Allow specialty doctors to open patient charts and order labs.

Branch-scoped staff could 404 on charts when the patient's home branch differed from the visit site; Orders also linked doctors to a lab index they could not access.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/PatientController.php

@@ -4,7 +4,9 @@ namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Models\Appointment;
 use App\Models\Patient;
+use App\Models\Visit;
 use App\Services\Care\CarePermissions;
 use App\Services\Care\OrganizationResolver;
 use App\Services\Care\PatientService;
@@ -89,9 +91,22 @@ class PatientController extends Controller
         abort_unless($patient->organization_id === $this->organization($request)->id, 404);
 
         $branchScope = app(OrganizationResolver::class)->branchScope($this->member($request));
-        if ($branchScope !== null && $patient->branch_id !== $branchScope) {
-            abort(404);
+        if ($branchScope === null || $patient->branch_id === $branchScope) {
+            return;
         }
+
+        $hasLocalActivity = Visit::query()
+            ->where('patient_id', $patient->id)
+            ->where('organization_id', $patient->organization_id)
+            ->where('branch_id', $branchScope)
+            ->exists()
+            || Appointment::query()
+                ->where('patient_id', $patient->id)
+                ->where('organization_id', $patient->organization_id)
+                ->where('branch_id', $branchScope)
+                ->exists();
+
+        abort_unless($hasLocalActivity, 404);
     }
 
     /**