Clinical System Rescue · 2026
A neurofeedback practice
An intake and progress tracker moved off a third-party stack the client was not comfortable with, and held at pilot until the compliance paperwork catches up.
- app, one deploy, one owner
- 1app, one deploy, one owner
- third-party processors holding her data
- 0third-party processors holding her data
- held until a BAA is in place
- Pilotheld until a BAA is in place
What I walked into
A small neurofeedback practice needed a client intake and progress tracker: patients self-register, complete a symptom intake, get a scorecard, and retake it over time so the provider can see whether treatment is working.
The original plan put all of that on a managed third-party backend. The practice owner was not comfortable with patient information sitting there and asked whether it was compliant. It was a fair question, and the honest answer was that the arrangement she had did not cover it.
What I did about it
I moved the whole thing onto infrastructure the practice controls: a single Node and Express application serving both the API and the front end, backed by Postgres, with authentication built in-house rather than delegated: JWTs and bcrypt, provider access gated separately from client access. Schema changes run as tracked migrations on every deploy, so the database state is never a mystery.
On top of that: symptom scorecards, PDF reports, and a baseline-versus-latest progress chart that only appears once a client has retaken the intake, because a progress chart drawn from one data point is a lie.
The part worth reading, though, is what I told her rather than what I built. Moving the data onto her own infrastructure improved her position but did not make her HIPAA compliant on its own. That needs a Business Associate Agreement and a compliant data platform underneath it. So the system is documented and running as a pilot, explicitly not holding real regulated patient information, until that paperwork exists.
It would have been easier and more profitable to call the migration "HIPAA compliant" and move on. Plenty of developers do. She would not have known the difference until it mattered, and by then it would have been her problem, not mine.
Next case study
A behavioral health practice