Virtual Mental Health Support During Motherhood

Strategy

Development

Integrations & Interoperability

The Problem

When it comes to virtual care, protecting the patient's private health information (PHI) is a key issue. Seven Starling needed to revamp their platform and tech stack to guarantee HIPAA Compliance.

This process included ensuring every tool and third-party provider involved complied with HIPAA regulations.

The Solution

As a digital healthcare product development agency and advisor, we helped Seven Starling's team make tough decisions regarding their tech stack & integrations. We analyzed their current tech ecosystem, proposed alternatives, and made adjustments.

We worked side-by-side with Seven Starling's team to define a new tech stack and make the integrations with the systems. These integrations included an EHR, a medical billing platform, an appointment scheduling tool, a marketing platform, and a payment gateway.

Tech Stack

Laravel

Nginx

Docker

AWS

Datadog

Tools that needed the custom integration

Online Appointments
Scheduling

Sends info

Customer Experience
Automation

Sends info

Electronic
Health Record

ilustration of a screen showing medical information

Info
exchange

Medical Billing
Platform

For security, some of the main services used where:

Web Access Control Lists acting as firewalls.

Load balancing ensuring no direct access to the servers.

HTTPS required for connections with the load balancer.

Aggressive security rules for each resource disabling all traffic as default and only allowing required traffic, including preventing all ssh access to servers.

Isolated Virtual Private Clouds to segregate environments.

AWS Inspector to detect vulnerabilities in all docker images utilized.

Database-level encryption.

To ensure complete logging, monitoring and adaptability:

Application-level RFC5424 compliant logging streamed directly to cloudwatch

Server (nginx) specific logging also streamed to cloudwatch

Cloudwatch alarms from previous logs (such as non 2xx responses from the server, or any log with a level of NOTICE or higher) with SNS email notifications

Infrastructure monitoring, such as database and server CPU usage, or database storage, also with enabled notifications

Database daily backups

Datadog’s Cloud Workload Security to detect key signals of an intrusion, including, but not limited to: new shell spawned, file integrity monitoring, binaries executed (curl, netcat, dig, passwd)

Solution tech's specifics

We led tech decisions and helped with product development while working under Agile methodologies.

This process consisted of 2 steps:

First, delegate all PHI storage to external services that were already HIPAA compliant. While no PHI was stored in our servers, the PHI still went through them to set up the different integrations.

Second, ensure the system's security and audibility. The team fulfilled this requirement using several AWS features and other external services.

After successfully completing the initial scope and its implementation, we continue to collaborate with Seven Starling as their tech partner, actively improving the product and adding new features.

Results

A secure, private, and HIPAA-compliant platform that meets US law standards for safeguarding patient health data.

A new tech stack that took the app to the next level was defined and implemented.

“Light-it added valuable engineering capacity and expertise to our team. They were able to flexibly scale up and down with our needs and were valuable thought partners in our compliance journey. They always ask for the “why” behind technical decisions and help us find the most efficient, secure, and scalable solution for our objectives. I’d highly recommend Light-it to other startups and founders.”