hacCare
Stable v6.0.4
A multi-tenant healthcare simulation platform for clinical education. Built with React, TypeScript, and Supabase.
Overview
hacCare is a simulated Electronic Medical Record (EMR) system designed for healthcare education and clinical training. It provides realistic patient care workflows including barcode medication administration (BCMA), vital signs monitoring, clinical documentation, and simulation management with role-based access control.
What's New in 6.0.4
- Medication doctors' orders — A doctor's order can be a medication order that adds the
medication to the MAR automatically. The order holds the ordered dose (e.g. 50 mg) while the MAR
keeps the label strength (e.g. 25 mg tablets), and the MAR and BCMA show the order next to the
medication so students work out the dose.
- Tablet counting on BCMA — Oral tablets are given by count, with the total dose recorded.
- Ready to Start simulations — Launch leaves a simulation Ready to Start; pressing Start moves
the chart forward to now and starts any timed orders. The instructor quick guide was rebuilt.
- Medication labels from the Patient Library — Print medication labels straight from a patient
template.
- Institution-scoped access — Templates, simulations, users and programs are confined to their
own institution, and every privileged database function checks its caller.
- Template editing improvements — Instructors can delete handover notes, are warned before
leaving edit mode, and no longer get stuck in a template after editing; templates always keep
their program tag.
- Fixes — Order dates no longer show a day early, time fields accept "20:00", students take
phone/verbal orders like nurses, and a patient chart no longer opens outside its workspace.
What's New in 6.0.3
- Timed orders and medications — Instructors can hold a doctor's order or a medication back
from students until a set number of minutes into a simulation, so a scenario can develop on its
own.
- Patient photos — Patients can have an uploaded stock photo instead of an illustrated avatar.
- Insulin sliding scales on BCMA — Diabetic medications can carry a correction scale that BCMA
shows at the point of administration, with the glucose reading and dose recorded in the debrief.
- Instructors edit their own templates — Instructors can edit and delete medications and
doctors' orders, and enter lab panels and results, while editing a template.
- Named template states — Save weekly versions of a template (Week 1, Week 2, …) and launch or
reset a simulation into any of them, keeping the same printed labels all course.
- Auto-generated student logins — Launch can create simulation-only student accounts, and new
instructors get an email invite to set their own password.
- Cleaner medication catalog and labels — Generic (Brand) names, brand on its own label line, and
one shared Add/Edit Medication form.
- Fixes and hardening — Dates of birth no longer show a day early, BCMA accepts a typed Patient
ID, wristband codes no longer double their prefix, and tenant isolation was tightened further.
- Refreshed Knowledge Base — Updated articles throughout, including a new Timed Orders &
Medications section.
Core Features
Patient Care Management
- Complete patient profiles with demographics and medical history
- Real-time vital signs monitoring with automated alerts
- Medication administration tracking with Five Rights verification
- Clinical assessments including wound care and diabetic management
- Patient notes system with categorization and priority levels
- 24-hour Medication Administration Record (MAR) view
Barcode Medication Administration (BCMA)
- Five Rights verification (Patient, Medication, Dose, Route, Time)
- Multi-format barcode scanner support
- Patient wristband and medication label generation
- Automatic patient identification via hospital bracelets
- Complete audit trail for regulatory compliance
Clinical Documentation
- Wound assessment tools with photo documentation
- Laboratory order management with specimen tracking
- Body mapping system for device and wound tracking
- Admission and discharge processing workflows
- Printable labels compatible with Avery 5160 format
Alert System
- Real-time patient monitoring with priority classification
- Medication due alerts with intelligent deduplication
- Critical vital sign notifications
- Acknowledgment workflow with audit logging
- Escalation rules for unacknowledged alerts
Simulation System
- Template-based patient scenarios for teaching
- Multi-session simulation support with data isolation
- Student activity tracking and review
- Debrief report generation with PDF export
- Schema-agnostic design for automatic database adaptation
Security & Compliance
- Role-based access control (Student, Instructor, Coordinator, Admin, Super Admin)
- HIPAA-compliant data handling with encryption
- Comprehensive audit trails for all actions
- Secure session management with automatic timeout
- Multi-tenant isolation with Row Level Security
Technical Stack
Frontend
- React 19.2 with TypeScript 6.0 (strict mode)
- Vite 8.2 (Rolldown-based bundler) with
@vitejs/plugin-react 6.0 (Oxc-powered React Refresh, no Babel)
- Tailwind CSS 4.1 via PostCSS
- React Router 7.18 for client-side navigation
- TanStack Query 5.101 for server state, caching, and background sync
- Lucide React 1.31 for icons
- React Big Calendar 1.20 for scheduling views
- React Dropzone 20.1 for drag-and-drop file uploads
- React Image Marker 1.2 for body mapping (device/wound placement)
Backend & Database
- Supabase (PostgreSQL 17) hosted in ca-central-1 (Canada) for data residency
- Row Level Security (RLS) enforcing multi-tenant isolation on every table
- SECURITY DEFINER functions for privileged cross-tenant operations
- Supabase JS 2.112 client SDK
Document & Barcode Generation
- jsPDF 4.1 + html2canvas 1.4 for PDF export
- @react-pdf/renderer 4.6 for structured PDF reports
- qrcode 1.5 for QR-based patient and medication label generation
- PapaParse 5.6 for CSV import/export
Utilities
- date-fns 4.4 for date formatting
- DOMPurify 3.4 for XSS sanitisation
- UUID 14.0 for identifier generation
Dev Tooling
- Vitest 4.1 for unit testing
- ESLint 10.8 with TypeScript and React Hooks plugins
- Terser 5.50 for production minification
- rollup-plugin-visualizer 7.1 for bundle analysis (
npm run build -- --analyze)
Version History
6.0.4 (Stable — October 2026)
- Medication doctors' orders linked to the MAR (ordered dose vs. label strength)
- BCMA tablet count with total dose for oral medications
- Simulations launch as Ready to Start; Start moves the chart forward to now
- Medication label printing from the Patient Library
- Data scoped to its owning institution; access guards on privileged database functions
- Template editing fixes: handover note deletion, leave-edit warning, program tag, stuck tenants
- Required simulation names, named multi-room launches and renaming
- Order date, time input and release-hint fixes; students take phone/verbal orders
- Patient charts blocked outside their workspace
- Repository security hardening and Node.js 22.23.4
6.0.3 (Stable — October 2026)
- Timed doctors' orders and medications that release partway through a simulation
- Patient photos as an alternative to illustrated avatars
- Insulin sliding scales shown on BCMA and recorded in debriefs
- Instructors can edit/delete template medications and orders and enter lab results
- Named template states for weekly scenarios
- Auto-generated simulation student logins and email invites for instructors
- Medication catalog cleanup, label redesign and a unified medication form
- Simulation pause and legacy patient transfer removed
- Date-of-birth, BCMA manual entry and wristband code fixes; further tenant isolation hardening
- Knowledge Base refresh with a Timed Orders & Medications section
6.0 (Preview — August 2026)
- Admission records now fully tracked in simulation debrief reports and reset between sessions
- Hardened multi-tenant data isolation safeguards across clinical record types
- Deleting a simulation template now fully cleans up all associated data
- Deleting a patient now automatically cleans up related records to prevent orphaned data
- New instructor tool to seed sample data into a running simulation for debrief testing
5.5.0 (May 2026)
- Migrated infrastructure to Canada (ca-central-1) region for data residency compliance
- Fixed critical security vulnerabilities (jspdf HTML injection, flatted prototype pollution)
- Optional vital signs fields to support clinical edge cases (newborns, partial assessments)
- Fixed empty array handling in snapshot restore function
- Redeployed reset simulation functions with BBIT entries support
- Dependency and environment variable cleanup
5.3.0 (March 2026)
- Made assigned nurse field optional for simulation workflows
- Fixed all security vulnerabilities (7 high/moderate issues resolved)
- Updated Supabase SDK to 2.99.0 for improved API compatibility
- Updated React, Vite, Tailwind, and build tooling to latest versions
- Improved multi-role support for students, instructors, and coordinators
5.2.0 (February 2026)
- Template versioning system with smart simulation sync
- Program-based instructor permissions
- Student management improvements
- Enhanced simulation portal with card-based UI
- Coordinator auto-login fix for program tenants
- Lab orders system with specimen tracking
- Body mapping for device and wound tracking
- BCMA Five Rights verification with barcode scanning
5.1.0 (January 2026)
- Alert system with smart deduplication
- Priority classification and escalation
- Real-time notifications
- Enhanced security diagnostics
5.0.0 (December 2025)
- New simulation system architecture
- Template management and reusable scenarios
- Student activity tracking
- Multi-tenant isolation improvementsement
- Vital signs tracking
- User authentication
Getting Started
Prerequisites
- Node.js 20.x or higher
- npm or yarn package manager
- Supabase account for database
Installation
- Clone the repository
- Install dependencies:
npm install
- Configure environment variables in
.env
- Run development server:
npm run dev
- Build for production:
npm run build
Environment Variables
Required environment variables:
VITE_SUPABASE_URL - Supabase project URLVITE_SUPABASE_ANON_KEY - Supabase anonymous key
Documentation
Comprehensive documentation is available in the docs/ directory:
- Architecture guides in
docs/architecture/
- Feature documentation in
docs/features/
- Database schema in
docs/database/
- Deployment guides in
docs/deployment/
- Operations and troubleshooting in
docs/operations/
Security
This application handles simulated protected health information (PHI) for educational purposes. All security features follow HIPAA compliance guidelines.
Continuous Security Scanning
- GitHub CodeQL — static analysis runs on every PR and push, scanning JavaScript/TypeScript and Python for vulnerabilities (SQL injection, XSS, path traversal, insecure randomness, etc.)
- Snyk — dependency vulnerability scanning on every PR, with results uploaded to the GitHub Security tab as SARIF reports
npm audit — run locally and in CI to catch known CVEs in the dependency tree
All findings are reviewed before merging. Security alerts are visible under the Security tab of this repository.
Application Security Controls
- Multi-tenant Row Level Security — every table enforces
tenant_id isolation via PostgreSQL RLS; cross-tenant data leakage is blocked at the database layer
- Role-based access control — five-tier hierarchy (Super Admin → Coordinator → Admin → Instructor → Nurse) with program-scoped permissions
- SECURITY DEFINER functions — privileged operations (simulation launch, tenant creation) run as controlled database functions, not ad-hoc queries
- DOMPurify sanitisation — all user-supplied HTML is sanitised before rendering
- Secure session management — automatic timeout, token rotation via Supabase Auth
- Comprehensive audit trails — all clinical actions logged with user, timestamp, and tenant context
- PHI redaction — simulated patient data only; no real PHI is stored or transmitted
Report security issues to the repository maintainers.
License
See LICENSE file for details.
Support
For issues, questions, or contributions, please use the GitHub issue tracker.
Built with ❤️ by the hacCare Team | A haclabs Inc. Product
