Platform
Microsoft stack where already licensed, otherwise a specialist care system.
Why. Do not rebuild sector software without need.
Trade-off. Licence and governance cost.
Industry patterns · Aged care and community services
Aged care and community services administration
Client records, rosters, care plans and incident reporting connected on a Microsoft stack, with consent, family access and regulatory reporting handled deliberately.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- Aged Care Quality Standards and reporting obligations
- WCAG 2.2 AA
Architecture
- People and clients
- Security and identity
- SaaS and business systems
- Databases and data
- Compute and containers
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Care staff sign in with SSO, and rosters and visits show only the clients they are assigned to.
The administration app handles the client record, care plan, notes and incidents.
Data lives in Dataverse with row and column security for sensitive notes.
Family members see agreed information through a consent-based portal, with the client's or representative's consent recorded.
Rostering and timesheets integrate with payroll and billing, to reduce re-keying.
Quality and clinical indicators are calculated from the record and reported to managers.
Regulatory reports and incident notifications are generated from the same data, reviewed and submitted by a responsible person.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Dynamics 365 or custom apps on Dataverse | Client records and processes. | Matches existing Microsoft licences. |
| Entra ID and External ID | Staff and family identity. | One security model. |
| Dataverse field and row security | Sensitive notes. | Need-to-know access. |
| Rostering integration | Visits and timesheets. | Reduces double entry. |
| Incident management workflow | Capture, escalate and report. | Time-critical obligations. |
| Power BI | Quality indicators. | Visibility for managers and boards. |
| Consent management | Family and representative access. | Legal basis for sharing. |
| Mobile app | Visit notes in the field. | Staff are rarely at a desk. |
Design decisions and trade-offs
Family access
Explicit, revocable consent per person and per data category.
Why. Privacy and dignity.
Trade-off. More consent management.
Incidents
Workflow with timers and escalation.
Why. Reporting deadlines.
Trade-off. Needs clear ownership.
Reporting
Indicators derived from the record, not re-keyed.
Why. Accuracy.
Trade-off. Data quality at point of care matters.
Well-architected pillars
Security
Private networking, Entra ID with Conditional Access, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Zone-redundant services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
Spoke virtual network with private endpoints to data services. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Staff via Entra ID with MFA. Families via external identity with verified relationships. Role-based access by care team.
Data and encryption
Health and personal information of vulnerable people. Encrypt with CMKs, restrict region, minimise, log reads and define retention per aged care record rules.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Missed incident deadline | Timers, escalation and a daily open-incident review. |
| Wrong family access | Verified relationships and consent review. |
| Poor connectivity in homes | Offline-capable mobile notes. |
| Rostering integration failure | Queue and daily reconciliation. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Providers needing integrated records, rostering and reporting.
- Organisations on Microsoft 365.
When not to
- Replacing clinical systems without clinical governance.
- Collecting data not needed for care or reporting.
More in industry patterns
State government
Citizen service portal for state government
A public channel for an application, a payment and a case, with the decision kept with an officer and a full audit trail, hosted in Australian regions.
Local government
Council request and field service platform
Residents lodge requests on web or mobile, crews work offline in the field and the council system of record stays authoritative, with AI used only to triage and summarise.
Health
Health referral and intake workflow
Structured digital referrals into a clinical service, with consent, secure messaging and clinical system integration, hosted in Australia with strong audit.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.