Four design decisions, and what each one costs.
Every architectural choice has a price. These are ours, and the price we pay for each.
Four design decisions, and what each one costs us
One record, resolved not merged
We match identity across organisations. Nobody’s record is copied or renumbered because their organisation changed. What it costs us: keeping those matches right is permanent engineering work, not a one-off move.
Configuration, not code
How the platform behaves in each country is read from a dated, controlled record. What it costs us: a country can’t go live until a named person has signed off its required settings, which is slower than shipping a default.
Fail safe, never borrow
An unconfigured value resolves to nothing not to a neighbour’s. The cost: more visible gaps. The alternative is a silent wrong answer.
State the ceiling in the product
Where a capability has a limit, the API and the interface say so. The cost: our own marketing is harder to write. The benefit is that it survives technical due diligence.
Three ontologies: what a thing means, how it moves, and how the system adapts
commvita isn’t an openEHR system with screens on top. A health system needs three kinds of knowledge held together: what things mean, how they move, and what to do about it. Describing a platform in those three layers is common well beyond health and we don’t claim it as ours. What’s ours is where the layers sit: on the operational record, on your estate. Open a layer to see what sits in it, and read the architecture explainer for what is built and what isn’t.
1 Semantic — meaning
Before anything else the platform has to agree what a person, an organisation and a condition mean. commvita uses published models instead of inventing its own: the NHS canonical data model, pinned and checked against its publisher; FHIR R4 at the interfaces; SNOMED CT and dm+d for what was recorded; OMOP for research; and openEHR as the clinical record shape we’ve committed to and haven’t yet shipped, with no archetypes and no query language today, which the platform’s own status screen says. Jurisdictional variance is modelled too — the regulator, the identifier scheme, the professional register, the legal deadlines — as dated, source-cited entries with a named signatory.
What it costs us: we can’t take a shortcut when a standard is awkward. A field that doesn’t map stays unmapped and visible.
2 Kinetic — flow and movement
This layer is about movement: a person from home to ward and back, work through a team, data between organisations. Flow is modelled the way a production line is, with the constraint, the work in progress and the failure demand visible, and it sits on the same platform as the clinical record. Movement of data is the other half. A model that isn’t wired to real data is a diagram. Admissions, transfers and discharges land on an append-only, hash-chained event spine, and relationships are derived from those events, never typed. A connector register records the feeds, a person is resolved once, and an ambiguous match is refused, and the GP record is requested from the practice’s own system. The translation of an inbound feed into the canonical shape is the part not yet built. Where a record holds a reference and nobody can be matched to it, the screen says so instead of showing the key.
What it costs us: decision 01 above — keeping those matches right never stops being work.
3 Dynamic — adaptation and optimisation
This is what the system does about what the other two layers tell it. A rule changed once applies everywhere the first layer says that concept appears. Escalation follows the signal and stands down when it abates, instead of on a calendar date. Access and waiting are managed on need and deprivation. Access control is two separate things: what your role lets you do, and which organisations you can reach. A group grants reach only, never a role. Enforcement sits on the server, so a clinician outside the organisation a person is registered with gets a refusal with a reason, not a hidden menu. Approvals run as gates with a named authoriser, an SLA and an escalation. And where a jurisdiction has no value for something, the capability that depends on it switches off and says why.
What it costs us: decisions 02 and 03 above — the visible gaps, and the slower path to go-live.
Change a rule once and it changes behaviour everywhere the first layer says that concept appears, across every source the second has wired. One change in one place, instead of the same change repeated on every screen that touches it.
Some of the wiring above runs end to end today and some is a representative surface over seeded data. Each explainer says which, and so does the screen.
What that adds up to
The fourth aim is the one most platforms make worse.
A platform you can leave is a platform you can trust to stay.