Healthcare
HIPAA-compliant software development
I build software that holds protected health information, under a signed Business Associate Agreement. Not a generalist who will learn HIPAA on your project. Someone who has already shipped clinical systems and handled the paperwork that comes with them.
What HIPAA actually requires of your software
There is no such thing as a HIPAA-certified developer, or a HIPAA-certified product. Anyone selling you one is telling you something about themselves. What the rule requires is a set of safeguards, and software either implements them or it does not: access control scoped to each user, audit logging of who reached which record, encryption in transit and at rest, automatic session termination, and a defined process for breach notification.
The part most people miss is the boundary. Compliance is not only about the database you built. It is about everywhere the data goes afterwards. Error monitoring, analytics, server logs, backups, third-party APIs. Protected health information leaking into a debugging tool is still a disclosure, and it is the kind nobody notices until an audit.
How I work inside your boundary
The BAA gets signed before I touch anything that holds patient data. Access is least-privilege and scoped per role, so a clinician reaches their own clients and nobody else's. Every read of a patient record is logged. Sessions time out. Credentials are handed back or rotated the day the work ends.
On a live system I built, identifying information is deliberately excluded from third-party error monitoring, accepting thinner debugging data rather than letting PHI leave the boundary through a side door nobody thinks to check. That is the kind of decision that separates software built for healthcare from software that merely runs in it.
When not to hire me
I am not a compliance consultant, a lawyer, or an auditor. I build and secure the software side. If what you need is a risk assessment, policy documentation or staff training, you need a compliance professional, and I will say so rather than take the work.
If you are a very small practice already running a vendor product that mostly fits, the honest answer is usually to fix one narrow thing rather than rebuild. I will tell you that too.
Related work
Behavioral health · 2025 – present
A behavioral health practice
Three production systems for one behavioral health practice over two years: a clinical assessment platform, a full EHR with insurance claims submission, and an in-session data collection tool, all operated under a signed Business Associate Agreement.
Read the case studyHealthcare · 2026
A neurofeedback practice
An intake and progress tracker moved off a third-party stack the client was not comfortable with, and held at pilot until the compliance paperwork catches up.
Read the case studyQuestions
Before you ask
Are you HIPAA certified?
Nobody is. There is no such certification, and any vendor claiming it is telling you something about themselves. What is real: I have signed and worked under a Business Associate Agreement, and I build to the safeguards HIPAA actually requires.
Will you sign a BAA?
Yes, before I touch anything holding PHI. If your legal team has its own template, send it. If you do not have one, that is worth a conversation on its own. You may need one in place with more vendors than you think.
Can you work with the systems we already have?
Usually. Most engagements start by mapping where PHI currently lives and moves before anything is built or changed. That map is worth having whether or not you hire me for the work that follows.
Next step
Tell me what you’re dealing with.