DDM makes the invisible visible.
What you have. How it connects. What breaks if it's compromised.

Click anything. Know everything.

The interactive diagram organizes every application by patient-care phase — Pre-Registration through Post-Discharge — with a separate grid for infrastructure and support systems. Click any application, contract, project, hardware profile, person, team, or site to open a full detail sidebar.

• Drill into scrollable field lists with working back-navigation
• Data flows shown as a searchable, filterable list connecting source and target applications
• Retired applications hidden by default, revealable with one toggle — search surfaces them automatically if a match is retired
• Collapse to search-only mode for CIOs who prefer typing over browsing

One search bar. Every category, simultaneously.

A single query covers applications, data flows, contracts, projects, entities, hardware profiles, phases, data fields, project documents, departments, workflows, personnel, teams, vendors, certificates, and sites — each rendering as its own labeled results category.

Results are fully cross-referenced: a matched contract, project, or site lights up every application it touches on the diagram, not just what's directly tagged.

The blast radius answer — instantly.

Trace any patient data field (SSN, MRN, Guarantor, Date of Birth, etc.) to every application and data flow that touches it. This is the definitive answer to: "what's exposed if this is compromised?"

Core fields aren't a guess at what matters — they're grounded in the identifier categories HIPAA's Safe Harbor de-identification method defines (45 CFR §164.514(b)(2)), reviewed against what your systems actually capture.

• Core Categories — a HIPAA Safe Harbor–grounded bundle (45 CFR §164.514(b)(2)) of identifier fields, inherited by an application in one click instead of tagging dozens of fields individually
• Per-application exceptions for the rare case a Core app is missing one field — accuracy is never sacrificed for speed
• Every result honestly distinguishes "directly tagged" from "inherited via Core", with the legal citation shown inline

What goes down if the data center does?

DDM™ now maps where everything runs — data centers, hospitals, clinics, and cloud or hosted environments. Hardware sits at a site, applications run on that hardware, and DDM connects the chain. Every site opens with an "Impact If Unavailable" summary: how many applications depend on it, how many handle patient data, and how much hardware is there.

• Start simple, add detail later — begin at the site level; network segments, firewalls, storage, and clusters can be nested underneath whenever your network team is ready, with no change to DDM itself
• Hosted and cloud applications link straight to their site when there's no hardware of your own to point to
• Outage tracing — follow a site to its hardware, applications, data flows, contracts, and the support teams to call
• Restricted from day one — a map of your infrastructure is sensitive, so sites can be locked down exactly like restricted contracts

The answer, wherever the question comes up.

Outages don't wait for you to get back to your desk. On a phone, DDM™ becomes a focused lookup app — search, results, and full-screen records with a Back button — and installs to the home screen like a native app, with no App Store involved.

• Tap to call or email the right person or vendor straight from the record, extensions included
• Filters sit above the results, and every record opens full-screen
• The desktop experience is unchanged — one platform, both screens

Everything your IT organization tracks, in one repository.

DDM™ is not just a diagram — it's a full asset and relationship registry for the entire organization.

• Entities — track which health system(s) own an application, critical during mergers and acquisitions
• Departments — sub-units of an entity (e.g., "Orthopedics" under Riverwell); scoped per-entity so a widely-used app doesn't produce an unmanageable wall of checkboxes
• Personnel & Teams — real people and real teams, not typed-in names; every Application Manager, Project Manager, Owner Team, Project Team, and Assigned Tech links to one, so "who do I call about this" always has a real answer
• Owner Teams and Support Teams — kept apart on purpose: the business side that owns an application, and the IT teams who keep it running — on applications, hardware, and sites alike
• Time commitments — each person's share of time on every team, with team and project capacity totals and a clear warning when someone is over-allocated; support time and project time side by side, so "run" versus "change" is never a guess
• Vendors — one real record per vendor, with contact and escalation info, linked directly from Contracts and Applications — no more vendor names quietly drifting out of sync across the platform
• Contracts — linked to a real Vendor record, with typed classifications (BAA, License, Maintenance & Support, Implementation/Consulting, MSA, and more), PDF attachment, a Restricted flag for sensitive agreements, and links to every application, project, or hardware profile each contract covers
• Certificates — SSL/TLS and other certificate expirations, linked to an application or a piece of hardware, tracked the same way contract renewals are, so nothing lapses silently
• Projects — full lifecycle tracking: type, PM, budget vs. actual with live variance, status, linked applications and contracts, plus a Documents & Links section (Epic Userweb articles, specs) labeled Internal or External
• Hardware Profiles — status, warranty, the site it sits at, an Owner Team, Support Teams, and an Assigned Tech — tracked alongside applications with the same contract and project linkage
• Sites — data centers, hospitals, clinics, and hosted environments, each with its entity, provider, owner, support teams, and everything that runs there
• Workflows — upload the actual Visio diagrams, spreadsheets, or PDFs that document how an application really operates, attached directly to that application
• Attributes — flexible custom fields (text, number, boolean, date) for applications, data flows, hardware profiles, personnel, and sites — compliance flags, vendor details, or anything else, organized into categories

Real roles. Real boundaries.

Four roles — Administrator, Senior Admin, Manager, and Analyst — each with genuine, enforced boundaries, not just a label. Records marked Restricted — contracts and sites — are invisible to anyone without access: not just hidden, but undiscoverable — no confirmation a restricted record even exists — enforced consistently across the web app, search, and DDM Plus.

GeekAudit™ — know exactly how DDM is being used.

A real-time, attributable activity log that shows your team exactly how DDM is being used — searches, record views, and results, timestamped and tied to a real account. Full transparency, zero guesswork.