One app, one backend
A single Flutter application for appointments, prescriptions and teleconsultation. It runs on one consolidated backend in place of the three separate systems.
Healthcare app development case study
Three clinic systems replaced by one app — with audit logging from day one.
A clinic network's patient care was split across three systems that couldn't share data. We replaced them with one mobile app on a single backend (the server the app talks to), designed around the technical safeguards of HIPAA, the US health privacy law.
- 15,000+ active patients
- Every record access logged since launch
- Staff roles enforced on the server
- Flutter
- HIPAA
- Healthcare
In brief
- The client
- A healthcare clinic network offering appointments, prescriptions and teleconsultation (consultations held remotely).
- The problem
- Each service ran on its own system, and the three didn't exchange data. A single patient's care was spread across three places.
- The result
- One mobile app on one backend, built with Flutter (a toolkit for building apps). It now serves more than 15,000 active patients.
The challenge
Clinical data in one place, and a log of every read.
Bringing the data together raised the bar for protecting it.
One backend holding appointments, prescriptions and consultation records makes a better product. It also makes a bigger target. So when we merged the three systems, security design couldn't be pushed to a later phase.
Encryption, audit logging and role separation (what each staff role may see and do) had to be part of the architecture the app was built on. That is where the technical safeguards in the HIPAA Security Rule point anyway. Access control, audit controls and transmission security are requirements on the system itself.
What the brief had to solve
- Three systems, no shared data. Appointments, prescriptions and teleconsultation each ran on a separate system.
- Health records in one backend. Once the systems were merged, all of that data would sit in one place.
- A log of every read. Every access to a patient record had to be logged, not only changes to it.
- Roles that hold. Staff roles had to hold even if someone went around the app.
What we built
One app, with the safeguards in the architecture.
Three systems became one Flutter application, and the HIPAA technical safeguards went into the backend design.
Encrypted at rest and in transit
Patient data is encrypted where it is stored (at rest) and while it moves between systems (in transit).
Every read logged, roles held on the server
Audit logging covers every access to a patient record. Role separation is enforced on the server rather than in the app.
The impact
One application serving 15,000+ active patients.
Appointments, prescriptions and teleconsultation now run through a single application instead of three disconnected systems. Every access to a patient record has been logged since launch, and staff permissions are enforced by the server, not by the app on someone's phone. Figures are the client's own, as reported to us.
- 15,000+
- active patients
- 3 → 1
- clinic systems replaced by one app
- HIPAA
- technical safeguards in the architecture
The hard part
Audit logging is cheap early and expensive late.
In a new system, every read of a record passes through code you are writing anyway, so logging it is part of the design. In a live clinical system, adding it later means finding every path to the data while clinicians are using it.
Retrofitting that is not something we would want to quote for. Here, compliance shaped the architecture from the start instead of being bolted on at the end.
Related services
The services behind this project.
Planning something similar? Pick the need closest to yours.
- We want an app built with Flutter, like this one.Flutter app development
- We need a mobile app for our patients or customers.Mobile app development
- Our services run on separate systems that don't share data.Web and custom software
- Our software will hold health records and has to follow HIPAA.HIPAA compliance
- We run a clinic or health product and want software and security that fit healthcare.Healthcare
More case studies: the hotel management platform, the logistics operations platform, the smart home monitoring dashboard and the travel booking and itinerary app. Or see every case study.
Let's talk
Building software that will hold health data?
We design audit logging and access control before the first screen, when they cost least. Tell us what you are building and what it has to replace. We reply within one working day.