Healthcare software development
Healthcare software built around HIPAA safeguards from day one
We build patient-facing apps, clinic tools and AI features for healthcare companies with the technical safeguards HIPAA expects designed in — not retrofitted before an audit. We are clear about what software can and cannot do for compliance.
There is no such thing as "HIPAA-certified" software
HIPAA compliance belongs to organisations, not code. What software can do is implement the technical safeguards the Security Rule describes — access control, audit controls, integrity, authentication and transmission security — and make it easy for your organisation to run compliant processes on top.
The common failures are architectural: protected health information (PHI) copied into logs, analytics or error trackers; vendors in the data path without a business associate agreement (BAA); and, increasingly, PHI pasted into AI services that never agreed to handle it. We design to keep PHI where it belongs.
Safeguards we design in
Know where PHI lives
A data-flow map of every place PHI is stored, processed or transmitted, so every vendor in that path is one that will sign a BAA.
Access control and minimum necessary
Role-based access enforced in the database, so each user sees only the records their role requires.
Audit logging
Who viewed or changed which record, when — stored separately and protected from tampering.
Encryption
Encryption in transit everywhere and at rest for databases, files and backups, with keys managed by the cloud provider.
PHI-free telemetry
Logs, analytics and error tracking are scrubbed of PHI, because these tools are often outside the BAA boundary.
AI without leaking PHI
LLM features either never receive PHI or use endpoints covered by a BAA, with de-identification where the task allows.
What we build
Patient portals and apps
Appointments, intake forms, messaging and records access on web and mobile.
Clinic and practice tools
Scheduling, internal dashboards and workflow tools for care teams and administrators.
Telehealth features
Video visit booking and flows built on vendors that offer BAAs.
AI features for healthcare teams
Document summarisation, intake triage and knowledge assistants designed so PHI handling stays within BAA-covered services.
Deployment and vendor considerations
BAA-covered infrastructure
Hosting, databases, storage, email and AI providers chosen from vendors that sign BAAs for the services you use.
Environments without real PHI
Development and staging use synthetic data; production access is limited and logged.
Integrations
Integrations with EHR/EMR systems depend on what each vendor exposes (for example FHIR APIs); we scope them per system.
Medical device software
Software that is regulated as a medical device has additional regulatory requirements. We can build supporting applications, but regulatory strategy must come from specialists.
How we work on healthcare projects
- 1
Map data and vendors first
Before features, we agree what PHI the product touches and which vendors are allowed near it.
- 2
Design safeguards into the architecture
Access control, audit logging and encryption are part of the data model, not a later hardening sprint.
- 3
Build with your compliance owner
Your privacy or compliance lead reviews data flows and decisions as we go.
- 4
Document for audits
Architecture and data-flow documentation your organisation can use in its own risk assessments.
Technology we use
Application
- React
- Next.js
- React Native
- Node.js
- Python / FastAPI
Data & security
- PostgreSQL
- Row-level security
- Audit logging
- Encryption at rest and in transit
AI
- BAA-covered LLM endpoints
- De-identification
- Retrieval-augmented generation
Who this is for
- Digital health startups building their first patient-facing product.
- Clinics and practices that need internal tools their off-the-shelf systems lack.
- Healthcare companies adding AI features without exposing PHI.
- Teams preparing an existing app for enterprise healthcare customers.
Related services
Healthcare Software Development: common questions
Tell us about your healthcare product
Tell us what you are building or what needs fixing. You will hear back from an engineer — not a sales rep — within one business day, usually with questions or a rough approach.
Your enquiry goes straight to our engineering team — the people who will scope and build your project, not a sales desk.