for compliance binder: web form to CRM to staff queue, not to EMR auto-write.

Performance and reliability

Patient search targets sub-300ms p95 on warm indexes for phone and EMR id lookups across fifty thousand CRM profiles. PostgreSQL indexes cover location_id plus normalized phone hash; explain plans reviewed during load testing. List screens paginate at twenty-five rows with cursor pagination to avoid offset drift on large datasets.

Redis caches permission sets per user for five minutes, invalidated on role change. Queue workers scale horizontally during morning appointment reminder bursts — typically seven to nine AM local time. ECS auto-scaling policies added capacity when queue depth exceeded thresholds for fifteen minutes.

Clinic networks with intermittent latency benefited from optimistic UI on appointment saves with server reconciliation — front desk staff see immediate feedback while background jobs confirm SMS dispatch. Offline-first was out of scope; instead we kept forms resilient to brief disconnects with retry toasts.

Morning reminder bursts seven to nine AM IST required queue worker auto-scaling — ElastiCache setup handled peak without SMS duplicate sends thanks to idempotency keys on reminder jobs. DevOps dashboard shows failed SMS count and consent-suppressed count separately so ops distinguishes provider failure from policy correct behavior.

Security, privacy, and role separation

Security design assumed healthcare-adjacent sensitivity even though Web6 did not claim formal certification on the client\'s behalf. Transport encryption end-to-end via TLS 1.3 at Cloudflare and within AWS VPC. Database encryption at rest on RDS; application secrets in AWS Secrets Manager rotated on schedule. Staff passwords enforced with length and breach list checks; optional MFA for administrators enforced at go-live.

Role separation is enforced server-side. React merely hides buttons; every mutating API endpoint re-validates policy classes mapping roles to abilities. Clinicians attempting consent edits receive 403 responses logged as policy violations for review. Patient detail serializers emit field subsets per role — billing notes never serialize to clinician responses.

Access logs provide accountability when patients ask who viewed their information. Break-glass access requires mandatory reason text and emails privacy officer distribution list. Export actions watermark PDFs with generator username and timestamp.

Backup strategy: RDS automated snapshots daily, cross-region copy weekly, restore drill documented in runbook. Disaster recovery RTO agreed at four hours for CRM availability — acceptable because EMR remained separate for clinical continuity during outage.

• ✓ Server-enforced RBAC — not UI-only hiding
• ✓ Append-only consent and access audit trails
• ✓ Encrypted transport and at-rest database
• ✓ Break-glass access with mandatory reason
• ✓ Session timeout for shared front desk devices
• ✓ Explicit non-EMR boundary documented

Testing and quality assurance

Automated tests covered permission matrices exhaustively — PHPUnit data providers attempted forbidden actions per role and expected 403. Consent versioning tests verified append-only behavior and marketing filter correctness. Access log tests asserted view events on patient detail routes.

Manual UAT spanned fifty scenarios across roles: front desk reschedule with consent check, clinician follow-up completion, billing ticket dispute loop, administrator log export. Pilot clinics ran parallel operation one week — CRM alongside legacy notebook — before cutover. Defects from pilot prioritized by patient impact; P0 fixes same-day for data scoping issues.

Load testing simulated morning login spikes and reminder job batches without queue collapse. SMS provider sandbox validated template rendering before production send.

Measured outcomes

Sixty days after full pilot cutover, missed follow-up callbacks — defined as tasks overdue more than forty-eight hours without outcome logged — fell sixty-two percent compared to the pre-CRM baseline the client tracked in spreadsheets. Supervisors attributed the drop to assigned ownership and morning digest emails rather than heroic individual memory.

Median time to resolve routine front desk inquiries ( appointment status, reschedule, lab report pickup coordination ) improved forty-one percent measured from call start timestamp to resolution logged in CRM. Agents cited patient timeline search as the largest time saver versus checking WhatsApp and paper simultaneously.

Billing dispute rework attributed to incomplete front desk handoffs dropped fifty-five percent in finance\'s categorization — not zero, because insurance complexity remains, but fewer " nobody told us about the payment plan " loops. Structured tickets forced minimum fields before submission.

Adoption exceeded targets: eighty-nine percent weekly active front desk users across pilot locations within sixty days; clinician follow-up completion logged in CRM reached seventy-six percent of assigned tasks — up from untracked informal callbacks previously.

Lessons learned

Scoping the CRM as complementary to the EMR — not a replacement — kept stakeholders aligned and prevented feature creep into regulated clinical territory. Early written boundary statements saved weeks of debate mid-sprint.

Role separation must be enforced in API serializers and policies, not just hidden in React. One late-discovered serializer leak taught us to auto-generate contract tests from the role matrix workshop output.

Consent versioning with append-only history earned trust from privacy reviewers faster than editable checkbox fields ever would. Staff initially grumbled about extra clicks; audits became trivial.

Billing handoffs succeeded because finance co-designed required fields — CRM did not impose a workflow they rejected. Structured tickets beat beautifully designed free-text notes.

“We did not need another EMR — we needed our teams to stop losing patients in the gaps between phone calls, spreadsheets, and billing emails. Web6 built a CRM our front desk actually uses every morning. When a patient asks who accessed their record, we can answer with facts, not guesses. That alone changed how seriously we take coordination.”

Suggested project visuals

• Role-separated healthcare CRM: front desk, clinician, billing, and admin paths with append-only audit logs.

  File: healthcare-crm-role-architecture-diagram.webp

  ALT: Architecture diagram of healthcare CRM with Laravel, React, PostgreSQL, and role-separated access

• Front desk home screen unifies today's appointments, callbacks, and overdue follow-ups per clinic.

  File: healthcare-crm-front-desk-dashboard.webp

  ALT: Front desk dashboard showing appointment queue and patient timeline in healthcare CRM

• Versioned consent records show who changed SMS, email, or voice permissions and when.

  File: healthcare-crm-consent-audit-history.webp

  ALT: Consent preference history with timestamps and actor in medical CRM software

• Structured billing escalations replace ad hoc email threads with required context fields.

  File: healthcare-crm-billing-handoff-queue.webp

  ALT: Billing handoff ticket queue linked to patient CRM profile