Industries
Technology work for providers, payers and health platforms
Clinical systems run around the clock and carry data that cannot leak. That shapes everything: when you can deploy, how you test, what you are allowed to copy into a test environment.
What makes this sector different
Most healthcare integration work is interface work. HL7 v2 messages still carry a large share of clinical traffic, FHIR APIs are growing, and the two coexist for years. We build and modernize those interfaces, add monitoring that tells someone when a feed stops, and document the mappings so the next team can follow them.
Downtime is a clinical risk, not an inconvenience. Deployment windows are short and sometimes impossible, so work is planned around them: feature flags, backward-compatible interface changes, rollback that has been rehearsed.
Protected health information decides what a project may touch. Non-production environments get masked or synthetic data. Access is scoped to the people who need it. Logging records who read what. These are design constraints from day one, not a security review at the end.
Where the work usually is
-
Interfaces nobody owns
A message feed built years ago by someone who left, with no documentation and no alerting. It works until it does not.
-
FHIR alongside HL7 v2
New API consumers need FHIR while existing systems speak v2. Mapping between them correctly, including identifiers and code systems, is detailed work.
-
PHI in test environments
Copies of production data in places with weaker access control. Common, and one of the first things a security review finds.
-
Identity across many systems
Clinicians with accounts in a dozen systems, shared workstations and accounts that outlive employment.
-
Revenue cycle data quality
Claims rejected because of upstream data problems that nobody traced to their source.
-
Legacy reporting
Reports built directly against transactional databases, which slow down the systems clinicians use.
Systems and platforms we work in
Platform names describe where our consultants have worked. They do not imply a vendor partnership or certification.
How we help
-
Interface and API development
HL7 and FHIR interfaces, with mapping documents, error handling and monitoring.
-
Cloud migration
Landing zone, migration waves and validation for the systems that can move.
-
HIPAA security risk analysis
Technical risk analysis against the Security Rule safeguards, with a prioritized plan.
-
Penetration testing
Application, API, external and internal testing with authorization and a retest.
-
Data engineering and reporting
Pipelines and a reporting layer that does not sit on the transactional database.
-
Specialist staffing
Integration engineers, security analysts, data engineers and ERP consultants.
Regulatory and contractual context
- The HIPAA Security Rule requires a risk analysis and risk management process covering electronic protected health information.
- In January 2025 the Office for Civil Rights published a proposed rule to update the Security Rule; check its current status before planning against it.
- The HIPAA Breach Notification Rule sets reporting duties that shape incident response plans and logging requirements.
- Business associate agreements govern what a vendor may access, and are a reason to agree data handling in writing before work starts.
- Information blocking rules under the 21st Century Cures Act affect how data is made available through APIs.
- State privacy and medical record laws can be stricter than federal rules, especially for sensitive categories of data.
Roles we recruit for this sector
Contract, contract-to-hire and direct hire. We do not sponsor visas: candidates must already be authorized to work in the United States.
Illustrative engagement
Illustrative scenario. Not a real client engagement. No outcomes are claimed.
A multi-site provider group wants to expose patient demographics and appointments to a new patient-facing app, and has only HL7 v2 feeds today.
- Starting point
- Three HL7 v2 feeds, one integration engine, no API layer and no inventory of which downstream systems consume which message types.
- Scope
- Build a FHIR facade for the two resources the app needs, map identifiers and code systems, add authorization per patient, and log access.
- Team
- An integration architect, two developers with FHIR experience, a security engineer for the authorization design and a test lead.
- Evidence
- A mapping document reviewed by the clinical informatics team, authorization tests per patient and per role, and a load test at expected volume.
- What is not claimed
- An example of scoping, not a completed engagement. No outcomes or client are implied.
Questions people ask
Will you sign a business associate agreement?
Where our work involves protected health information, a BAA is appropriate and we expect to sign one before the work starts. Send your form during scoping.
Can you work inside our EHR?
We work on interfaces, APIs, data and reporting around the EHR, and we staff analysts with experience in specific platforms. We will tell you at intake whether our consultants’ experience matches your platform.
Do you use offshore staff on healthcare work?
Only with your written agreement, and with the location and data access restrictions you set. By default, work involving protected health information is done by United States based staff.
Can you do a HIPAA risk analysis?
Yes, as consultants. We assess the technical and administrative safeguards and give you a prioritized plan. We are not an accrediting body and we do not certify compliance.
Related
-
Enterprise API integration
Design, build and secure APIs and the integrations that depend on them, with versioning, monitoring and ownership.
-
HIPAA security risk analysis
Technical support for the risk analysis HIPAA requires: identify where ePHI lives, assess threats and safeguards, and plan remediation.
-
Cloud
Cloud strategy, readiness assessments, migration, landing zones, governance, FinOps and operations on AWS, Azure and Google Cloud.
-
Life sciences
Validated systems, batch records, quality processes and regulated change control.
Have a technology challenge? Let’s work out the approach.
Discuss a project
Tell us the current system, the target and the timeline. A technical lead replies to talk about scope.
Start the project briefRequest technical talent
Need consultants inside your team rather than a project owner? Send the requirement.
Request talentBecome a partner
Delivery firm, staffing supplier or consulting partner? Register your company.
Register as a partner