23 / LEGAL SERVICES / PERSONAL INJURY CASE MANAGEMENT

An MVP case management platform connecting the law firm, the patient, and every provider involved in a case, with the access controls a legal and medical record actually needs.

Client: Personal injury law firm

Tags: Legal Tech · Personal Injury · MVP · Compliance · Case-Scoped AI

// Problem

A personal injury case touches a law firm, the patient, and a rotating cast of clinics and providers — each on their own phone, email, and paper trail, with sensitive medical and legal information passed around with no consistent record of who saw what or consented to what.

// Our Solution

An MVP case management platform connecting the law firm, the patient, and every provider involved in a case, with the access controls a legal and medical record actually needs. Patients check in, sign consent forms, upload documents, and message the firm through a link that needs no account or password; providers get their own scoped portal to fulfill requests and see only the billing information relevant to their own involvement. Every role on the firm side sees exactly the case data their job requires, with every sensitive read and write logged to an audit trail nobody — not even an admin — can edit after the fact. A case-scoped AI assistant can answer questions straight from a case's own documents, without ever pulling in a file the asking user isn't already allowed to see.

// Technical Details

Magic-Link Patient & Provider Portals

Patients and providers never need an account — a single-use, expiring, hashed-at-rest magic link opens a session-less portal scoped to just their case. Patients check in, e-sign and revoke consent, upload documents, message the firm, and grant or revoke access to a delegate, with every action recorded in a receipt ledger.

Role-Based Access With a Read-Only Axis

Four firm-side roles — org admin, attorney, case manager, billing — each see only the case data their job requires, with per-org permission overrides on top of platform-wide defaults. A separate read/write flag applies across any role, so a broad read-only reviewer role falls out of the same mechanism instead of needing its own special case.

Compliance-Grade Audit Logging

Every write, and every read of anything classified as sensitive patient data, is logged automatically by the request middleware — not opt-in per endpoint. The audit log itself is append-only at the database level: an update is rejected outright, and a delete is only permitted from inside the scheduled retention job that purges old entries.

Provider Fulfillment With Preflight Gates

A request sent to a clinic or specialist can't be marked fulfilled until every requirement specific to that provider type is checked off, so a completed request always means the same thing regardless of which type of provider handled it.

Case-Scoped AI Assistant

A per-case AI assistant answers questions grounded only in that case's own documents, mirrored to the AI provider's file store under the same role-based visibility rules the rest of the app enforces, so it never answers from a document the asking user couldn't otherwise open.