Duplicate phone number created when using Edit Command

[zenn345]

When I use edit 8 p/98771234, I am able to create 2 person with the same phone number.

[soc-pe-bot]

[IMPORTANT!: Please do not edit or reply to this comment using the GitHub UI. You can respond to it using CATcher during the next phase of the PE]

Team's Response

This is an intentional design choice when using the edit command, our add command supports the same scenario as we do allow duplicate phone numbers.

Mental health issues are very common among kids, teenagers, who might be too young to own a phone. Also given that they have mental health issues, their parents might not trust them with a phone, they might not even have the freedom to come for sessions on their own, which means their parents or guardian will accompany them for visits.

As such, if multiple children in the family come for sessions often, their phone numbers will be recorded as the same parent’s phone number, so it is completely valid for multiple patients to have the same phone number.

This flexibility is provided in both the add and edit commands to ensure that patient records can still accurately reflect situations where multiple patients share the same contact information.

This may seem like a functionality issue at first glance but let me assure you that this is indeed an intentional decision that we have considered based on the diverse requirements of our user base.

Items for the Tester to Verify

❓ Issue response

Team chose [response.Rejected]

• I disagree

Reason for disagreement: I understand and appreciate the rationale provided — especially in contexts involving minors and shared guardianship, where using the same phone number for multiple patients can be realistic.

However, I believe the current implementation still poses a few important concerns:

1. Privacy and Confidentiality Risks
   In mental healthcare, especially with youths, sessions are expected to be confidential between the patient and their healthcare provider. Allowing duplicate contact numbers increases the risk of sensitive information being misdirected, e.g., appointment reminders, progress notes, or reports might accidentally be sent to the wrong individual sharing that contact.
   For example, if two siblings share a number but one receives communication about the other, it compromises privacy, which can be a serious concern under healthcare privacy standards.

2. Data Integrity
   Contact numbers are commonly used as identifiers for lookup or communication purposes. If multiple patients share a number, it becomes especially problematic as it allows the user to unintentionally duplicate data, which may degrade the quality and reliability of patient records over time.

Hence, I would still consider this a Medium-severity design flaw, not due to app-breaking behavior, but because of silent data duplication risks and potential privacy violations, which are especially significant in a mental health app.

---

❓ Issue severity

Team chose [severity.Low]
Originally [severity.High]

• I disagree

Reason for disagreement: I’d like to contest the severity downgrade from High to Low and suggest a more balanced classification of Medium.

While I acknowledge that allowing shared phone numbers is an intentional design to accommodate families with shared contact points, the lack of safeguards (e.g. a confirmation or warning prompt) introduces a risk of silent data duplication and privacy breaches.

Especially in the context of mental health, where confidentiality is critical, the ability to change a unique piece of patient contact information without checks can cause:

• Miscommunication or mistaken identity.
• Loss of accountability over edit actions.

This doesn't make the application non-functional, but the risk and impact are significant enough that a Low severity rating does not accurately reflect the potential harm.

Hence, I believe Medium is a fair classification — recognising that it’s a design choice, while also acknowledging the implications it can have in real-world usage.

---