From Excel to Multi-Tenant SaaS: Scaling a CCM/PCM Operation from 3,200 to 8,000+ Patients

A US-based Chronic Care Management (CCM) and Principal Care Management (PCM) company was running their entire operation — roughly 3,200 patients at the time — out of Excel spreadsheets: patient rosters, care-minute logs, monthly progress verification, provider paycodes, invoicing, and payment tracking all lived in disconnected files with no access control, no audit trail, and no compliance posture.

The engagement started with a single goal — replace the spreadsheets. It evolved into a multi-phase platform build that eventually became a fully multi-tenant SaaS product other care coordination organizations now use independently. The operation has since scaled past 8,000 patients without the back office scaling with it.

Phase 1 — Internal Operations Platform

The first version was a private internal system. The core architecture introduced RBAC (Role-Based Access Control) so each employee could only see and act on patients assigned to them. Managers had elevated access to their team's patient list. Administrators had organization-wide visibility. HIPAA compliance was engineered from day one: encrypted PostgreSQL storage with field-level encryption of patient identifiers (MRN/FIN), comprehensive audit logging, strict IAM policies, and API-level access controls enforced by FastAPI middleware.

Employee and manager dashboards were built as a Flutter web application with role-conditional rendering — the same codebase shows a different interface depending on who logs in. Automated report generation (Excel and PDF) was introduced early, replacing the manual monthly reporting cycle and giving operations leadership the first structured view of billing activity and employee output they had ever had.

Phase 2 — Time Tracking, Billing, and Automated Invoicing

CCM and PCM billing operates on documented time. CMS requires a minimum of 20 minutes of care coordination per patient per month for standard CCM (CPT 99490), with additional codes for extended time (99439) and for PCM (99426/99427). Every minute a care coordinator spends on a patient is a billable asset — or a compliance risk if it's undocumented.

This phase introduced per-patient time tracking at the employee level and, on top of it, fully automated invoice generation: monthly invoices are produced per clinic directly from CPT paycode counts, per provider, with Excel and PDF outputs — a process that was previously assembled by hand every month. Manager dashboards show team-level time distribution, identify patients consuming disproportionate time, and flag coordinators who are consistently underutilizing or over-extending.

Phase 3 — Predictive Scoring and Patient Reassignment

The third phase tackled a hard operational problem: by the time a manager realizes an employee isn't going to hit their monthly care-minute targets, it's often too late to do anything about it. An individual employee scoring system tracks progress against monthly targets on a rolling basis and generates a projected end-of-month coverage estimate. Employees falling behind threshold trigger alerts and surface into a reassignment workflow where managers can temporarily or permanently move patients to another coordinator to protect billing compliance. The platform also integrates with an external Remote Patient Monitoring (RPM) system, exporting enrolled-patient data so care programs stay in sync.

Phase 4 — Multi-Tenant SaaS Conversion

After the internal platform proved its value, partner organizations wanted onto the same infrastructure. The architecture was refactored from a single-tenant internal tool into a fully multi-tenant SaaS: isolated per-tenant data environments (schema-per-tenant PostgreSQL with row-level security), tenant-scoped encryption, invitation-based organization onboarding, and per-tenant role management. A care coordination organization can register, add their employees and patients, and be running the same operational infrastructure independently — without any tenant ever touching another tenant's data.