Designing a Clinical System without letting the UI define reality

Keeping roles, permissions, and machine states aligned with real-world clinical workflows.

Improving Safety, Accountability, & Compliance in Radiotherapy environments

Keeping roles, permissions, and machine states aligned with real-world clinical workflows.

Context

RadPass manages access, handovers, and machine state in radiation-controlled environments. It supports Radiographers, Physicists, and Engineers across real-time clinical use and administrative oversight.

My role

Founding Product Designer (0→1). I defined the domain model, designed the information architecture across both admin and clinical tools, and ensured every permission structure was auditable and safe to configure.

Roles, states, and permissions lived in three different places

Configuring access felt harder than it should.

Admins had to configure roles in one place
Machine states in another
Then re-encounter the same relationships again
It wasn’t clear where access was actually controlled

Why this wasn’t just an IA issue

Machine states describe clinical reality. They shouldn’t exist because of a tablet.

UI structure was beginning to redefine clinical reality — an unacceptable risk in a regulated environment. Machine states shouldn't exist because the tablet needed a label. They should exist because clinical workflows require them.

The Insight

We were mixing clinical meaning with operational responsibility.

Machine states define clinical meaning
Roles define responsibility
We were letting both define access rules

Before / After

After, roles became the single place where access was configured.

✔

The decision: Roles own tablet access

The decision:
Roles own tablet access

Roles became the single place where tablet access is defined.
Each role determines which machine states can be set on tablets.

Roles became the single place where tablet access is defined. Each role determines which machine states can be set on tablets.

✔

Outcome

Access configuration became much easier to understand matching the Admin's mental model, without redefining clinical reality.

Next Case Study