In production · replacing legacy scheduling
HospitaLists runs the hospitalist call schedule end to end: it drafts the year block by block, checks every change against your group’s own rules, shows each clinician exactly where they stand against everyone who shares their work, and keeps a record of who changed what. Built for a group of around eighty clinicians across twenty-nine service lines, and live every day.
What it does
Twenty-four tabs in all. What any given person may see and change is set per tab, per person.
The month or the week, line by line. Find anyone and the rest of the grid fades back. Reassign, claim, propose a swap or post a giveaway from the cell itself — rules-checked on the way in, with an administrator override that is logged rather than silent.
click and drag to paint a runDraft a year block by block, review it, finesse it slot by slot, sign it off as a version. An algorithm, not a language model — and it never publishes on its own.
pre-flight · draft · sign-offFill one line from a pattern — a rotation through a group of people, or each person’s own days — and look at the result on the grid before any of it is kept.
one line, one patternOpen shifts, giveaways and trades, with an approval trail. People move their own shifts between themselves; the rulebook decides what is allowed, not an inbox.
claim · give away · tradeWho holds each line and how to reach them, the whole day, on a board fit for a workroom wall. And a home page for every clinician: what is mine, what is waiting on me, what I could pick up, and which resident team is on call.
the four questions, one screenYour month, your year and your calendar, paced against your contracted minimum — with an end-of-year goal you set for yourself that changes nothing anyone else is owed.
your year, your paceShifts per person, per line, month by month, over any range you choose: totals, nights, weekends and service mix. Tap a name to see the days behind its number, and export an Excel workbook that opens without a repair prompt.
exports to .xlsxIs the month staffed, and by whom. Every line against every day, with the gaps named and the unanswered configuration that would cause one listed beside them.
gaps, before they are gapsStaffing history line by line and year by year, back to the first archived month in 2016: who carries a line, how often it changes hands, how the roster has moved. Administrators can also ask their own questions in SQL, on a nightly copy that carries initials, never names.
ten years of archiveWhat the schedule must obey, edited as grids rather than written as code: eligibility, conflicts, sequences, rest limits, married lines, blocks and cohorts.
your practice, not oursSeasons grouped for equity, ranked once each by every person, weighed against what they carried in past years — so Christmas is answerable with a history, not a memory.
ranked, carried, relievedRequests to decide and approved days to enter. Time off blocks the days and keeps the target; leave blocks the days and lowers the year’s target in proportion to the days away.
FMLA · parental · medical · sabbaticalThe roster and the lines, each in one place: every person’s contract as dated terms, their cohort and, if they want one, their photo; every line’s hours, days and staffing.
the roster · the linesWrite to everyone, to a group, or to chosen people, or post an announcement at the top of their Today. Everyone it will reach is listed by name first. A message goes by email and to phones with notifications on. An announcement goes the way you choose.
messages · announcementsA page for every tab, in plain words, and picture guides to the everyday jobs that save as a PDF. Ask a question and an assistant answers from those pages and the wording built into the app — it never sees the schedule — and what it cannot answer goes to a person.
answers from Help and How ToReport a problem or suggest a change from a button on every page, and add a screenshot if it helps. What the app adds to help fix it is shown to you first, and never includes the page’s contents or anybody’s name. The reply comes back as a conversation.
screenshot · diagnostics · repliesThe Schedule Builder
The builder maps the work that must be staffed in advance and leaves the human fill to people. Each cohort week is a matching of members against slots at the lowest total cost, where every cost is measured per share of the load — not per shift, and never one service at a time.
It never publishes on its own. A build makes a draft only the Builder tab shows. Signing it off writes it beyond the publish horizon, where schedulers can see it and clinicians cannot. Only the people named on the Admin page may move that horizon — deliberately, and never a machine.
Continuity of care
Some lines are meant to be one person’s week. When a week on one of them is split between people, the Schedule’s Continuity card lists it and looks for a fix: trade the week with a line nobody watches, so everyone works the same days on a different line. See the trade draws both lines before and after, and you trade from there, or not.
Your group marks which lines should be one person’s week. The Continuity card beside the grid lists every week on those lines that changed hands, and only on the lines you may change.
beside the ScheduleThe fix trades which line people work, never which days. Everyone works exactly the days they already had, so a swap two colleagues agreed on is never undone. A trade can be put back in one press.
the line changes, not the dayThe picture shows both lines now and after, and says it in words: how many people the week had and will have, a week the trade would split, a handover that moves off the week line, and anyone it puts ahead of their share.
before you press TradeWorking together
When more than one scheduler has the Schedule open, each sees who else is on it and what they are looking at. A change reaches every other open grid the moment it is saved, with no reload, and nobody can save over a change they never saw.
The pill at the top of the grid shows the faces of the other schedulers and administrators who have the Schedule open. Press it to see which month each is on and which shift they have open. Nobody else is shown.
schedulers and administratorsA shift somebody changes is drawn again on your grid, ringed with their initials for a few seconds, and added to the top of the Activity card. A shift somebody has open wears a dashed ring.
no reloadIf a shift changed after you opened it, your change is not saved. The side panel says who changed it and who has it now, so you decide again with the grid as it is.
refused, never overwrittenTelling the group
Post an announcement from Messages to the whole group, or to the people on certain lines. It sits at the top of Today until it comes down, and it can ask each person to say they read it. Reminders go only to the people who have not.
It goes up now or at an hour you pick, and comes down when you choose. It shows as from the group, from you, or from a name you type, such as Hospital IT. Push it, email it, both or neither.
on Today until it comes downAsk people to say they read it, and each one presses I’ve read it. Its page in Messages shows who has, who has not, and how each was reached.
the count stays in MessagesAdd up to three, each a set number of days or hours before it comes down, by push, email or both. Only the people who have not read it by then get one.
push · email · bothFairness, measured
Most scheduling arguments are arguments about arithmetic nobody can see. This is the arithmetic, on the screen, the same numbers for the clinician asking and the director answering.
Your year, at a glance
My Stats draws the year as it stands: the shifts you have worked, the ones already scheduled, where your contract says you should be today, your minimum and a goal of your own. The same card sits at the top of the Marketplace, so you see your year before you give a shift away or pick one up.
Booked 11 ahead of pace through Nov 30
Solid, then striped. Solid is what you have worked. Striped is what is already on the schedule.
Today’s pace. The dashed line is where your minimum says you should be today. Leave and a contract change move the line, so they never put you behind.
Minimum and goal. The amber tick is what your contract asks for the year. The teal one is a goal you set yourself, and it changes nothing anyone else is owed.
Where the year lands. The short mark under the bar is where the published schedule ends. Past it, faint stripes carry on at your rate so far: a forecast, not a plan.
In the calendar you already use
One button puts your shifts in Google Calendar, Apple Calendar or Outlook. Each calendar app then checks for changes on its own timetable, so My Stats tells you when each one last checked and whether it has your latest shifts.
Google Calendar opens its own page to add your shifts. On an iPhone, iPad or Mac, Calendar asks to subscribe. For Outlook or any other app, the link is copied for you. On a phone the three are buttons of their own.
Google · Apple · OutlookEach calendar app checks your link on its own timetable. The link asks for every hour, but Google Calendar decides for itself, often every few hours and sometimes longer. So My Stats says when each app last checked, whether it has your latest shifts, and how to catch it up.
when each app last checkedAdministrators see every person's link on one page: which calendar apps read it, when each last did, which are behind, and how often each kind of app really checks. A link shows only the months that have been published.
Admin ▸ Calendar linksShifts change hands
The scheduler stops being a switchboard. A clinician who needs a day off posts it; a colleague who wants the work takes it; the rulebook decides whether it may happen, and the record writes itself.
Said they can work this day
An offer assigns nothing by itself. A claim passes exactly the validation an assignment does, so the answer is the same whoever is looking.
The rulebook
Every rule is edited as a grid by the people who run the group, and every rule is checked on every change: a draft from the builder, a swap between two clinicians, an administrator moving a cell by hand.
A rule nobody has configured produces a schedule that looks perfectly clean. It fires, finds nothing, and says nothing — which is indistinguishable from a rule that is working.
So every rule and every configuration column has to declare the check that reports its unanswered inputs, and the app keeps one list of everything nobody has answered yet: a line with no hours, a season in no group, a person with no contract, a requirement never set. The coverage report shows the subset that would leave a gap this month.
A gap is a question still worth asking. The audit reports what somebody can act on now — not next year’s holiday dates in January.
Governance, access and the record
A schedule is a personnel record. It holds contact details, contracts, leave and who was where — so access is decided per person and per page, and enforced where it counts.
One grid: every person against every page, with three answers a cell can hold — block, read, modify — and a line under each page saying what a grant opens. Read shows a banner, offers nothing that writes, and the API refuses every write behind it, because a page that says “read” while the server still saves is a lie with a nice icon.
enforced at the API, not the buttonYour own clinical id and a personal password, hashed and never stored in the clear. A six-digit PIN carries on after an idle timeout and confirms a shift moving. On your own device, Face ID, Touch ID or Windows Hello does both.
passkeys · PIN · one-time sign-in linksWho changed what, when, and from what — including every administrator override. Signed versions make it sharper still: the schedule can always be read back against what was agreed.
every change, every overrideA snapshot every night, kept on the server for two weeks. Each night it is also sent to cloud storage you choose, scrambled on your server before it leaves, so the storage holds nothing it can read. Thirty nights and a year of months are kept, checked after every copy, and Admin shows whether last night arrived. A configuration export restores every column it was able to create, proved on each release by a round trip.
encrypted off-site · checked nightlyIt runs on your own hardware, behind your own tunnel. There is no tenant, no shared database, and no copy anyone else can read. The off-site backup is encrypted before it leaves your server. It holds no patient data of any kind. The Help assistant sends a model only the question and the app's built-in wording: the Help page, the How To guides and the words on its screens. It can use a model inside your own network instead.
self-hosted · no PHIEvery message is written down as a record before it is sent, worded from the rows as they stand at that moment, and voided if the thing it was about changed. Each person picks email, a phone notification or neither, and a tap opens the exact thing it is about. Nothing is delivered until sending is switched on at the server itself.
queued, worded, then deliveredGetting there from here
The hardest part of replacing a call schedule is not the software. It is the month where half the group is looking at the old one. This was built to make that month boring.
Imports your existing schedule month by month — ours came across with ten years of archive behind it — and keeps syncing on a timer, with a local edit always beating the feed. For the days you choose it can match the old schedule exactly, and it takes a snapshot first. A full parallel run costs nobody a second entry.
import · sync · no double entryIt answers in the same report format your old scheduler did, so an aggregator already pulling your schedule into the EHR needs no new parser and no new mapping. The day the old system is switched off is a base-URL change on one stream.
read-only · token-gated · rotatableOne press puts a person's shifts into Google Calendar, Apple Calendar or Outlook, through a private link. Each calendar picks up changes when it next checks, and My Stats says whether it has caught up. A link never shows a month that has not been published.
webcal · per personThe counts workbook is a real .xlsx: frozen panes, number formats, one sheet per view. It is checked on every release by opening the actual file the app produces, the strict way, rather than a fixture that flatters the writer.
.xlsx, verified on each releaseIt installs to the home screen, with the steps for your phone’s browser, and opens without browser chrome, with your daily pages in a bar along the foot. Today, Who is On, the grid, the marketplace and your own year are all built for a phone first, because that is where a shift actually changes hands.
installable · notificationsWho is on, and how to reach them, on a screen anybody in the department can see — opened with a short code of its own rather than a personal sign-in, and printed on one page for the days the screen is not enough.
shared screen · own codeWhat running it takes
There is no cluster, no managed database and no seat count. The whole schedule — roster, rules, history, audit — is a single SQLite file you can copy, back up and read with ordinary tools. Restoring it is putting the file back.
Built for one hospitalist group, in production every day. Every feature on this page exists because a scheduler or a clinician asked for it, used it, and said what was still wrong with it.