HIPAA-compliant telemedicine platform shipped in 16 weeks
Engagement
16 weeks
Team
1 tech lead, 4 engineers, 1 designer, 1 compliance lead
Industry
Healthcare
Stage
Enterprise
The numbers that mattered to the client.
What we walked into.
The client — a regional healthcare network with 12 hospitals — needed to scale telemedicine from a 2-hospital pilot to a network-wide rollout. The pilot was built on a third-party SaaS that didn't meet HIPAA BAA requirements and couldn't integrate with the network's EHR (Epic).
The build-vs-buy decision was complex: existing telemedicine SaaS vendors didn't meet compliance or integration needs. Custom build was the only path — but the timeline was 16 weeks before the pilot contract expired.
What we built.
We built a custom telemedicine platform with four pillars: scheduling (CalendarCore, our internal scheduling engine), video visits (WebRTC with Twilio as fallback), AI-assisted clinical notes (Whisper for transcription, GPT-4 for SOAP note structuring), and bidirectional EHR integration (FHIR API to Epic).
HIPAA compliance was built into the SDLC from sprint zero: PHI encryption at rest (AES-256) and in transit (TLS 1.3), audit logging of every PHI access, role-based access with quarterly access reviews, BAA signed with every sub-processor (AWS, Twilio, OpenAI).
We brought the compliance lead into the daily standup from day one. Every PR that touched PHI got a compliance review before merge. This sounds heavy — it added 4 hours per PR, not 4 days.
Tech stack
What changed for the client.
- Launched on schedule with 12 providers and 4 specialties
- 0 PHI incidents in 18 months of production (audited quarterly)
- Average visit duration down 22% due to AI-assisted notes
- 99.99% uptime SLA met in every month since launch
“They hit a 16-week deadline that two other firms said was impossible. Compliance was treated as an engineering problem, not a separate workstream.”
CMIO
Regional healthcare network
Want results like these?
Book a free 30-minute consultation. We'll review your situation and propose a small first milestone — same playbook as the case studies above.