National Jewish Health

Seven staffing areas ran their schedules on paper, and building each one by hand cost every manager hours a week.

The float pool's schedule lived on one physical sheet of paper, then on one shared spreadsheet anyone with the link could edit, including rows already final. There was no reliable record of who changed what: version history names a Google account, not a person. A desktop grid, read on a phone, took hours to build and more hours to reconcile.

The seven-area rollout automated the arithmetic and the layout: formulas that build the grid, not the judgment of who works which shift. That call stayed with each manager.

The float pool went further because its availability can change after a shift is already booked against it. The system flags that case for a person to look at again; it does not resolve it. There is no model in this product. Whether a flagged shift gets reassigned is still a scheduler's call, made by reading the flag.

Staff hold a personal link with a private token checked on every call, so a person can only ever see and edit their own row; an admin can rotate a leaked link in one tap. Every write is timestamped and logged to an append-only audit trail.

The Google Sheet stays the database and the fallback: readable, printable, and editable without the app, with a private emergency workbook refreshed every hour if the app itself is down. A tested three-way merge tool exists to fold emergency edits back in, and is deliberately held back until it is actually needed.

Rules

• Every server function re-checks the caller's token; there are no passwords or accounts
• Maintenance functions (backup, migration, link listing) require a signed-in operator identity, not just a valid staff link
• The scheduler stores a display name and free-text availability only: no patient data, no clinical information, no staff contact details

Evals

• 236 tests, 13 files, run on every push: API contract, authorization rules, a static-markup scan

The seven-area workbook rollout is in use: cloud, formula-driven sheets replaced paper across all seven areas, each manager got several hours of administrative work back a week, and staff got real flexibility in how shifts get filled.

The float-pool scheduler is built, deployed, and live at njfloatpool.org, and is currently in the hospital's IT security review before use with hospital data. Separately, I have trained colleagues at NJH on using AI tools, and I mainly use AI to improve my own workflows, on non-patient work only; no patient data goes into any AI tool.

I wrote the spec and reviewed every change; an AI coding agent wrote most of the code: 56 of the repository's 70 commits carry an AI co-author. Since July 31, 2026, every push to main has run the test suite (236 tests today) in CI. Deployment is a deliberate, human-run two-step: push the code, then cut a new version on the existing stable deployment so no staff link changes.