Healthcare software and HIPAA
Software that handles patient data must protect it by design: encryption, audit logging, role-based access and tenant isolation, plus the agreements that go with them. We have built telehealth, clinic operating systems, pathology and clinical-trial platforms, with compliance designed in before the first feature.
Where we do this work
Where it has shipped
- Clinical Trials & Healthcare OperationsA Clinical Research Organization (CRO) & Life Sciences NetworkAdvanced patient recruitment and data management platform for clinical trials, enhancing recruitment velocity, trial scalability, and regulatory compliance.
- Telehealth & Digital HealthA US & UK Telehealth Platform (GLP-1 Space)Multi-tenant clinical operating platform across the US and UK for the GLP-1 surge: synchronous/asynchronous EMR, compliant e-prescribe, automated pharmacy routing, and split-billing with day-zero HIPAA and UK GDPR architecture.38Clinic Tenants
- Executive Healthcare & Clinical OpsAn Executive-Health Clinic GroupTransitioning complex executive-health clinic ops from a fragile low-code stack to an offline-first Next.js PWA with zero downtime, live payment processing, and HIPAA + PCI-DSS compliance.8 DaysProposal to Kickoff
Read more on this
Engineering HIPAA-ready telehealth platforms: the decisions we make first
How tenant isolation, access control, audit logging, identity and vendor agreements shape a HIPAA-ready telehealth system, with what each looked like on three clinical platforms we built.
Telehealth compliance checklist for the US and UK
An engineering checklist for a telehealth platform serving US and UK patients: contracts, access and audit, clinic isolation, licensing by jurisdiction, prescribing, signatures, payments and incidents.
How to build a GLP-1 telehealth platform
A builder's guide to a GLP-1 telehealth platform: compliance, multi-tenant clinics, eligibility checks, licensing by jurisdiction, chart review, pharmacy routing, cold chain and billing.
Terms explained
- HIPAAThe US law that sets rules for protecting patients' health information. Software that handles that data must follow it.
- BAA (business associate agreement)A contract under HIPAA between a healthcare organisation and a vendor that handles patient data for it, setting how that data must be protected.
- GDPRThe EU's data protection law. It needs a lawful basis for using personal data and gives people rights to access and erase it, and it applies to anyone handling EU residents' data.
- RBAC (role-based access control)Giving users permissions according to their role, so people can only see and change what their job requires.
- Audit trailA tamper-resistant record of who did what and when in a system, needed in healthcare, finance and other regulated work.
- Multi-tenant architectureOne application serving many customers while keeping each customer's data separate, usually by schema or row-level rules.
- Asynchronous telehealthCare delivered without a live appointment: the patient completes an intake questionnaire, and a clinician reviews the case and responds later. Video is used only when a case needs it.
- GLP-1 telehealthOnline clinics that prescribe GLP-1 medicines such as semaglutide for weight management, after an intake check and a clinician review, with the medicine supplied by a pharmacy.
- Telehealth KPIsThe numbers a telehealth operator tracks to see whether care is working and the business is healthy, such as encounters per month, time to physician approval, prescription fulfilment time and revenue per encounter.