A clinical product has to fit how care is actually delivered, and it has to prove its handling of patient data. Both are design problems before they are engineering problems.
Health services products carry two constraints most software does not. The first is that the workflow already exists: clinicians have a way of working, usually under time pressure, and a product that adds steps will be abandoned regardless of how well it is built.
The second is evidence. HIPAA is not a feature you add. It is a set of claims about access control, audit trails, encryption, and business associate obligations that you have to be able to demonstrate. That is easier to build in than to retrofit, and considerably cheaper.
There is a third constraint that gets missed. A health organization is not one audience. Patients, clinicians, front-desk staff, billers and administrators all touch the same records with different goals and different tolerance for friction. A product built for the average of those five fits none of them.
We build patient-facing and clinician-facing products on HIPAA-ready infrastructure, with the compliance evidence produced as the work happens rather than reconstructed before an audit.
Nine things we are asked for repeatedly in this segment. Each one is a build with an integration surface, not a feature toggle.
Apps that patients will actually use between appointments, not just at them.
Built around an existing workflow rather than replacing it.
Practice management and records systems, with drift detection.
Controls and documentation produced during the build.
Wearables and connected devices, sized for rollout volume rather than pilot volume.
Medical billing, payment capture, and the reconciliation behind both.
Scheduling, staff management, and the administrative load nobody budgets for.
Instrumented so clinical and product teams see the same numbers.
WCAG conformance, which in health is frequently a procurement gate.
Two builds in this segment, and the part of each that is publicly verifiable.
Fashioned Health runs on HIPAA-compliant infrastructure with Stripe handling PCI-compliant payments, and it was built that way from the first commit rather than corrected before launch. Founder Thomas Caraballo's aim was to reduce unequal access to care, which meant clinical information had to be legible to people without clinical training.
Luna's problem was different. Outpatient physical therapy was losing people at both ends, with more than 50% of therapists reporting work-related pain and 70% of patients not completing their course of care. The obstacles were logistical rather than clinical, which is why the answer was a phone.
The sequence matters more here than in most segments, because two of these steps are cheap now and expensive later.
Step 01
We watch how the work is done before we design anything, including the parts nobody documents: the sticky note on the monitor, the second system somebody keeps open, the step that is skipped when the clinic runs late. That is where adoption is won or lost.
Step 02
Which data is protected health information, which vendors touch it, who signs the business associate agreement, and how much of the regulated footprint can be engineered away. Cheapest possible moment to ask.
Step 03
Designed against the observed workflow rather than against a category convention. Patients and clinicians get separate surfaces, because a shared one means one of them is using somebody else's product.
Step 04
Scale decisions get made once. Connected devices and monitoring produce data volumes that look trivial at pilot size and structural at rollout, so the shape is chosen before the first patient, not after the thousandth.
Step 05
Delivered by an AI Pod against a committed scope, with a working end-to-end product loop in the first phase rather than a foundation you cannot demonstrate to a clinical stakeholder.
Step 06
Testing runs through the build rather than at the end of it, and the compliance evidence is produced as the controls are written. Reconstructed evidence is how audits go badly.
The build itself is priced in story points before work begins. See how that works.
Early-stage health companies are usually racing a funding milestone or a competitor, and the compliance work is the part that gets deferred until it cannot be. We scope it alongside the product so the first enterprise security review does not become a rebuild. Where the idea still needs proving, an MVP with a real clinical loop is a better fundraising asset than a deck.
Payers, pharmaceutical companies and hospital groups rarely have one system of record. They have several that disagree, plus procurement, security review and accessibility gates the product has to clear before anyone uses it. We inventory what is genuinely load-bearing before quoting, because that inventory is the estimate.
Practices handle a large volume of records with a small margin for administrative overhead. Patient portals move booking, records access and treatment plans off the front desk, and Health Information Exchange standards govern what happens when those records move to another authorized provider. Off-the-shelf gets most practices most of the way. Custom is for the part it does not reach.
A stalled clinical build is usually not stalled for the reason its owner thinks. Before you write off the investment, we run a technical and clinical assessment against the actual failure: adoption, integration drift, performance, or a compliance gap discovered late. Sometimes the answer is a rebuild. Often it is not, and knowing which is worth the assessment on its own.
Product planning sits inside all four rather than beside them. Roadmaps, opportunity analysis and market framing are part of the same engagement, because a health product that is aligned to the technology and not to the operation gets built correctly and used by nobody.
Modern care runs on stored data. Records, imaging, monitoring streams, and increasingly the analytics built on top of them to improve treatment plans. All of it sits inside the Privacy Rule, the Security Rule and the Breach Notification Rule, and the enforcement is real.
The distinction that matters is that HIPAA compliance is an organizational state, not a software property. Your policies, your training and your business associate agreements are part of it, and no development partner can hand you the whole thing. What is ours to do is make the product's handling of protected health information defensible, and produce the evidence behind that.
There is also no HIPAA certification scheme. Anyone selling you HIPAA certification is selling something that does not exist. We build the controls, produce the documentation, and provide a written attestation on completion. Your counsel or your auditor owns the sign-off, because a self-assessment is not evidence.
In this sector the consequence of getting security wrong is not a fine and an apology. That is why it is scoped first and why we would rather shrink the regulated footprint than defend a larger one.
What lands on your side
Clinical software rarely fails on the build. It fails on adoption, and the causes are consistent enough to design against before a line is written.
Patient-facing and clinician-facing builds are delivered by AI Pods against a committed scope, estimated in story points and priced before work begins. The estimate is built from the integration surface and the workflow observation, not from a screen count.
Compliance work sits outside that. HIPAA attestation and audit support are scoped as a retainer or a fixed fee, because the deliverable is an opinion rather than a feature. When a build and a compliance engagement run together, they are two lines on two bases, and we state them separately.
Third-party attestations, which are the only kind worth listing. Our development unit is appraised at CMMI-DEV/3.
Two builds, and the two capabilities a health product leans on hardest.
Case study: in-home physical therapy, three months from concept to market
Case study: a HIPAA-compliant telehealth product with compliance built in, not retrofitted
The capability this segment leans on most, ending in a written attestation rather than a certificate that does not exist
Where the workflow observation actually happens, before a clinician is asked to change how they work
In 30 minutes, we will show you what a Pod would ship first and how we would price it.
