Stored XSS in Diagnoses section of patient.page

This xss bug can be exploited when a user clicks on the "Visit Note" link on a patient's page and creates a note with diagnosis: Non-coded <script>alert('xss');</script>.

The injected JS will be executed back on the patient's page in the diagnosis section.