Patient data has rules. We follow them.
A model will happily write you a patient portal that logs full medical records to the console. Healthcare software has obligations that no prompt mentions.
What usually breaks.
PHI in the logs
Patient names, diagnoses, and identifiers written to application logs, error trackers and analytics. None of those is somewhere people think of as a database.
Consent as a checkbox
One boolean, no record of what was agreed to or when, and no way to withdraw it. That is not consent, and it will not survive review.
Everyone can see everything
One role, or none. A receptionist and a consultant reach the same records because access control was never modelled.
What we'd do about it.
Security Hardening
PHI scrubbed from logs and error reports, encryption at rest and in transit, role-based access, and access logging that answers who read this record.
Bug Fixing & Code Rescue
Proper HL7 and FHIR handling instead of hand-rolled parsing, and consent modelled as a record with history rather than a flag.
QA & Testing
Tests that specifically try to reach another patient's data, because that is the failure that ends the product.
Fair things to ask.
Do you understand HIPAA?
We build to it: PHI kept out of logs and error trackers, encryption at rest and in transit, access logging, role separation. We're engineers, not your compliance officer.
Will you see patient data?
We work against anonymised or synthetic data wherever possible. If real data is unavoidable, we sign whatever you need first.
Can you do HL7 or FHIR properly?
Yes, with a real library rather than the hand-rolled parsing we usually find.
Our consent is a single checkbox.
Then it isn't consent. It needs a record of what was agreed, when, and a way to withdraw it.
What about data protection rules where we operate?
Tell us which regime applies and we build to it. We won't guess at your jurisdiction.
Do you work with hospitals directly?
We work with whoever owns the software. If that's a hospital IT team, we'll work alongside them.
Is video consultation in scope?
We integrate an established provider. Nobody should be building a video stack from scratch for this.
Can you help us pass a security review?
We can make the software defensible and hand you the evidence. We can't sit the review for you.
Working on something in Healthcare?
Send us the repo. We'll tell you what's wrong with it before you commit to anything.
Start a handoff