Overview
HNZ Radiology Tools: architecture and handover
HNZ Radiology Tools is a set of web apps built for the national radiology network. There's a facility profile tool, a workforce sizing model, a triage reference and a portal for radiology staff. They all run in one Cloudflare account, build from one GitHub repo and share one sign-in.
This pack is written for Health NZ Digital's architects and senior technical staff, ahead of Digital taking over governance, the Cloudflare account and releases. It covers what's there, how the pieces connect, why it was built this way and what's still outstanding.
How to read this pack
These pages describe the platform as it runs in production. Anything that isn't right yet is in the risk register, with how serious it is, where it's at and how to fix it.
| Marker | Meaning |
|---|---|
| In production | Running for users. |
| Planned | Designed and agreed, not yet built. |
| Partly fixed | A known weakness with some mitigation in place. |
| Open | A known weakness with no mitigation yet. |
The whole system
The apps
Site Profiles
The record of every radiology facility: equipment, staffing, contacts, performance and digital tools. It also holds the radiologist registry the portal uses.
My HNZ Radiology
The staff portal at hnzradiology.nz. People keep their own profile, specialties and photo up to date, find colleagues, read announcements and message peers.
Service Sizing
Works out how many SMOs each planning unit (a "grain") needs for its reporting and MDM load, and compares that with who it actually has.
Triage
A vetting reference. About 2,600 clinical scenarios, each with the right modality and priority, searchable by keyword or by pasting in the referral.
Identity hub
Where everyone's account lives. It handles sign-in for all the apps and decides who can do what, all from one admin screen.
Email worker
Sends every email the platform sends: sign-in codes, invitations, announcements and the Monday digest of out-of-date facility profiles.
What handover involves
Right now all of this sits with one person. Handing it over means moving:
- The code. The GitHub repo moves from a personal account into a Health NZ organisation. That also switches on branch protection, required reviews and an approval step before production, none of which the current plan allows. Details are on Repository and pipelines.
- The platform. Health NZ owns the Cloudflare account, with named administrators, two-factor sign-in enforced and the secrets kept in a Health NZ vault. Details are on Operations, cost and handover.
- Release sign-off. Every production release already goes through one GitHub Actions workflow. After handover, a Health NZ reviewer approves each run before it goes out.
At the moment people sign in with a six-digit code emailed to them. Site Profiles, Service Sizing and Triage already trust the identity hub, so Entra only needs adding to the hub. It would accept an Entra sign-in and hand out the same token it does now, and none of the apps would need to change. The identity data was set up with this in mind: each person can have several verified email addresses, and there's a spare column ready for their Entra ID. More on Authentication and security.
Where things stand
In good shape
- There are no servers, operating systems or databases for anyone to patch.
- Production and preview have separate databases, Workers, R2 buckets and encryption keys. They still share one deploy token (R4).
- Staff personal data in the hub and the registry is encrypted, and looked up without decrypting it. The exception is the old app user tables that are due to be retired (R14).
- One sign-in and one set of access rules across all the apps, managed in one place and logged.
- Nothing reaches production except through GitHub Actions.
Needs attention
- It all depends on one person: a personal GitHub account, and secrets set from one laptop.
- The current GitHub plan can't protect branches or require approval before a release.
- One item needs finishing straight away: R1 in the risk register.
- There's very little automated testing. CI only checks types.
- AI calls still go straight to Anthropic. They need moving to Health NZ's own endpoints.