Healthcare Software Development

HIPAA doesn't certify individuals — it certifies processes and infrastructure. In practice that means AES-256 encryption at rest, TLS in transit, immutable audit logs, role-based access with minimum-necessary scope, session controls, and deployment on HIPAA-eligible infrastructure with signed BAAs. It's architecture, not a checkbox, which is why it has to exist from the first line of code rather than being retrofitted before an audit.

HL7 v2 for the message feeds most hospital systems still speak — ADT, ORU, ORM — typically through Mirth Connect channels, and FHIR R4 APIs for modern EHR integration. OpenConnect applies exactly this: an HL7 gateway carrying 10,000+ clinical messages a day from 200+ hospital monitors into downstream clinical systems at 99% delivery.

Yes — that is what OpenConnect does for Fukuda Denshi USA's HealthMosaic ecosystem. Device telemetry is ingested, normalized to HL7, queued for reliability, and delivered downstream. It eliminated 95% of manual vitals entry, with estimated savings of roughly $400K a year.

Interface engines fail quietly — a stopped channel just means data stops arriving. The Mirth Connect monitoring dashboard I built watches 32 channels with alerting, and cut mean time to resolution from 3 hours to 30 minutes — 90% faster issue resolution. A channel outage should page someone, not sit unnoticed until a clinician asks where the results went.

Yes. I sign BAAs as a Business Associate for healthcare projects involving PHI, covering the obligations under 45 CFR Part 164, and I ensure subprocessors (AWS, etc.) have signed BAAs in place as well.

Most engagements start around $5K; smaller well-scoped work is considered case-by-case. Book a call or email me and you'll have a reply within 24 hours.