Concept explainer

Core concepts

Sets out the ideas the rest of the documentation builds on, including patients, visits, encounters, orders, charges and the record itself.

Pensieve installs a small vocabulary, and the rest of this documentation builds on it. A reader who holds these terms can follow any page on the site. This page defines each one, shows how they relate, and walks a single patient event through all of them.

How to read this page

The terms build on each other. Read them in order the first time. Afterwards, treat this page as the reference you return to whenever a later page uses a word you want to pin down.

The shape of the vocabulary

Eleven terms carry most of the meaning in Pensieve. They fall into four ideas: where care happens, what the record holds, how work gets done, and how the platform stays safe. Each idea adds a few words, and every later tool reuses them exactly.

Where care happens

Organisation and site

An organisation is the legal entity that runs the hospital. A site is a physical location that the organisation operates, such as a main hospital building or a satellite clinic. One organisation holds one or more sites, and the work happens at a site. The site is the unit of tenancy, so operational data such as catalogues, tariffs, roles, beds and staff is held per site, while the organisation is a grouping label for naming and reporting. The patient record belongs to the patient. It exists once, has no owning hospital, and sits outside the tenancy structure, so it is not scoped to the organisation.

organisation
- site
  - unit
    - location
      - bedthe smallest location

The record is a single object that follows the patient across every site that runs Pensieve, not only across the sites of one hospital group. A hospital group is a grouping label, not the record's boundary. The section on the hospital model sets out how sites, units, locations and beds nest inside each other.

Encounter

An encounter is a single contact between a patient and the hospital. A walk in visit to the outpatient desk is an encounter. An inpatient stay is an encounter. The encounter is the spine that everything else hangs from: the diagnoses recorded during it, the orders placed within it, and the charges it generates all point back to one encounter.

The clerk opens the encounter at the front desk, choosing its type and attaching it to the patient record.

What the record holds

Patient record

The patient record is the durable account of a patient across every encounter. It holds diagnoses, documents, results, consent and the history of who did what. The record belongs to the patient and has no owning site, so a clinician treating the patient reads the same history at any site that runs Pensieve, not only the sites of one organisation.

diagnoseslist

Coded conditions carried forward across encounters.

documentslist

Scanned and uploaded files attached to the record.

resultslist

Laboratory and imaging results returned against orders.

consentlist

Directives the patient has given about their record.

historylog

The attributed account of who did what and when.

Directive

A directive is an instruction the patient gives about their own record, such as a consent to a procedure or a rule about who may view a document. Directives are stored as first class entries, so the record carries both the clinical facts and the patient's own decisions about them.

Attribution holds under pressure

Every entry in the record names the person who made it and the moment they made it. On a shared ward workstation, each member of staff signs in as themselves, so the record stays truthful about who acted even when several people use one screen through a shift.

How work gets done

Orderable and order

An orderable is an item in the catalogue that a clinician can request: a drug, a laboratory test, an imaging study, or a consultation. An order is a specific request for an orderable, placed for one patient inside one encounter.

encounter string Required	The encounter the order belongs to.
orderable string Required	Catalogue identifier, snapshotted at placement.
priority string	Routine or urgent, read by the fulfilling service.
note string	Free text passed to the fulfilling service.

When an order is placed, Forge records a snapshot of the orderable as it stood at that moment. A later change to the catalogue leaves the placed order alone, so the history reads exactly as it was at the time of the decision. The sequence below shows one placement end to end.

Charge

A charge is the billable consequence of an event, such as a procedure performed or a drug dispensed. A charge captures what was billed and the price that applied when it was raised. The section on billing follows a charge through tariffs, invoices and claims.

How the platform stays safe

Permission

A permission is the right to take a particular action. Pensieve decides what a person may do by combining their role with their relationship to the patient in front of them. Deciding from both, rather than role alone, is what keeps access tied to a current reason to see a record.

	Role only	Role and relationship
Reflects who the patient is to the actor	Absent	Present
Tracks the actor's changing shift	Absent	Present
Simple to reason about	Present	Partial

The set of actions a person holds is what draws their dock, the home screen they see when they sign in.

The dock

Open an encounter

Find a patient

Place an order

Record a diagnosis

Raise a charge

The dock a person sees is the set of actions their role and relationships allow. The screen is a projection of a permission decision.

Audit entry

An audit entry records that something happened: who acted, what they touched, and when. Pensieve writes the audit entry inside the same transaction as the change it describes, so a committed change always carries its audit entry. The section on governance sets out the full field list and how the audit trail answers the question of who saw a record.

{
  "actor": "nurse.k.rao",
  "action": "order.place",
  "encounter": "enc_7f31",
  "orderable": "paracetamol_500mg_tablet",
  "at": "2026-08-17T09:24:11Z"
}

Connection

A connection is a governed link between Pensieve and another hospital system, such as a laboratory analyser or a radiology archive. A connection carries messages across a controlled boundary. It is installed and mapped through orophin, the bridge that runs on the site network.

POST/connections/{id}/messages

Deliver one message across the connection boundary.

operator shell

$ pensieve connection install lab-analyser
connection lab-analyser installed
status pending mapping

The section on interop covers how a connection is installed, mapped and monitored.

The ward word and the platform word

Staff arrive with the vocabulary of the ward. Pensieve maps that vocabulary onto its own terms. The table below sets the two side by side.

Ward word	Platform word	What it means
Admission	Encounter	One contact between a patient and the hospital, from a walk in visit to an inpatient stay.
Notes	Patient record	The durable clinical account of the patient across every encounter.
Prescription	Order	A request for a drug, placed for one patient inside one encounter.
Bill line	Charge	The billable consequence of an event, priced as it stood when raised.
Login	Permission	The right to take a particular action, decided from role and relationship.
Paper trail	Audit entry	The record that something happened, written with the change it describes.

A term in motion

Before a dose can be given, a few preconditions have to hold. The checklist below is the state at the start of the walkthrough.

The organisation and its first site exist.

At least one clinician has a sign-in identity.

The laboratory connection is mapped.

The terms are easiest to hold once you watch one event travel through them. Here is a single dose of paracetamol, from the front desk to the ledger.

Figure 1.One patient event travelling through the vocabulary, from registration to the audit entry.

1
Register the patient
A clerk registers the patient in Gate, which creates or finds their patient record. The record belongs to the patient and sits outside the tenancy structure rather than being held at the organisation.
2
Open an encounter
The patient is seen at a site, so an encounter opens and anchors the visit.
3
Place an order
A clinician chooses an orderable from the catalogue and places an order inside the encounter. Forge stores the snapshot of the orderable as it stands now.
4
Raise a charge
The dose is administered, and Vault raises a charge that carries the price in force at that moment.
5
Leave a trail
Each of these steps writes an audit entry in the same transaction, so the whole sequence stays reconstructable later.

One patient event touched the record, an encounter, an orderable, an order, a charge and several audit entries, and it stayed within a single permission decision the whole way through.

Common confusions

Is an encounter the same as an admission?

An admission is one kind of encounter. A walk in visit to the outpatient desk is another. The encounter is the general term the platform uses for any single contact.

Is an order the same as a prescription?

A prescription is one order among many orderables. An order can also be a laboratory test, an imaging study or a request for a consultation.

Who decides a permission?

Pensieve decides a permission from the actor's role and their relationship to the patient in front of them, not from a role list alone.

A note on names

Several tools ship under short names that appear across the console and in this documentation. Each is glossed once here and then used plainly.

Gate handles admissions and visits.
Atlas holds the patient record.
Forge carries orders through their lifecycle.
Vault runs billing and revenue.
Nexus Manager models the hospital, and Cirith Manager decides access.

The glossary carries the full list. Read it once, and the rest of the documentation reads plainly.