← Back to all workProduct · Healthcare

Avalon

Splitting the note from the record — designing clinical documentation for the bedside, not the chart.

Role
Sole Product Designer
Company
CureMD
Platform
iOS — iPhone, iPad, Apple Watch
Duration
~2 years
Year
2023
Partners
UX Writer, UX Analyst
CureMD's desktop EMR — the complete chart. Avalon is its companion at the point of care.
CureMD's desktop EMR — the complete chart. Avalon is its companion at the point of care.
01
The setup

Built like a chart, used like a hallway

Avalon is the mobile companion to CureMD's EMR — the app a physician uses to chart, prescribe, check eligibility, and manage their schedule between patients rather than at a desk. The version I inherited was built like desktop software ported to a phone: dense, exhaustive, and optimised for the completeness of the medical record. That's the right instinct for a chart. It's the wrong instinct for the thirty seconds a physician has standing in a hallway between rooms.

The constraint that made this hard is specific to the domain: clinical documentation carries medico-legal weight, so the safe-feeling default is to capture everything, up front, in one pass. But the operator here isn't a record-keeper at a workstation — it's a clinician in motion, and every additional required field is friction at the exact moment they have the least attention to spare.

The working hypothesis: if a note could be documented and signed in the time a physician actually has at the point of care, both adoption and documentation quality would rise — without sacrificing the completeness the record demands.

Multi-user login — built for shared clinic devices, not one phone per user
Multi-user login — built for shared clinic devices, not one phone per user
Patient select — the clinician picks up where they are, mid-round
Patient select — the clinician picks up where they are, mid-round
02
The first wrong turn

The completeness-first form

The first direction treated the Provider Note as a single comprehensive form. Capture the full History of Present Illness, reason, comments, severity, and structured clinical detail on the entry path — mirror the record exactly. On paper this is unarguable: clinicians need complete documentation, and the signed record genuinely holds dense, structured clinical narrative.

What the completeness-first form missed is where the physician is standing when they fill it out. It solved the record's problem, not the prescriber's.

03
The pivot moment

Capture fast, verify later

Physician interviews surfaced the real behaviour. Providers don't document for completeness in the moment — they capture fast and verify later. Shown the comprehensive entry form, they described it the way they described the legacy app: as something to get through, not something that helped them care for the patient in front of them.

That was the signal that the frame was wrong. We weren't designing a form that was too long; we were designing the wrong artifact for the moment of use. The completeness was real and necessary — it was just living in the wrong place in the flow.

04
The reframe

Separate documenting from reading

The principle that came out of it: separate documenting from reading.

Instead of one note, two states. The entry-and-sign-off path is stripped to what a physician needs while moving — patient, date and time, reason, a comment, and a single, unmissableSign Off action. The full clinical record — the structured HPI, severity, the signed-by attribution and timestamp — becomes the read state, surfaced when reviewing or auditing the chart, not when capturing it.

Fast in. Complete on the record. Nothing about the documentation's completeness was sacrificed; it was relocated to the moment where completeness actually matters.

Write state — patient, date, time, reason, comment, and one Sign Off action
Write state — patient, date, time, reason, comment, and one Sign Off action
Read state — full HPI, severity, signed-by attribution and timestamp
Read state — full HPI, severity, signed-by attribution and timestamp

Two states of one note. The same artifact, split by the moment it's used in.

05
The friction

Defending the split

The hard part wasn't drawing the two states — it was defending the split. In clinical software, "capture everything up front" isn't laziness; it's a genuine risk-management instinct, because an incomplete note has medico-legal consequences. The resistance here was that instinct itself rather than any one antagonist: the pull toward completeness-at-entry is the default every clinical tool drifts toward, and the burden was on the design to prove the split was safe, not merely faster.

The design's answer to the tension: completeness was never removed, only moved into the signed record. That reframing — relocate, don't delete — is what let the split survive review.

06
The resolution

One pattern, repeated across the app

What shipped was the two-state Provider Note, sitting inside a design system I architected for the whole app — which is why the same logic could repeat across every module. A fast surface over a complete record, again and again.

Module

Explicit states, everywhere

Appointments carries an eight-state status taxonomy — Scheduled, Confirmed, Checked Out, Forced, Blocked, Check In, Waiting List, Rescheduled — and Rx Activity names every prescription state, including controlled-substance (EPCS) handling: Sent, Queued, Not Supported, Data Error. A prescriber always knows exactly where an order stands.

Appointments — eight colour-coded status states
Appointments — eight colour-coded status states
Rx Activity — explicit EPCS order states
Rx Activity — explicit EPCS order states
Module

Actions one gesture away

The common actions — edit, reschedule, cancel; replace, delete — live behind a consistent swipe-to-reveal. The list stays calm; the action is never more than one gesture away.

Swipe an appointment — edit, reschedule, cancel
Swipe an appointment — edit, reschedule, cancel
Swipe a prescription — edit, replace, delete
Swipe a prescription — edit, replace, delete
Module

Careful with the data that matters

Inline validation catches malformed input at entry; identifiers are masked for privacy; identity fields are inclusive, with a "Choose not to disclose" option; and insurance is modelled as a real primary / secondary / tertiary hierarchy rather than a single flat field.

Add Patient — inline validation catches bad input at entry
Add Patient — inline validation catches bad input at entry
Insurance — primary, secondary and tertiary coverage
Insurance — primary, secondary and tertiary coverage
The system underneath

A design system, built end to end

What made the repetition possible was a system I owned end to end — banners, input and error states, table cells, tab bars, and a full button family. Because it was mine top to bottom, the note's core pattern — a fast surface over a complete record — stopped being a one-off and became a reusable primitive across the app.

Avalon design system — banners, error and input fields, table cells, tab bars and buttons
The Avalon system — banners, error & input fields, table cells, tab bars, and the button family.
Avalon design system detail — banner variants, input and error states, table-cell patterns
Detail — banner variants, required-field and error states, and the table-cell patterns reused across modules.
Result — qualitative

What the operators said

Physicians who had described the legacy app as a 90s relic responded positively to the revamp in follow-up interviews. There's no A/B number here, and that's the honest read — in a clinical tool used by physicians, you rarely get to run a controlled experiment on them. What there is instead is a documented research loop: a real behaviour observed, a frame corrected because of it, and a design the operators themselves validated.

07
The postmortem

What I'd weight differently

With distance, two things stand out. First, the controlled-substance prescribing path (EPCS, with its own error and "not supported" states) is the highest-consequence flow in the app, and a flow that error-prone deserved its own dedicated validation round with prescribers earlier than it got one. Second, the information architecture has aged far better than the visual styling — which is the real lesson about where the durable design investment lives. The thinking about separating documentation from reading is as valid today as it was then; the gradients are not.