Case study · Healthcare
HIPAA-compliant SaaS for treatment programmes, built for BPDS, LLC.
Treatment engagement, adherence and retention data that falls under HIPAA and 42 CFR Part 2, where a consent mistake is a legal event. The shared-spreadsheet answer was never available, so we built the platform with compliance engineered into the product rather than audited onto it.
- Client
- BPDS, LLC
- Industry
- Healthcare
- Duration
- Multi-tenant platform, phased
- Team
- Senior pod, FORGE + CITADEL
The challenge
What stood in the way.
Drug courts, probation and parole services, recovery housing and case management teams needed shared visibility of treatment engagement, adherence and retention. The data falls under HIPAA and 42 CFR Part 2, where the consent state at the moment of access is the thing an auditor asks about, and the platform had to meet State of New Hampshire DHHS requirements.
Our approach
How we framed it.
Compliance was treated as product scope, not a checklist at the end. Consent became a first-class record with its own event history; the audit trail was designed write-once and cryptographically chained before any feature was built on top of it; and the rules that programmes are measured against were modelled as data, with templates, so they could be added without a release.
The solution
What we built.
- Provider workstation: caseloads, check-ins, appointments and compliance in one place
- Administrator command centre: tenants, programmes, billing and the audit trail
- Rule-based compliance engine: 43 rules across 10 categories, each with measurement type, target, severity and auto-detection; violation monitor and client risk scoring
- Consent under 42 CFR Part 2 tracked as events: grants, expiries, revocations, renewals, reportable over any window
- Write-once, append-only, cryptographically chained audit trail retained seven years under HIPAA 164.312(b); integrity verified on a schedule; no user, including a system administrator, can edit or suppress an entry
- Angular portal, .NET services behind a REST API, PostgreSQL with Redis; WCAG 2.1 AA
Results
What changed.
A multi-tenant platform in production for BPDS, LLC, with providers and administrators on one system and an audit console that shows authentication, user activity, data access and consent changes with chain integrity verified.
Stack
Tools used in production.
- Angular
- .NET
- REST API
- PostgreSQL
- Redis
- HIPAA
- 42 CFR Part 2
- NIST 800-53
- WCAG 2.1 AA
Practices
Practices on the engagement.
Talk to us
Have a similar problem? Bring it to a senior engineer.
A senior engineer plus the relevant department lead joins the first call. No discovery gauntlet, no junior reps.