Student Health Records Module

Capture and protect sensitive student health information. Parents provide and confirm records; a doctor's note is required as proof. Only authorised staff in the Health Records Access group can view clinical data.

Service: health-service · Add-on module · Phase 3 · Module catalog

Purpose

Schools need accurate health information to care for students during the school day — allergies, medications, chronic conditions, emergency contacts for medical events. This module:

• Collects health data from parents/guardians at registration and on updates
• Requires parent confirmation on the dashboard so students cannot submit false information alone
• Requires a doctor's note (PDF/image) as supporting proof for declared conditions
• Restricts viewing to school nurse and top administration via a dedicated access group

Who can see what

Health Records Access group

Configurable per school in admin settings. Staff are assigned explicitly — not by job title alone. Typical members:

• School nurse(s) per campus
• Head teacher / director (optional per school policy)
• Designated welfare officer

Implemented as HEALTH_RECORDS_VIEWER permission + optional custom group health-records-access in auth-service. Gateway enforces on all /api/v1/health/** routes except parent portal paths.

Registration workflow

1. Reception creates student (Core module)
2. Parent invited to portal or completes health section at office with staff
3. Health questionnaire — parent fills required fields per school template
4. Parent uploads doctor's note (required if any condition/medication/allergy declared; required for boarding schools — configurable)
5. Record saved as PENDING_PARENT_CONFIRMATION
6. Parent taps "I confirm this information is true and complete" on dashboard
7. Status → CONFIRMED; nurse notified for review
8. Enrollment can proceed to ACTIVE once health section submitted; school may block full access until CONFIRMED (configurable)

Parent dashboard

Each linked child shows a Health record card:

• Status badge: Not started / Pending confirmation / Confirmed / Update required
• Summary lines: allergies, medications (labels only — full detail in form)
• Doctor's note: attached ✓ or missing ⚠
• Actions: Review & confirm, Update health information, Upload doctor's note

Updates after confirmation reset status to UPDATE_PENDING until parent re-confirms and (if conditions changed) new doctor's note uploaded.

Data captured

Record statuses

Nurse & administration actions

• Queue: students pending nurse review, expiring doctor's notes, unconfirmed records
• Add confidential nurse notes (not visible to parents unless school policy shares summary)
• Log incident / sick bay visit (optional sub-feature, same access group)
• Request parent re-confirmation with reason
• Export audit log for director (who accessed which record, when)

Security & compliance

• Separate health_db — no health fields in student-service public tables
• Encryption at rest (PostgreSQL + MinIO for documents)
• Uganda Data Protection Act — explicit consent at confirmation; retention policy configurable
• Immutable health_access_audit log (read, export, print)
• No health data in SMS/email body — alerts say "Action required on health record" with portal link only
• API returns 403 for unauthorised roles — not 404 (to avoid enumeration, optional mask as 404 for non-existent student)

API endpoints (health-service via gateway)

# Parent portal
GET    /api/v1/portal/health/{studentId}           # summary + status (guardian-linked only)
PUT    /api/v1/portal/health/{studentId}           # submit / update form
POST   /api/v1/portal/health/{studentId}/confirm     # parent confirmation
POST   /api/v1/portal/health/{studentId}/documents   # upload doctor's note → file-service

# Health Records Access group only
GET    /api/v1/admin/health/students?campusId=&status=
GET    /api/v1/admin/health/students/{studentId}     # full record + audit on read
POST   /api/v1/admin/health/students/{studentId}/nurse-note
POST   /api/v1/admin/health/students/{studentId}/request-reconfirmation
GET    /api/v1/admin/health/audit?studentId=&from=&to=

# Auth admin
PUT    /api/v1/admin/groups/health-records-access/members

Data model (health_db)

student_health_records
  id, organization_id, campus_id, student_id
  status, version
  allergies JSONB, chronic_conditions JSONB, medications JSONB
  blood_group, disability_notes, immunisation_notes
  family_doctor_name, family_doctor_phone, hospital_preference
  emergency_action_plan_file_id
  parent_confirmed_at, parent_confirmed_by (guardian_id)
  parent_declaration_text
  nurse_reviewed_at, nurse_reviewed_by
  created_at, updated_at

health_documents
  id, health_record_id, document_type (DOCTORS_NOTE, ACTION_PLAN, OTHER)
  file_id, uploaded_by, uploaded_at, expires_at

health_nurse_notes
  id, health_record_id, note, author_id, created_at

health_access_audit
  id, health_record_id, student_id, actor_id, action (READ|EXPORT|UPDATE)
  ip_address, created_at

health_record_status_history
  id, health_record_id, from_status, to_status, actor_id, note, created_at

Events

• HealthRecordSubmitted → notification to nurse group
• HealthRecordConfirmed → nurse queue
• HealthReconfirmationRequired → parent SMS/email

See also: database design · architecture · parent portal