Back to Case Studies

Healthcare · HIPAA Compliance

HIPAA-Compliant Patient Portal

A multi-provider medical practice in greater Boston had no patient-facing digital experience. Scheduling happened entirely by phone. Intake was paper, re-keyed by hand into the EHR. We built a HIPAA-compliant portal that changed both — and kept the practice's existing systems in place.

40%
Less admin overhead
50%
Fewer no-shows
HIPAA
Aligned architecture
< 60 days
To full launch

The Problem

The practice had five providers across two locations and saw roughly 150 patients per week. Administrative staff spent a significant portion of each day on the phone: scheduling appointments, answering questions that a patient portal would have answered automatically, and calling patients to remind them about upcoming visits. No-show rates were running near 22%.

Paper intake forms meant that patient information had to be manually re-keyed into the EHR at check-in — a slow, error-prone process that delayed room turnover during busy mornings. The practice's EHR vendor had a patient portal option, but it required migrating to a new platform version that would have disrupted clinical workflows and cost substantially more than a purpose-built solution.

The compliance requirement was non-negotiable: any system handling patient health information needed to meet HIPAA's technical safeguards — encryption, access controls, audit logging, and a Business Associate Agreement with every vendor in the data path.

Architecture

The backend is a Python/Django application deployed on AWS within an isolated VPC. The database is Amazon RDS for PostgreSQL with encryption at rest (AES-256) and automated snapshots. All data in transit uses TLS 1.2+. AWS CloudTrail and CloudWatch Logs capture AWS infrastructure and service activity. Separate application-level audit logs record who viewed, created, modified, exported, or disclosed patient information — including the affected record, the action, and the timestamp — which is the layer HIPAA's audit requirement actually depends on.

The patient-facing application is built in React Native, available on iOS and Android. It handles scheduling, digital intake forms, secure messaging with the care team, and appointment reminders. On the provider side, a React web dashboard gives staff a view of upcoming appointments, outstanding intake responses, and message queues.

EHR integration uses HL7/FHIR endpoints to pull provider schedules and push appointment data back — keeping the EHR as the system of record for clinical data. We signed a Business Associate Agreement with AWS, established data retention policies per HIPAA requirements, and documented the full security architecture for the practice's compliance review.

Technologies

Python Django React Native AWS VPC Amazon RDS AWS CloudTrail AWS WAF HL7 / FHIR PostgreSQL iOS & Android

Business Impact

  • 40% reduction in administrative overhead — the bulk of the scheduling and reminder workload shifted to the system, freeing staff for clinical support.
  • 50% fewer missed appointments within 90 days of launch, driven primarily by automated SMS and push reminders.
  • Technical safeguards, vendor BAAs, access controls, encryption, and audit procedures were documented to support the practice's HIPAA compliance program.
  • Check-in time reduced from an average of 9 minutes to under 3 — digital intake forms were completed before arrival.
  • The EHR remained untouched — no migration, no clinical workflow disruption.

For more on how the compliance side of a project like this actually works — vendor BAAs, encryption, and separating PHI from everything else — see the companion write-up.