What we build for healthcare teams
Six areas where AI is genuinely earning its place in US healthcare — and where the engineering, not the model, is what decides whether it ships.
Clinical documentation
Ambient capture, structured SOAP notes, and coding support that drafts for a clinician to review and sign — never files unreviewed. Whisper or Deepgram for transcription, an LLM layer for structure, and a review queue built into the workflow.
Patient engagement
Scheduling, intake, reminders, and refill requests handled over chat and voice, with clean escalation to staff for anything clinical. Built so patients get an answer at 2am and your front desk stops fielding the same five questions.
Revenue cycle & claims
Eligibility checks, coding assistance, claim scrubbing, and denial triage. The models surface likely rejections and missing documentation before submission; a biller makes the call.
Remote patient monitoring
Device ingestion from wearables and connected BP, glucose, and weight monitors, with thresholding, trend detection, and care-team alerting. Includes the billing-code scaffolding RPM programmes need to be viable.
EHR & data integration
FHIR R4, HL7v2, SMART on FHIR launch, and Bulk FHIR export — the standards layer every EHR connection runs on, and the unglamorous work that decides whether the rest of your product can ship.
Healthcare SaaS platforms
Multi-tenant products for clinics and provider groups — tenant-isolated PHI, per-organisation roles, audit trails, onboarding, and billing. Architected for the compliance review your first enterprise customer will run.
Compliance is an architecture decision, not a checklist
Healthcare buyers will run a security review before they run a pilot. We build for that review from the start, because retrofitting audit logging and access control into a shipped product costs several times what it costs to design in.
We sign a BAA
We operate as a Business Associate and sign a Business Associate Agreement before touching PHI. Worth saying plainly: HIPAA has no certification scheme, so any vendor claiming to be 'HIPAA certified' is telling you something that does not exist.
SOC 2 readiness underway
Our SOC 2 audit is in progress and the report has not yet been issued. We will tell you exactly where it stands rather than imply more than we have.
Encryption in transit and at rest
TLS 1.2+ everywhere, KMS-managed keys for data at rest, and no PHI in logs, error reports, analytics, or prompt payloads sent to third-party model providers.
Audit logging that survives review
Append-only access logs covering who read which record and when, retained to policy and queryable — the artefact auditors and enterprise security reviews actually ask for.
Least-privilege access
Role-based access control, MFA, scoped IAM roles, and break-glass procedures with alerting. Access is granted per role, not per convenience.
AWS on BAA-eligible services
Infrastructure built on AWS services covered by their BAA, with PHI kept inside that boundary. We have been an AWS-first shop since long before this was a healthcare conversation.
Healthcare platforms we have shipped
EMR, telehealth, practice management, and an AI front desk — delivered and in production.
Medical Office Force
All-in-one healthcare platform powering modern clinics
Comprehensive healthcare management platform with EMR, patient records, billing, telehealth, and AI-powered virtual assistant — all in one production-grade system.
MOF - Front Desk Reception Agent
AI virtual front desk that never sleeps
Automates appointment scheduling, reminders, and prescription refills with an AI virtual receptionist that handles patient calls 24/7 — built end-to-end by Woyce.
AdvancedCare
Enterprise EHR built for hospital networks
Comprehensive EHR system with integrated telehealth, insurance claims processing, and patient data management for hospitals and clinics.
VetWise
Smart veterinary practice management
Comprehensive veterinary practice management system with appointment scheduling, medical records, billing, and client communication tools.
Standards, terminologies, and systems we work with
Healthcare integration is mostly a vocabulary problem. These are the standards and systems we have worked against — and the ones we will tell you honestly we have not.
Interoperability
- FHIR R4
- SMART on FHIR
- Bulk FHIR
- HL7v2
- DICOM
- CDA
Terminologies & coding
- ICD-10-CM
- CPT
- HCPCS
- SNOMED CT
- LOINC
- RxNorm
EHR systems
- Epic
- Oracle Cerner
- athenahealth
- eClinicalWorks
- NextGen
- DrChrono
Compliance frameworks
- HIPAA Security Rule
- HIPAA Privacy Rule
- HITECH
- SOC 2 (readiness underway)
- GDPR (where applicable)
How teams engage us
Compliance & architecture review
Pre-build, or before an enterprise security review
A fixed-scope review of your architecture, PHI flows, access model, and audit posture, ending in a prioritised remediation list. Often the fastest way to find out whether your current build will survive a hospital's vendor assessment.
Product pod
Digital health startups building v1 or v2
A cross-functional team — backend, frontend, AI, and design — owning delivery end to end against a roadmap. HIPAA-aware architecture from the first commit rather than retrofitted after a customer asks.
Integration engagement
Teams blocked on an EHR connection
Scoped to a specific integration: FHIR or HL7v2 against a named EHR, including sandbox setup, mapping, error handling, and the certification path where the vendor requires one.
Embedded engineers
Teams with a roadmap and no bandwidth
Senior engineers embedded in your team with 4+ hours of daily US overlap, in your standups and your repo. Scale up or down month to month.
How a healthcare build actually runs
- 01
Scope & compliance mapping
We map the PHI flows before we map the features — what data enters the system, where it rests, who reaches it, and which safeguards that obliges. This is also where we agree the BAA.
- 02
Architecture & integration spike
The riskiest integration gets built first against a sandbox. EHR connections are where healthcare projects slip, so we find out early rather than in month four.
- 03
Build in reviewable increments
Two-week increments, each demoable. Audit logging, access control, and encryption are part of the first increment, not a hardening phase bolted on at the end.
- 04
Clinical review loop
Anything that touches a clinical decision gets a human-in-the-loop design and is reviewed with your clinical stakeholders before it ships. Model output drafts; a clinician signs.
- 05
Launch & evidence pack
We hand over the architecture documentation, access-control matrix, and audit-log design your customers' security reviews will ask for — so the sales team is not chasing engineering for answers.
Healthcare development FAQs
Do you sign a BAA?+
Yes. We sign a Business Associate Agreement before any engagement where we will handle protected health information. It is a precondition of the work, not a negotiation.
Are you HIPAA certified?+
Nobody is — HIPAA has no certification scheme, and any vendor claiming certification is describing something that does not exist. What we do is architect to the HIPAA Security Rule (encryption in transit and at rest, audit logging, role-based access control, PHI minimisation), sign a BAA, and document the controls so your customers' security reviews have something concrete to assess.
Are you SOC 2 certified?+
Not yet. Our SOC 2 audit is underway and the report has not been issued. We would rather tell you that than let you find out during diligence.
Which EHRs can you integrate with?+
We build on FHIR R4, SMART on FHIR, Bulk FHIR, and HL7v2 — the standards layer every major US EHR runs on, including Epic, Oracle Cerner, athenahealth, and eClinicalWorks. We haven't shipped a production integration with any of them yet, and we'd rather say that plainly than imply otherwise. Every vendor has its own sandbox, review process, and quirks, so we scope the specific integration against the specific system rather than promising a generic connector — our FHIR and EHR integration page has the current, honest status for each one.
Can you use GPT-4 or Claude on patient data?+
Only inside a compliant boundary. That means a provider covered by a BAA, no PHI in prompt logs or training data, and de-identification wherever the use case allows it. Where a model provider will not sign a BAA for the deployment you need, we design around it — self-hosted models or a de-identification layer ahead of the call.
Will your AI make clinical decisions?+
No. We build assistive systems with a clinician in the loop. The model drafts, summarises, flags, or ranks; a qualified human reviews and signs. If a use case would push a product into autonomous clinical decision-making, that is a Software as a Medical Device question with an FDA pathway attached, and we will tell you so rather than build around it quietly.
How long does a healthcare MVP take?+
For a digital health MVP with one EHR integration and a compliant baseline, plan on three to five months. The integration is usually the long pole, not the product — which is why we build that spike first.
Do you work with US healthcare startups specifically?+
Yes, that is our primary focus. We have delivered EMR, telehealth, practice management, and AI front-desk platforms for US healthcare clients, and our engineers work with 4+ hours of daily US time-zone overlap.