AI-Powered Therapist Dashboard

The problem

• Session documentation takes real time away from patient care: one practicing therapist who tested the workflow confirmed this matched her real experience.
• Turning messy, informal session notes into a usable summary and follow-up direction is exactly the kind of repetitive synthesis work an LLM can help with, if it’s built carefully around a sensitive domain.

The approach

• Built as a serverless pipeline: a React frontend calls three separate Lambda functions behind API Gateway, one to list patient summaries, one to save or update a session summary, and one that sends session notes to Claude (via Bedrock) and returns a draft observation.
• The Bedrock prompt is deliberately scoped: it explicitly frames the output as "gentle," "supportive," and "professional" draft observations about patient progress and next steps, LLM-generated draft observations for therapist review, not diagnoses, treatment recommendations, or clinical decisions.
• The prototype stored its synthetic session records in DynamoDB rather than persisting them in client-side browser state.

What broke (and how it got fixed)

• No authentication was implemented on any of the three Lambda endpoints, confirmed directly in the code and in template.yaml, which has no Cognito authorizer, API key, or request validation configured at all. Anyone with the API Gateway URL could have read or written the synthetic records stored by the prototype. The test used synthetic patient data throughout for exactly this reason: a real lesson from a first hackathon, not a deliberate tradeoff.
• Each Lambda function was granted AmazonDynamoDBFullAccess and AmazonBedrockFullAccess, broad, account-wide managed policies, rather than permissions scoped to just the one patients table and the one Bedrock model actually in use.
• CORS was left fully open (Access-Control-Allow-Origin: '*') rather than restricted to the actual frontend origin, and getting CORS working cleanly between a Render-hosted frontend and API Gateway took longer than expected. AWS Bedrock’s documentation for calling Claude was sparse enough that reaching a working request shape took real trial and error.

Outcome

• One practicing therapist tested the workflow using synthetic session notes, confirmed that documentation burden was a real problem, and expressed interest in a secured version.
• The full pipeline works end to end on serverless infrastructure with no servers to manage: notes in, a Claude-generated draft observation and a saved, retrievable summary out.

Stack

Honest scope

Built and tested with synthetic data only. This hackathon prototype was not designed, reviewed, or approved for handling protected health information. Authentication, authorization, least-privilege IAM, restricted CORS, audit controls, and formal compliance work would be required before any use with real patient data.