Woyce
Six areas where AI is genuinely earning its place in US healthcare — and where the engineering, not the model, is what decides whether it ships.
Ambient capture, structured SOAP notes, and coding support that drafts for a clinician to review and sign — never files unreviewed. Whisper or Deepgram for transcription, an LLM layer for structure, and a review queue built into the workflow.
Scheduling, intake, reminders, and refill requests handled over chat and voice, with clean escalation to staff for anything clinical. Built so patients get an answer at 2am and your front desk stops fielding the same five questions.
Eligibility checks, coding assistance, claim scrubbing, and denial triage. The models surface likely rejections and missing documentation before submission; a biller makes the call.
Device ingestion from wearables and connected BP, glucose, and weight monitors, with thresholding, trend detection, and care-team alerting. Includes the billing-code scaffolding RPM programmes need to be viable.
FHIR R4, HL7v2, SMART on FHIR launch, and Bulk FHIR export — the standards layer every EHR connection runs on, and the unglamorous work that decides whether the rest of your product can ship.
Multi-tenant products for clinics and provider groups — tenant-isolated PHI, per-organisation roles, audit trails, onboarding, and billing. Architected for the compliance review your first enterprise customer will run.
Healthcare buyers will run a security review before they run a pilot. We build for that review from the start, because retrofitting audit logging and access control into a shipped product costs several times what it costs to design in.
We operate as a Business Associate and sign a Business Associate Agreement before touching PHI. Worth saying plainly: HIPAA has no certification scheme, so any vendor claiming to be 'HIPAA certified' is telling you something that does not exist.
Our SOC 2 audit is in progress and the report has not yet been issued. We will tell you exactly where it stands rather than imply more than we have.
TLS 1.2+ everywhere, KMS-managed keys for data at rest, and no PHI in logs, error reports, analytics, or prompt payloads sent to third-party model providers.
Append-only access logs covering who read which record and when, retained to policy and queryable — the artefact auditors and enterprise security reviews actually ask for.
Role-based access control, MFA, scoped IAM roles, and break-glass procedures with alerting. Access is granted per role, not per convenience.
Infrastructure built on AWS services covered by their BAA, with PHI kept inside that boundary. We have been an AWS-first shop since long before this was a healthcare conversation.
EMR, telehealth, practice management, and an AI front desk — delivered and in production.
All-in-one healthcare platform powering modern clinics
Comprehensive healthcare management platform with EMR, patient records, billing, telehealth, and AI-powered virtual assistant — all in one production-grade system.
AI virtual front desk that never sleeps
Automates appointment scheduling, reminders, and prescription refills with an AI virtual receptionist that handles patient calls 24/7 — built end-to-end by Woyce.
Enterprise EHR built for hospital networks
Comprehensive EHR system with integrated telehealth, insurance claims processing, and patient data management for hospitals and clinics.
Smart veterinary practice management
Comprehensive veterinary practice management system with appointment scheduling, medical records, billing, and client communication tools.
Healthcare integration is mostly a vocabulary problem. These are the standards and systems we have worked against — and the ones we will tell you honestly we have not.
Pre-build, or before an enterprise security review
A fixed-scope review of your architecture, PHI flows, access model, and audit posture, ending in a prioritised remediation list. Often the fastest way to find out whether your current build will survive a hospital's vendor assessment.
Digital health startups building v1 or v2
A cross-functional team — backend, frontend, AI, and design — owning delivery end to end against a roadmap. HIPAA-aware architecture from the first commit rather than retrofitted after a customer asks.
Teams blocked on an EHR connection
Scoped to a specific integration: FHIR or HL7v2 against a named EHR, including sandbox setup, mapping, error handling, and the certification path where the vendor requires one.
Teams with a roadmap and no bandwidth
Senior engineers embedded in your team with 4+ hours of daily US overlap, in your standups and your repo. Scale up or down month to month.
We map the PHI flows before we map the features — what data enters the system, where it rests, who reaches it, and which safeguards that obliges. This is also where we agree the BAA.
The riskiest integration gets built first against a sandbox. EHR connections are where healthcare projects slip, so we find out early rather than in month four.
Two-week increments, each demoable. Audit logging, access control, and encryption are part of the first increment, not a hardening phase bolted on at the end.
Anything that touches a clinical decision gets a human-in-the-loop design and is reviewed with your clinical stakeholders before it ships. Model output drafts; a clinician signs.
We hand over the architecture documentation, access-control matrix, and audit-log design your customers' security reviews will ask for — so the sales team is not chasing engineering for answers.
Yes. We sign a Business Associate Agreement before any engagement where we will handle protected health information. It is a precondition of the work, not a negotiation.
Nobody is — HIPAA has no certification scheme, and any vendor claiming certification is describing something that does not exist. What we do is architect to the HIPAA Security Rule (encryption in transit and at rest, audit logging, role-based access control, PHI minimisation), sign a BAA, and document the controls so your customers' security reviews have something concrete to assess.
Not yet. Our SOC 2 audit is underway and the report has not been issued. We would rather tell you that than let you find out during diligence.
We build on FHIR R4, SMART on FHIR, Bulk FHIR, and HL7v2 — the standards layer every major US EHR runs on, including Epic, Oracle Cerner, athenahealth, and eClinicalWorks. We haven't shipped a production integration with any of them yet, and we'd rather say that plainly than imply otherwise. Every vendor has its own sandbox, review process, and quirks, so we scope the specific integration against the specific system rather than promising a generic connector — our FHIR and EHR integration page has the current, honest status for each one.
Only inside a compliant boundary. That means a provider covered by a BAA, no PHI in prompt logs or training data, and de-identification wherever the use case allows it. Where a model provider will not sign a BAA for the deployment you need, we design around it — self-hosted models or a de-identification layer ahead of the call.
No. We build assistive systems with a clinician in the loop. The model drafts, summarises, flags, or ranks; a qualified human reviews and signs. If a use case would push a product into autonomous clinical decision-making, that is a Software as a Medical Device question with an FDA pathway attached, and we will tell you so rather than build around it quietly.
For a digital health MVP with one EHR integration and a compliant baseline, plan on three to five months. The integration is usually the long pole, not the product — which is why we build that spike first.
Yes, that is our primary focus. We have delivered EMR, telehealth, practice management, and AI front-desk platforms for US healthcare clients, and our engineers work with 4+ hours of daily US time-zone overlap.