Digital health · HIPAA
Taking over an agency-built health platform and making it safe to own.
A consumer digital-health product handling protected health information, handed over from an outside agency with the codebase split across repositories and compliance gaps in the way of growth.
- Client
- US digital health company
- Role
- Technical lead
- Period
- 2026 – present
- Focus
- Agency handover
- repositories consolidated
- 2 → 1repositories consolidated
- classes of HIPAA gap closed
- 7classes of HIPAA gap closed
- long-lived deploy keys
- 0long-lived deploy keys
- ✓Secrets manager
- ✓PHI audit log
- ✓Role-based admin
- ✓No PHI in code
The problem
The product was live and handling protected health information, but had been built by an agency, split across repositories, with no single owner. The company needed to know what it actually had.
Shipping new features — especially AI — meant first closing critical HIPAA gaps and moving onto infrastructure the company controls.
What I built
- 01
One codebase
Merged the web app and API repositories into a single monorepo — adding background workers and a Python service — with one build and one set of conventions.
- 02
Compliance remediation
Audited against the HIPAA Security Rule and closed the critical gaps first: secrets management, audit logging of every PHI read and write, role-based access to admin tools, and health data removed from the codebase.
- 03
Greenfield AWS infrastructure
New AWS accounts defined in Terraform — staging live, production built and verified for cutover — with CI/CD that deploys through short-lived OIDC credentials instead of long-lived keys.
- 04
AI that stays inside the BAA
Personalised recommendations built on Claude through AWS Bedrock, so health data stays inside BAA-covered services.
The result
- The company owns one codebase it can reason about, with infrastructure in its own accounts instead of an agency's.
- A documented compliance posture to build on — and an AI roadmap that doesn't require a compromise on health data.