Healthcare software built for clinical reality

Custom healthcare software development is the design, build and deployment of clinical or administrative software made for one specific healthcare organisation. Instead of adapting your clinic to a generic product, the system is built around your care pathways, your data model and the systems you already run. It covers patient portals, telemedicine platforms, hospital and practice management systems, clinical workflow tools, and the integration layer that connects them to your EHR, labs, imaging and billing.

No, and no development company legitimately is. HIPAA has no official certification body for software vendors, so any agency claiming to be HIPAA certified is either confused or selling something. What we do is build software designed to support HIPAA requirements, implementing the HIPAA Security Rule technical safeguards. Contractual terms such as a Business Associate Agreement are agreed per project where we handle protected health information on your behalf, and we configure your cloud account on HIPAA-eligible services so your provider’s BAA can cover the hosting layer. Your organisation remains responsible for its own HIPAA compliance.

TLS 1.2 or above on every connection, including internal service-to-service traffic. Encryption at rest for databases, file storage and backups, with keys in AWS KMS or Azure Key Vault rotated on a policy. Unique user identification with no shared ward or reception logins. Role-based access that follows the minimum-necessary rule. Immutable, append-only audit logs that record reads as well as writes. Automatic logoff with short idle timeouts on shared workstations. Integrity controls such as checksums and versioning. And tested restores, because an untested backup is a hypothesis. We also design to keep production data out of staging and PHI out of logs, error trackers and analytics.

Health data is special category data under UK GDPR and EU GDPR, so we build to the highest bar: a documented lawful basis, data minimisation designed into the schema, encryption, granular access control, retention and deletion rules, subject access and erasure support, UK or EU data residency, with contractual terms such as a Data Processing Agreement agreed per project. If you supply the NHS, the Data Security and Protection Toolkit sets the standard your organisation must meet each year. We build software that supports your DSPT evidence — access logs, role controls, documented security measures and a data flow map. The toolkit submission itself is made by your organisation, not by us, and we do not provide legal or regulatory advice.

Yes. Integration is the core of most healthcare projects we take on. We work with HL7 v2 message feeds, FHIR REST APIs, CDA and C-CDA documents, and vendor-specific APIs and SDKs, including SMART on FHIR when an app needs to launch inside the EHR. Where a system exposes no modern API, we build an interface layer that handles message parsing, field mapping, queueing, retries and error alerting. The right approach depends on your EHR vendor and which interfaces they will open to you, so we confirm that during discovery before we quote.

HL7 v2 is the older, pipe-delimited messaging standard that still carries most hospital interfaces, usually sent over MLLP. The message types you meet in practice are ADT for admission, discharge and transfer, ORM or OMG for orders, ORU for results, SIU for scheduling and DFT for billing transactions. FHIR is the modern standard: JSON or XML resources such as Patient, Encounter, Observation and Appointment exposed over REST APIs, which are far easier to build against. Most real hospitals run both, so a realistic plan speaks FHIR wherever the vendor exposes it and HL7 v2 everywhere else, often with a FHIR facade in front of a legacy feed.

A focused build such as a patient portal, an online booking system or a single integration usually takes 6 to 12 weeks. A full platform with several integrations, role-based clinical workflows and audit requirements typically takes 4 to 8 months. Compliance work, vendor interface access, security review and integration testing add time that consumer software does not carry, and they are usually the critical path. We work in two-week sprints, so you see working software throughout rather than at the end.

The biggest cost drivers are the number and difficulty of integrations, the depth of your compliance and audit requirements, the number of distinct user roles and workflows, whether the software touches regulated clinical decision-making, and data migration from legacy systems, which is the item most often underestimated. As a guide, a focused integration layer or patient portal typically costs £25,000–£60,000, a full telemedicine or care coordination platform £60,000–£140,000, and a patient record or multi-site system £150,000 or more. We scope first and give you a written quote, with scope and exclusions agreed up front, before development starts.

Yes, with clear boundaries. We build AI for clinical documentation support, intake and triage assistance, summarisation, coding support, scheduling optimisation and imaging workflow support, always with a clinician in the loop who reviews and signs off. That administrative and documentation AI is where most of the return is and where the regulatory burden is lightest. Anything that directly informs a diagnosis or treatment decision can fall under medical device regulation in your market; we build to your regulatory strategy but do not give regulatory or legal advice or claim clinical certification.

We can engineer to your SaMD regulatory strategy, working with your regulatory advisers, clinical safety officer and quality process. That means versioned requirements linked to tests, controlled releases, audit trails and evidence capture including a clinical risk log where your safety officer needs one, explicit human-in-the-loop design, and model monitoring with drift detection and a rollback path. We do not hold clinical certifications, we will not pretend a model is just a feature when it functions as a device, and we do not advise on which regulatory pathway applies in the USA, UK or EU.

Yes. We build custom portals for healthcare professionals and referrers to submit referrals and orders, track their status, receive results and reports, and message the care team. They are built with unique logins, role-based access, audit logging of every record viewed, and integration with your EHR, lab or practice management system through FHIR, HL7 v2 or the vendor’s API.

If a packaged product covers around 90% of what you need and you can live with the rest, buy it. Build custom when the gap is where your value lives: a care pathway that sets you apart, integration the vendor cannot offer, or a health-tech product where the software is the business. Most organisations end up hybrid, keeping a major EHR for deep clinical functions and building custom portals, integrations and workflow tools around it. If discovery shows a packaged product fits better, we will tell you.