# Design an electronic health record system: system design interview question

> Patient records with fine-grained access, clinical corrections, sensitive documents, and evidence of access and changes.

Source: https://sysround.com/questions/design-electronic-health-record-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design an electronic health record system for a network of care organizations. Staff use it to store and retrieve patient histories, diagnoses, prescriptions, and test results. The system must control access and maintain a record of changes."

## What to clarify first

- Scale and request mix
- Record and document size
- Latency
- Access rules
- Consistency and availability
- Clinical changes
- Lab identity and order
- Audit and administrator access
- Retention and durability
- Identity and exclusions

## Scope of a strong answer

Core requirements:

- Store and retrieve patient histories, diagnoses, prescriptions, and test results.
- Preserve prior revisions when staff or labs correct clinical records.
- Enforce access rules for each patient, record type, and action.
- Record access attempts and changes, including approved direct database access.

Usually out of scope:

- Match patient identities across organizations.
- Exchange records across organizations.
- Send prescriptions to pharmacies.
- Provide clinical advice or drug interaction checks.
- Process insurance claims or certify legal compliance.
- Permit unrestricted clinical SQL or database exports across patients.
- Protect against compromise of the independent security control plane.

## What interviewers probe

### Access to patient records

A staff role alone does not determine access. Consent, care relationships, record restrictions, and emergency access can change the result.

### Changes to clinical records

A correction must preserve the original clinical fact. Concurrent edits and delayed lab results can otherwise change treatment history without clear evidence.

### Evidence of access and changes

Reads need evidence as well as changes. Direct database access can bypass application events, while statement audits do not identify every patient row read.

## Common mistakes

- The design uses a staff role as the only access rule.
- The service replaces signed records and loses the original clinical facts.
- The service sends audit events after the response without a durable copy.
- The service exposes documents through URLs that bypass access checks.
- The design lacks a stable lab identity or assumes that arrival order defines correction order.
- The design assumes that SQL statement logs identify every patient whose records a query reads.

## The bar by level

- **Senior:** Defines access rules for each record type and enforces revocations. Handles concurrent edits, source identity, correction order, and audit outages. Sizes storage and indexes from the workload. Restricts privileged clinical queries so audit events have reliable patient attribution.
- **Staff+:** Defines enforceable administrator privileges and independent evidence for database access. Covers procedure scope, grants, alternate access paths, and uncertain audit outcomes. Specifies failure rules for policy checks, source updates, and audit capture. Evaluates recovery tests, retention costs, and organization isolation.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=electronic-health-records


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.