Building HIPAA-Compliant Healthcare Software: Lessons from PSI Nest

The Challenge

PSI Nest started as a straightforward request: build a practice management system for mental health professionals. But healthcare software is never straightforward. HIPAA compliance adds requirements that touch every layer of the stack, from database encryption to audit logging to access controls. Getting it wrong means fines up to $1.5 million per violation category.

Architecture for Compliance

The stack is NestJS with TypeScript on the backend, React on the frontend, and Neon DB (PostgreSQL) for storage. We deployed on Coolify, a self-hosted platform that gives us full control over the infrastructure, which is essential for HIPAA compliance since you need to sign a Business Associate Agreement with every service that touches PHI (Protected Health Information).

Encryption at Every Layer

All data is encrypted at rest using AES-256 in the database. All data in transit uses TLS 1.3. But HIPAA requires more than basic encryption. Specific PHI fields like patient names, diagnoses, and treatment notes use application-level encryption with rotating keys. Even if someone gains database access, the raw data is unreadable without the application keys.

Access Controls and RBAC

We implemented role-based access control with four roles: practice owner, clinician, front desk, and billing. Each role has granular permissions. A front desk staff member can view appointment schedules but cannot access clinical notes. A billing staff member can see procedure codes but not treatment details. Every permission check happens server-side, never in the client.

Audit Logging

HIPAA requires a complete audit trail of who accessed what PHI and when. We built an immutable audit log that captures every read, write, and delete operation on PHI. The logs are stored in a separate database with write-only access from the application. They include the user, timestamp, action, resource, and the IP address. These logs are retained for six years per HIPAA requirements.

Clinical Workflow Design

Beyond compliance, the system needed to actually improve clinical workflows. We built an appointment scheduler with automated reminders, a patient portal for intake forms and secure messaging, a clinical notes system with templates for common assessment types, and an integrated billing module that generates CMS-1500 claims.

The key insight was involving clinicians in every design decision. Software that is technically compliant but hard to use will be worked around, and workarounds create security gaps.

Results

PSI Nest launched in 12 weeks and passed an independent HIPAA security assessment. The practice reduced administrative time by 40% and eliminated paper-based processes entirely. Patient satisfaction improved because intake and scheduling moved online.

Healthcare software requires a different mindset than typical web development. Security is not a feature; it is the foundation everything else builds on. Have a healthcare project? Let us talk.