Staff shortages
Clinicians are the scarcest resource in the building. Any system that adds thirty seconds per encounter is costing you consultations, and it will be worked around within a fortnight.
Healthcare & life sciences
In healthcare, the audit trail is the product.
Every clinical system is two systems. There is the one clinicians use, which has to be fast enough that nobody works around it, and there is the one that proves afterwards who saw what, when, and on whose authority. Too many vendors build the first and bolt the second on at the end. We do healthcare software development the other way round, with the record of access designed in from the first schema.
The question to answer first
“Can you build this so it passes a HIPAA audit without slowing my clinicians down?”
65%
Shorter patient wait times on a HIPAA-compliant telemedicine platform we built
The pressure
Four forces, and none of them are technology.
Fragmented records
The EHR, the scheduling tool, the lab system and the billing platform each hold part of the patient. Nobody holds all of it, and the gaps are where errors live.
Telehealth as default
Remote consultation stopped being an overflow channel. It is now a primary one, and it inherits every compliance obligation the physical clinic has.
AI under scrutiny
Regulators are not asking whether you used a model. They are asking what it saw, what it decided, and whether a human could have overruled it.
The audit interview
Six questions, and where the answer has to already live.
These are asked after the fact, by someone with the authority to stop you. Each one is a design decision made months earlier, or it is a problem.
Who viewed this record, and when?
An append-only access log written by the same code path that serves the record. If viewing and logging can come apart, they will, and the gap is exactly what gets asked about.
On whose authority?
Role at the time of access, not role today. Permissions change, and an audit is a question about a moment in the past.
Was consent in place?
Consent recorded as a versioned artefact with a scope and an expiry, not a boolean on a patient row that somebody set once.
What did the model see?
The exact input, the version of the model, and the output, retained for the same period as the clinical record itself.
Could a clinician have overruled it?
Yes, and the fact that they did or did not is recorded. A recommendation nobody can decline is a decision wearing a recommendation costume.
Where did the data physically sit?
Region, provider and every subprocessor in the chain, documented before the contract rather than assembled during the incident.
The work
What we build for clinical organisations
Four kinds of system, each one shaped by the fact that a clinician will abandon anything that slows them down.
Telemedicine platforms
Video, scheduling, notes and billing in one flow rather than four tools a clinician tabs between. The consultation record is written once and referenced everywhere.
Clinical workflow tooling
Triage queues, referral tracking and care pathways that encode your actual protocol, including the exceptions your staff currently hold in their heads.
Interoperability layers
HL7 and FHIR interfaces to the systems you already own, so a new tool does not mean another island of data.
Patient-facing portals
Booking, results and secure messaging built for people who are unwell, on a phone, and not in the mood to solve a puzzle.
We were looking for a reliable partner to help us build our health screening platform. … Brilliant System designed the architecture in a way that the platform could comply with relevant needed compliances.
Read the full review
Non-negotiable
What HIPAA actually asks of the build
- HIPAA
- Technical, physical and administrative safeguards, with the audit log designed in from the first schema rather than added when someone asks for it.
- Access control
- Role-based, time-bounded, and recorded. Break-glass access exists and is logged loudly, because pretending it does not exist is how it gets shared.
- Data residency
- Where records live, who processes them, and which subprocessors touch them, documented before the contract rather than during the incident.
- Retention and disposal
- How long you keep it and how you prove you destroyed it. Both are audit questions and both are usually unanswered.
Where AI actually lands
Four places it earns its cost, and one line we do not cross.
Worth doing
- Triage support that ranks a queue by clinical urgency rather than arrival time, with the reasoning shown to the clinician who signs it off.
- Clinical documentation, turning a consultation into a structured note the clinician edits rather than writes.
- Coding and billing, where the pattern is well defined and the error rate of the current manual process is already known.
- Retrospective review, finding the cases a human reviewer should look at again.
Where we stop
Autonomous diagnosis. Not because the models cannot, but because nobody in your organisation can carry the liability, and no regulator will accept a system whose reasoning cannot be reconstructed after the fact. We build for the clinician holding the pen.
Evidence
Our published healthcare case study is a HIPAA-compliant telemedicine platform that cut patient wait times by 65 percent.
Read the case study
How we deliver it
The services this work draws on.
Custom Software
Systems built for one business, owned outright, with no licence renewal attached.
AI Development
Production ML pipelines, retrieval systems, and evaluation harnesses built to survive audit.
Cybersecurity
Threat modelling, hardening, and the evidence trail an auditor will ask for.
Other sectors we work in
Next step
Tell us what your clinicians are working around.
A senior engineer reads every enquiry and replies within one business day with an honest view of what it will take, including where the audit trail and HIPAA safeguards shape the build.
