Telehealth Practice
HIPAA-compliant telehealth software development and marketing
We build and integrate telehealth applications, and the marketing stack that goes with them, for the companies the enterprise firms price out. We build the software, sign the BAA, and do the compliance work.
Domestic
US development team.
Affordable
Priced for startups and mid-market.
Secure
PHI on infrastructure you own. BAA at start.
Nimble
AI-native builds, 8 to 16 weeks.
Experienced
Building software since 2000.
Regulated companies we have built for
What we do
Telehealth app development
Telemedicine app development from intake to fulfillment: video visits, e-prescribing, payments, identity verification, and the integrations that make the product run.
- Clinical platform, pharmacy, and lab integrations
- 8 to 16 weeks, US development team, BAA signed at start
- HIPAA program written alongside the code
HIPAA marketing stack
Analytics, lifecycle email, CRM, and conversion measurement that keep patient data in systems you control.
- Advertising trackers off every page that carries a diagnosis
- Self-hosted analytics and email; server-side conversions that never include a diagnosis
- Retention that runs by itself, and a documented vendor chain
Content governance
The claims inventory, the approval gate, and the sign-off log, so nothing goes live unreviewed.
- Every claim mapped to evidence you hold
- Approval workflow configured in your CMS
- Counsel owns the letter; we own the controls
How an engagement runs
- 1
Audit and scope
Two weeks, fixed price. Data flows, claims, demand, then a price and a date in writing.
- 2
Design
Screens and clinical flows, agreed with you before anyone writes code.
- 3
Build
AI-native delivery, 8 to 16 weeks, under a signed BAA.
- 4
Review
Nothing ships without a human sign-off, on the record.
- 5
Launch
With the HIPAA program written, and the vendor chain documented.
Start here
The telehealth web audit
One review of your marketing site as a PHI exposure, a claims-governance risk, and a demand asset. It is the same review we run before any telehealth app development engagement, sold on its own, and it tells you which of the three services you need.
Scope
Fixed
Timeline
Two weeks
Price
Fixed
# what you receive
- A map of every place patient data flows, with the vendor and the BAA status for each.
- A claims inventory: each public claim, who approved it, and the evidence behind it.
- Where you appear in Google and AI answers for the terms your patients use.
- A HIPAA security risk assessment of the stack the site runs on.
- Findings ranked by impact and a remediation plan you keep, whether or not we do the work.
What regulators did in the last two years
- FDASept 2025 – Jun 2026113 warning letters to telehealth companies, every one citing a sentence on a website.
- FTC, Utah, CaliforniaJul 29, 2026Complaint against Hims & Hers over patient data shared with Meta and Snap through tracking tools and customer lists.
- FTCJul 29, 2024Amended Health Breach Notification Rule in effect: an unauthorized disclosure is a breach, with a 60-day notice clock.
- WashingtonFeb 10, 2025First class action under the My Health My Data Act's private right of action.
The full record, updated monthly: the telehealth enforcement digest.
Proof
Regulated delivery, shipped
Helmer Scientific, Farrar, Henry Schein, North American Rescue, and technical due diligence for Trane. All regulated, all in production.
Built under other regimes
Payment systems under PCI-DSS, physical access control for a global datacenter operator, and tactical medicine sold through government procurement. HIPAA is one regime on that list.
Security work, on the record
Helmer Scientific's platform passed a 2024 PCI assessment, repeated penetration-testing cycles, and Trane Technologies' acquisition due diligence in 2023 with no cleanup project. Mobile Mini's ran enterprise penetration testing through a public-company merger.
Code your engineers can read
Greenroom, the review-and-sign-off gate we build with, is open source. Acorn, the analytics your PHI would run on, is self-hosted, so the data stays on infrastructure you own.
See what we build in the open“Their ability to anticipate and adapt to our requirements, while maintaining the project's momentum, was particularly impressive.”
AI in the product, or not
“AI-powered” means one of three things, and the difference is your whole risk posture.
1. AI wrote the code
A person reviewed every line before it shipped, so what you run is ordinary, deterministic software. This is how we build.
2. AI operates it from outside
Deterministic software your own agents drive through a constrained interface, on your terms. This is what we ship by default.
3. AI runs inside the product
A model making decisions live is a data-leak surface you own forever. Sometimes worth it, only as a decision you make with your eyes open.
Frequently asked questions
What's the telehealth web audit?
A fixed-scope, fixed-price review of your marketing site as three things at once: a PHI exposure (where patient data goes and which vendors hold it), a claims-governance risk (what you publish, who approves it, and what evidence stands behind it), and a demand asset (how you show up in search and AI answers, the same review we run for telehealth app development clients). You get the findings ranked by impact and a remediation plan you can hand to anyone. You keep it whether or not we do the work.
Which tools can we keep?
Any vendor that will sign a business associate agreement for the way you use it. The advertising platforms do not sign one for advertising, so pixels and audience uploads come off any page that carries a diagnosis. Analytics and lifecycle email usually move to infrastructure you own. Support, CRM, and form tools stay if their plan tier includes a BAA and the data in them is limited to what the tool needs.
Do you sign BAAs?
Yes. As the business associate to your covered entity, we sign a standard BAA at engagement start. For the sub-vendors in your stack (hosting, email delivery, storage), we manage the BAA chain so you don't have to negotiate each one yourself.
Are you HIPAA-compliant?
Yes. We operate as your business associate under a signed BAA, and every HIPAA build includes the compliance work: the risk assessment, the policies, and the documentation your auditor asks for. One precision worth knowing: there is no certification for software itself, so nobody can sell you a "HIPAA-certified" app. Compliance is something an organization holds, and we build the software and the program together so yours holds it. No compliance work, no HIPAA.
We had a breach, or we're worried about one. What changes?
Most telehealth breaches start in a vendor's system, with PHI your team put into a third-party tool years ago. Under the FTC's amended Health Breach Notification Rule, an unauthorized disclosure counts as a breach, with notice to affected individuals due within 60 days, so a pixel or an audience upload can start the clock. We move the data that matters onto infrastructure you own and run, document the chain that remains, and write the incident plan, so your auditor gets answers.
We took an FDA warning letter. Can you help with the marketing claims?
Your regulatory counsel owns the response letter. We handle the content side: a claims inventory, the compliant rewrite mapped to evidence you hold, and content controls in your CMS so no claim goes live without a sign-off on the record. It is a fixed-scope engagement, not a rebuild. We have read all 113 letters and can tell you which wave you are in.
Is there AI inside the product you'd build for us?
Only if you choose it deliberately. "AI-powered" can mean three different things, and the difference is your whole risk posture: AI wrote the code (fine, when a person reviewed every line), AI operates the software from outside through an interface you control and can revoke, or AI runs live inside the product (a hallucination and data-leak surface you'd own forever). By default we ship the second and build with the first. We'll put a model in the runtime only after you've seen exactly what the trade costs.
Have you built telehealth specifically before?
Our current regulated work is under NDA, so the names we can give are adjacent: two decades of medical device, life science, medical distribution, and government-channel products, and a year with Brad as CIO of a skin-health company, on the operator's side of the desk. The engineering judgment that keeps PHI safe and claims honest is the same across these; the telehealth specifics are what the engagement scopes.
Are you insured?
Yes: cyber liability and professional liability, certificate available during procurement.
Start with the audit
Two weeks, fixed price, findings ranked by impact, and a remediation plan you keep whether or not we do the work.