HIPAA compliant software, built to your workflow and audited in code.

Off-the-shelf HIPAA tools versus a custom build

A lot of searches for HIPAA compliant software are really asking whether a tool already in use, or about to be bought, meets the checklist above. For a mainstream workflow, an EHR, a scheduling system, a billing platform from a vendor that signs a BAA and publishes its safeguards, the honest answer is usually yes. Buying that is faster and cheaper than building it, and we will say so on the first call.

A custom build earns its cost under a narrower set of conditions: your workflow does not match what a generic SaaS product assumes, an inquiry that has to become a chart without changing systems, a routing engine with failover logic specific to your business; you need an AI feature, a scribe, a vision model, a classifier, running under your own BAA and audit log instead of a vendor's black box; or several existing systems need to become one record with one audit trail, instead of three separate compliance surfaces to defend in an audit.

A dental practice with a stable referral pipeline and a working practice-management system does not need a custom EHR. A clinic already running a BAA-covered scheduling tool does not need us to rebuild it. The rest of this page covers what changes when the fit is not there.

How we build it: controls enforced in code, not promised in a deck

We sign a BAA on request, before any PHI reaches a build. From there, the safeguards above get built into the system rather than described in a policy document: role-based access control scoped to who should see a given record at a given stage, encryption in transit and at rest, and an audit log wired into the data layer itself so a compromised credential cannot rewrite history. On a compounding-pharmacy platform we built, that discipline produced a seven-year immutable audit log and 490+ unit tests, each verified against a numbered requirement before anything merged, with patient-facing screens passing WCAG 2.1 AA.

AI features run under the same controls, not a separate exception. A voice-to-chart scribe that drafts a SOAP note from a provider's dictation, or a vision model that reads a radiograph, sits behind one internal interface, is never used to train a model on client data, and writes into a pending-review state that a named provider has to sign off on before it becomes part of the record.

Is ChatGPT HIPAA compliant. Not by default. OpenAI's Help Center states that ChatGPT Free, Plus, Pro, Team, and self-serve Business are not eligible for a Business Associate Agreement, and that BAA coverage runs through the API platform and sales-managed Enterprise or Edu accounts instead. PHI belongs in an integration built behind a BAA-eligible product with its own access logging and encryption, not typed into a consumer chat window. We build that integration layer as part of the system, not as an add-on bolted beside it.

What it costs and how the pod is staffed

There is no separate HIPAA pricing tier. The safeguard work adds engineering discipline, more review gates, more logging, more test coverage on anything that touches PHI, not a different pricing model. A Builder Pod is $7,500 a month: one active build track, a pod lead plus a two-engineer bench, weekly ship, month-to-month with 30 days notice. A Growth Pod is $10,000 a month for two concurrent tracks with a three-engineer bench. Enterprise engagements, three or more parallel tracks with a dedicated senior lead, are scoped in a meeting.

A pod starts on your codebase within 5 business days of a kickoff session. The BAA is signed before the pod touches anything with real PHI in it; a prototype or an early build phase runs on synthetic data until that agreement is in place. Everything ships into your own repository and your own cloud account or VPC, with a SOC 2 Type II report available under NDA if a customer or auditor asks for it.