Morning Timothy,
Regarding permissions and roles, I would recommend implementing via user roles and then rendering the relevant parts of the page conditionally to the current user's roles.
a. Add a custom migration with the role(s) you need [1]
b. make relevant e.g. patient lists or menu items visible based on these roles [2]
c. potentially also render parts of templates differently. We tend to do this with a context processor [3] [4]
Regarding recording payments and / or stock management, it really depends on the more detailed requirements!
As very speculative reckons, I wouldn't be surprised if Stock management turned out to be a different 'app' in many ways to the medical record. It's a different class of problem. Perhaps there's an interaction if you're doing electronic prescribing and running a pharmacy - but depends a lot on details.
Payments, you need to understand the user journey's and patient flow through the service before you can really start designing how the information gets recorded.
HTH
David