Healthcare
Healthcare Software Development — HIPAA-Compliant Platforms, Patient Apps & Clinical Tools
Healthcare software has a higher correctness bar than almost anything else we ship. We treat compliance, audit logs, and clinician UX as constraints we design around — not features bolted on at the end.
What we hear from Healthcare teams
- Patient apps that bounce because the EHR integration is brittle and PHI flows are unclear
- Clinician workflows requiring 20 clicks for a 5-second decision
- Compliance scope-creep from one well-intentioned feature touching the audit-log requirement
- Telehealth video that fails 5% of the time and your support team handles it manually
- BAA gaps with vendors that nobody noticed until the security questionnaire
- Lab-result integrations that fail silently on edge-case HL7 fields
Regulation & compliance we work with
HIPAA (Privacy, Security, Breach Notification)
HITRUST CSF certification
HL7 v2, FHIR R4 (EHR interoperability)
SOC 2 Type II
FDA SaMD classification (Class I/II) — when the software is a medical device
GDPR (EU patient data)
21 CFR Part 11 (e-signatures in clinical workflows)
State telehealth licensing requirements
What we deliver
Patient-facing iOS + Android apps with telehealth, messaging, appointment booking
Clinician-facing tools: charting helpers, decision support, workflow shells around the EHR
EHR integrations on FHIR R4 (Epic, Cerner/Oracle Health, athenahealth, eClinicalWorks)
HIPAA-compliant infrastructure (encrypted at rest & in transit, audit logs, BAAs in place)
Telehealth platforms with WebRTC fallback paths and recorded-encounter compliance
Remote-patient-monitoring (RPM) data pipelines + reimbursement-ready logging
Clinical-trial software (eConsent, ePRO, eCOA) for sponsor / CRO engagements
FAQ
- Do you sign BAAs?
- Yes — and we expect your subprocessors to as well. Our standard engagement includes a BAA covering PHI we touch in the course of work. We also audit your existing vendor BAAs as part of week-one diligence on healthcare projects, because that's where most of the gaps show up.
- Have you shipped Epic / Cerner integrations?
- We've shipped FHIR R4 integrations against Epic (App Orchard / Showroom), Oracle Health (Cerner), and athenahealth. Bulk-FHIR for population workflows; SMART-on-FHIR for clinician-facing app launches inside the EHR session. The integration timeline depends as much on the customer health system's IT calendar as on our work.
- When does our product become an FDA-regulated medical device (SaMD)?
- When the software's output is intended to drive a clinical decision. The line is the intended use, not the code. We don't render legal opinions, but we'll flag where you're approaching the line and recommend regulatory counsel before features ship. We've built around Class I and Class II SaMD products and know the design-controls overhead.
- Can you work without ever touching PHI?
- Sometimes. De-identification, synthetic data, and well-scoped subprocessor agreements can keep developers out of PHI scope for parts of the product. We design engagement boundaries deliberately — the smaller your PHI surface, the cheaper your compliance program.