A Patient Supply Order Form That Holds Up to a Security Review
Clinical staff order device supplies for named patients. That makes an ordinary web form a patient-data system, subject to GDPR and an enterprise security review — which is where most such forms fail.
Global medical-device manufacturer · EMEA patient supply
healthcare!The Need
Ordering consumables for an implanted or worn medical device is not a shopping cart. Each line item is a catalogue part number tied to a specific therapy — the device itself, its reservoirs, its sensors — and each order names a patient, their date of birth, their training date and, when therapy ends, the reason it stopped. That payload is health data about an identified person, so it falls under GDPR in every EMEA market the form serves, and it has to pass the manufacturer’s own security review before it can go anywhere near production. The original build authenticated against the corporation’s enterprise identity platform, which made every environment promotion a ticket through an internal process measured in weeks.
The Approach
We modelled the order around catalogue part numbers rather than free text, so the three supply lines — device, reservoirs, sensors — each carry their own part number and quantity and cannot be mistyped into something that does not exist. Patient identity, date of birth, training date and end-of-therapy reason are validated at the schema level, with the stop reason offering a defined set plus a free-text fallback so real clinical situations are not forced into the wrong box. The form is multi-language, because EMEA is not one market. Each submission renders a PDF the clinician can check before anything is sent, plus a recap view, and the completed order is emailed rather than left sitting in a database for someone to notice. We then replaced the enterprise identity dependency with magic-link authentication: no password is created, stored or transmitted, and a corporate mail gateway that pre-fetches links — the scanner opening the email before the human does — was handled explicitly rather than discovered in production.
