Custom EHR/EMR and practice platforms, patient portals, and HIPAA work that goes past the report and into the code — for care organizations stuck on software that no longer fits, and for HealthTech products that have to be HIPAA-defensible before the next round.
Off-the-shelf doesn't match how you work — a specialty workflow, an obligation nobody wrote a product for. We build the system that does: records, scheduling, documents, staff, compliance reporting in one place instead of four. Assisted living and homecare, mental health, physical therapy, multi-site groups. For substance-use practices, 42 CFR Part 2 — modeled wrong by most platforms.
Data exchange between systems: Healthcare Interoperability.
Online booking, secure messaging, results delivery, intake forms, payments — wired into the system your staff already lives in, so nothing gets re-keyed. Plus the layer most portals skip: an AI assistant trained on your providers, plans and protocols that answers routine traffic and escalates the rest to a human, not a hold queue. Right of access lands in days, not a phone call and a fax — one of OCR's most frequently enforced areas. Anything it learns from is a scoped, disclosed secondary use on de-identified data.
A hands-on review of how patient data actually moves through your systems — code, database, infrastructure, and every third-party tool that touches PHI — followed by the fixes, not just the findings. Details below.
We take over healthcare systems other people wrote, including ones whose vendor is gone, then modernize in place: an integration layer around what works, the highest-pain systems first, no big-bang replacement, no pause in clinical operations. Non-PHI PHP, Laravel or Yii: Legacy Modernization →
AI documentation support in your clinical workflow, coding and billing automation between EHR and billing, prior-authorization automation, no-show risk scoring, smart reminders.
Need the data layer — FHIR APIs, SMART on FHIR, EHR-to-EHR exchange, CMS-0057 prior authorization?
That's Healthcare Interoperability →
Between 2023 and 2026 most care organizations added tools faster than anyone reviewed them. A transcription app. A shared drive. A team chat where patient names appear. An AI assistant that drafts letters. Each was a separate decision nobody made deliberately, and the BAA you signed with your EHR vendor covers exactly one of them: theirs.
Regulatory status reviewed: September 2026.
Try it on yourself first: 9 questions about the tools your organization actually uses. It scores your exposure, flags which gaps are the expensive ones, and gives you a scorecard you can forward to whoever signs off on it. Free and self-serve.
Healthcare architecture is where general development shops discover, usually late, that healthcare is different. PHI in an unencrypted column. Analytics tools processing patient data with no BAA. Audit logging that was never built. None of it is exotic; all of it surfaces at exactly the wrong moment — technical diligence, an enterprise security review, or a customer's first real question about where the data lives.
Clinical insight, no technical partner. PHI handling, BAA-covered infrastructure, access controls and audit logging go in from the first sprint — retrofitting is the expensive version of the same work — plus the diligence pack a fund or enterprise buyer will ask for.
The product exists, it works, and it just failed someone's review. We audit against the concerns raised, split findings into must-change and can-wait, and fix them in your codebase. A rebuild is occasionally right and usually not — runway is finite, and most of what gets flagged is weeks, not months.
Real users, real uptime commitments — and now it needs AI. The risks that matter aren't model quality: PHI leaving through an API call with no BAA, RAG over clinical data with no access-control boundary, AI output shown to a clinician with no human in the loop. Two boundary questions we settle in the architecture review, before the code: whether a clinician-facing feature crosses into clinical decision support or software-as-a-medical-device territory — different rules, different scrutiny, plus nondiscrimination expectations for anything shaping a patient-care decision — and whether patient data training or evaluating the model is a secondary use, which we scope contractually and de-identify by Safe Harbor or expert determination, not by assuming consent covers it. Then we ship behind feature flags.
From $4,500 · 2–4 weeks
The PHI map — code, database, infrastructure, backups, logs; every third-party tool in the path with its BAA status and configuration; findings ranked by real risk; a prioritized fix list; security-questionnaire answers you can paste.
4–8 weeks · quoted after the review
The fix list implemented — MFA, encryption at rest and in transit, access and same-day offboarding, audit logging, tool replacement or reconfiguration; verified backup and restore, not just "backups exist"; a 24-hour incident-response runbook; the documentation pack for your cyber-liability underwriter or an enterprise questionnaire.
Discovery 2–3 weeks · build quoted after discovery
We read the system you have and document what holds it together and what is safe to change, in what order; then the integration layer, the portal, or the platform itself — scoped after discovery, not before.
From $5,500 · 2–3 weeks
Architecture and PHI-handling review against the concerns actually raised; findings split into must-fix and can-wait; the gap list for your diligence pack.
4–8 weeks · quoted after the review
Surgical fixes in your codebase; plus the diligence pack — architecture document, PHI data-flow diagram, subprocessor and BAA list, security-questionnaire answers.
MVP 10–16 weeks; AI feature build 4–8 weeks · quoted after the architecture review
PHI handling, BAA-covered infrastructure, access controls and audit logging in the architecture from the first sprint; or, for a live product, architecture review first, then implementation behind feature flags.
Every engagement is fixed-scope and fixed-fee; the first on each track is priced above, later stages quoted once we know what's in your systems.
A government-sponsored CME provider needed courses, live events and credit tracking to stay aligned with ACCME and AOA requirements, for physicians who are busy and dispersed.
Result: 12,000+ registered members and 4,000 credits earned on the platform to date.
Read the case study →A distributed sales force needed product and regulatory knowledge reinforced between live training sessions, without pulling reps out of the field.
Result: a scalable training platform for 300+ sales representatives, with structured reinforcement of knowledge beyond live events.
Read the case study →Therapists needed patients to actually understand and follow home exercise instructions, and to sync progress data back into the clinic's own EMR/EHR.
Result: markedly easier to use for therapists and patients, with HEP progress in clear reports and data synced to EMR/EHR systems.
Read the case study →"They worked hard to understand what the problems were and solve them correctly." Sharon McCormick, Clinical Director, The Listening Centre (EAP) Ltd
Also: Medical HRMS · Assisted Living Facility Software · Software for Mental Health Counselors
Contracting entity is an Estonian company; the engineering team is distributed across Ukraine and the EU. HIPAA imposes no geographic restriction on a business associate, but that's not the whole answer — many state Medicaid contracts and enterprise DPAs do restrict offshore access to PHI. We'll answer the data-residency, subcontractor, BAA and continuity questions in writing before you ask twice; the team has been distributed since 2022, with delivery uninterrupted. And where the cleanest answer is that PHI never reaches Greenice at all, the work happens inside your infrastructure.
No commitment
Run the HIPAA & AI-tools self-check — 9 questions, a scorecard you can forward. Free and self-serve; booking a call after is optional.
Run the self-checkWhen you're ready
Book a 30-minute call with a specific agenda — bring one system, one workflow, or one review that flagged you.
Book a 30-minute call
