A clinic that
runs itself.
Compliance with teeth.

Careful people, doing machine work by hand

At the clinic, skilled staff spent their days on work no human should have to do: calling and clicking through portals to check insurance eligibility one patient at a time, and tracking medication refills on spreadsheets that depended on somebody remembering to look. Every manual step was a chance for a lapsed policy or a missed refill to slip through. And the people doing it were the same people patients needed at the front desk.

Separately, a healthcare software platform serving many organizations needed a HIPAA Security Rule audit: not a generic checklist, but findings precise enough that an engineering team could open the report and start fixing.

The mandate: make the routine work run itself, and make compliance something you can prove and act on.

The clinic, automated. The audit, made actionable.

• Insurance eligibility now runs itself, end to end: verified in real time the moment an appointment is booked, re-checked automatically each day ahead of the schedule, swept across the full caseload monthly, with results written back to the chart instead of a spreadsheet.
• Refills no longer depend on memory: a reminder system triggered by the clinical notes themselves schedules outreach around each patient's actual supply, keeps trying when nobody responds, and hands staff a monthly summary.
• The front office sees everything without asking: patient contacts sync automatically into the phone system, and staff get a text alert the moment an intake form is submitted.
• It costs almost nothing to run: the whole fabric lives on cloud services that only run, and only cost money, when they're working. The result is near-zero overhead, with every password and key locked in a secure vault, built-in guardrails against overload, and a complete activity log on every workflow.
• On the audit, every verdict is provable: 43 HIPAA requirements examined across Technical, Physical, and Administrative safeguards, each finding tied to the exact file and line of code, then double-checked in a full second pass.
• Findings became work, not warnings: the 14 most urgent fixes written up so engineers could start immediately, each with a clear definition of done and the HIPAA citation it satisfies.
• The paperwork enforces itself: the two-way Business Associate Agreement chain mapped end to end, including a hard stop built into the system itself so no customer goes live without a signed BAA. Evidence discipline was strict throughout: I reviewed the code and records only, and never touched live patient data.

The test of an audit is what happens next: this one shipped as a ranked to-do list for the engineers, each item with a clear definition of done, not a binder that goes on a shelf.

In plain terms

This client, like every client here, is not named: confidentiality is part of what they pay for. Every figure comes from the engagement's own records, and a reference who'll take your call is available on request.