Health New Zealand | Te Whatu Ora
Radiology Tools Architecture and handover

Overview

HNZ Radiology Tools: architecture and handover

HNZ Radiology Tools is a set of web apps built for the national radiology network. There's a facility profile tool, a workforce sizing model, a triage reference and a portal for radiology staff. They all run in one Cloudflare account, build from one GitHub repo and share one sign-in.

This pack is written for Health NZ Digital's architects and senior technical staff, ahead of Digital taking over governance, the Cloudflare account and releases. It covers what's there, how the pieces connect, why it was built this way and what's still outstanding.

4 + 1applications, plus the identity hub they share
313people with one identity across the apps
45+radiology facilities profiled
~2,600clinical triage scenarios
US$10per month, total Cloudflare spend
0servers, VMs or containers to patch

How to read this pack

These pages describe the platform as it runs in production. Anything that isn't right yet is in the risk register, with how serious it is, where it's at and how to fix it.

MarkerMeaning
In productionRunning for users.
PlannedDesigned and agreed, not yet built.
Partly fixedA known weakness with some mitigation in place.
OpenA known weakness with no mitigation yet.

The whole system

WHO USES IT Radiology staff admins, editors, viewers Radiology members radiologists, MRTs, others Referrers public triage search ONE CLOUDFLARE ACCOUNT Edge: DNS, TLS, DDoS, caching APPLICATIONS (EACH WITH ITS OWN DATABASE) portal API, relayed to the hub Site Profiles facilities, equipment, staffing, registry My HNZ Radiology member portal Service Sizing SMO workforce demand vs capacity Triage scenario to modality and priority facilities and staffing data signed 15-minute token, one per app Identity hub (hnz-identity) email sign-in, sessions, access tiers and grants, person profiles (encrypted), announcements, audit Email worker hnz-email Cloudflare Email Also in the account: Cloudflare Images (photos), Workers AI and Vectorize (triage search), a weekly scheduled digest, and a full, separate preview copy of every component OUTSIDE CLOUDFLARE Anthropic API triage reranking, Site Profiles query Staff inboxes codes, invites, digests GitHub Actions deploy all code
Everything runs in one Cloudflare account. Site Profiles, Service Sizing and Triage accept a short-lived token signed by the identity hub, so none of them handles sign-in itself (their old password logins are still switched on and are due to be retired, R10). Service Sizing pulls facility and staffing data from Site Profiles. My HNZ Radiology is a thin portal. Its profile and announcement data sits in the hub, and for now it gets there by going through Site Profiles. The only traffic that leaves Cloudflare is outgoing email, AI calls to Anthropic (these will move to Health NZ's own AI endpoints) and Triage's password-reset emails through Resend.

The apps

What handover involves

Right now all of this sits with one person. Handing it over means moving:

  • The code. The GitHub repo moves from a personal account into a Health NZ organisation. That also switches on branch protection, required reviews and an approval step before production, none of which the current plan allows. Details are on Repository and pipelines.
  • The platform. Health NZ owns the Cloudflare account, with named administrators, two-factor sign-in enforced and the secrets kept in a Health NZ vault. Details are on Operations, cost and handover.
  • Release sign-off. Every production release already goes through one GitHub Actions workflow. After handover, a Health NZ reviewer approves each run before it goes out.
First win: Entra ID sign-in

At the moment people sign in with a six-digit code emailed to them. Site Profiles, Service Sizing and Triage already trust the identity hub, so Entra only needs adding to the hub. It would accept an Entra sign-in and hand out the same token it does now, and none of the apps would need to change. The identity data was set up with this in mind: each person can have several verified email addresses, and there's a spare column ready for their Entra ID. More on Authentication and security.

Where things stand

In good shape

  • There are no servers, operating systems or databases for anyone to patch.
  • Production and preview have separate databases, Workers, R2 buckets and encryption keys. They still share one deploy token (R4).
  • Staff personal data in the hub and the registry is encrypted, and looked up without decrypting it. The exception is the old app user tables that are due to be retired (R14).
  • One sign-in and one set of access rules across all the apps, managed in one place and logged.
  • Nothing reaches production except through GitHub Actions.

Needs attention

  • It all depends on one person: a personal GitHub account, and secrets set from one laptop.
  • The current GitHub plan can't protect branches or require approval before a release.
  • One item needs finishing straight away: R1 in the risk register.
  • There's very little automated testing. CI only checks types.
  • AI calls still go straight to Anthropic. They need moving to Health NZ's own endpoints.