Technology built
for the complexity
of modern care

We treat HIPAA compliance as an architectural requirement, not a sign-off task at the end. Every project starts with a PHI data flow mapping session, threat modelling, and a risk analysis. We define the technical safeguards - encryption, access controls, audit logging, transmission security - in the design phase, implement them in development, and document them in a Security Risk Assessment we maintain and update. You'll have everything you need for an audit before you go live.

Yes - and it's one of the things we've done often enough to be honest about the timeline. Epic and Cerner integrations require sandbox access, vendor review, and in some cases a technical review with the EHR vendor's team. We know this process well. A typical SMART on FHIR or CDS Hooks integration takes 8–14 weeks from kickoff to production, including the vendor approval period. If you need something faster, we can discuss which integration approach is feasible in your timeframe.

Yes. We've delivered projects for NHS trusts and integrated care systems. We're familiar with NHS DSP Toolkit requirements, NHS login integration, the GP Connect APIs, and the data security and protection standards that NHS organisations must meet. We also understand the procurement environment, which is different from private healthcare in ways that affect project planning.

Every clinical AI tool we build has a defined scope of use, a clear explainability model, and a human-in-the-loop design where the software informs clinical judgment rather than making autonomous decisions. We follow FDA Software as a Medical Device (SaMD) guidance for anything that might be classified as a medical device, and we design for clinical governance from the start - including audit trails, model performance monitoring, and defined escalation paths when predictions fall outside expected parameters.

Every engagement includes post-launch support with documented incident response runbooks. For healthcare clients, we have a specific HIPAA Breach Notification protocol: initial response within 60 minutes, preliminary investigation within 4 hours, and formal notification support within the 60-day HIPAA reporting window. We also provide quarterly security reviews and penetration testing as part of ongoing managed services.

Yes - we've supported several healthcare organisations through HITRUST CSF certification. We implement the technical controls that HITRUST requires, help you document them in the format assessors expect, and work with your chosen HITRUST assessor during the review. Full certification typically takes 6–9 months for a new system; we can usually have the technical controls in place within 12 weeks, with the remainder of the time spent on documentation and the assessment process itself.