Skip to content
AtheronLABS

You're visiting from the United States. Prices are shown in US dollars. Not right?

labs@atheron:~/industries/healthcare/compliance$ audit --controls --evidence

Healthcare compliance

HIPAA-ready and PHIPA-aware engineering for health data.

Health information carries duties under laws such as PHIPA in Ontario and HIPAA in the United States. Neither is a certification anyone can grant. What we do is build the safeguards in: access by role, every view logged, consent recorded, encryption, retention, and the documentation your privacy officer needs.

Start a projectSee the example projects

// what matters here

What is different in this industry.

01

Every view logged

Access logs that show who looked at a patient's record and when, kept as your retention policy says.

02

Consent recorded

What each patient agreed to, when, and its withdrawal, with the system respecting it everywhere.

03

HIPAA-ready architecture

Hosting on services that sign the agreements HIPAA expects, encryption at rest and in transit, and safeguards documented for your compliance team.

04

Your privacy assessment, supported

We provide the data flows and safeguards your privacy impact assessment asks for; your privacy officer leads it.

// example projects

Priced examples for this service.

Each one is hypothetical, labelled as such, and priced live from our rate card. Open any of them in the estimator and make it yours.

Example projectWeb appMobile app

Patient portal with a mobile app

Hypothetical. Not a client, not a result.

// The problem

A group of physiotherapy and dental clinics books every appointment by phone, sends reminders by hand and collects intake forms on clipboards in the waiting room.

// What we would build

A patient portal and an iOS and Android app for booking, intake forms, reminders and payments, connected to the clinics' practice management system so the front desk sees one calendar.

// What is in it

  • Online booking against real clinician availability, per clinic
  • Intake and consent forms filled in before the visit, stored with the chart
  • Reminders by push, text and email, with rebooking from the message
  • Payments and receipts for services not covered by public plans
  • English and French throughout
  • Health data hosted in a Canadian region, with access logged

// Stack

  • Next.js
  • React Native
  • PostgreSQL
  • Practice management system API
  • Stripe
  • AWS (Canada region)

// estimate

Build
≈ US$182,000 to US$278,000, delivered within 29 weeksCAD 258,500 to 395,500
Hosting
≈ US$492 a monthCAD 700 a month
Support
≈ US$2,500 a monthCAD 3,565 a month

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery
2.9 to 3.4 weeks
Design approved
7.4 to 12.4 weeks
Core features
1.9 to 2.9 weeks
Full build
1.4 to 1.9 weeks
First build on devices
3.4 to 6.4 weeks
Testing and fixes
0.4 to 0.9 weeks
Store submission
0.4 to 0.9 weeks
Controls built and evidenced
0.9 weeks
Readiness review
0.9 weeks
Launch
0.9 to 1.4 weeks

Outside our hands, and added to the calendar

App store review
1 week
EHR vendor approval and test access
1 to 4 weeks
Booking a penetration tester and their report
2 to 4 weeks

How it is paid

Deposit 20%
CAD 51,700 to 79,100
Discovery 7.2%
CAD 18,612 to 28,476
Design approved 7.2%
CAD 18,612 to 28,476
Core features 5.9%
CAD 15,251.50 to 23,334.50
Full build 3.9%
CAD 10,081.50 to 15,424.50
First build on devices 15.6%
CAD 40,326 to 61,698
Testing and fixes 1.9%
CAD 4,911.50 to 7,514.50
Store submission 5.2%
CAD 13,442 to 20,566
Controls built and evidenced 7.7%
CAD 19,904.50 to 30,453.50
Readiness review 7.7%
CAD 19,904.50 to 30,453.50
Launch 7.7%
CAD 19,904.50 to 30,453.50
Holdback, 30 days after launch (10%)
CAD 25,850 to 39,550
Start from this example
Example projectWeb appAIOpen-source model

Private clinical note assistant

Hypothetical. Not a client, not a result.

// The problem

Clinicians spend their evenings finishing notes, and the clinic cannot send recorded visits to an outside AI service.

// What we would build

An assistant that transcribes the visit with the patient's consent and prepares a structured note for the clinician to review, edit and sign, on open-source models running on a GPU server in the organisation's own data centre, so no audio or text leaves it.

// What is in it

  • Consent captured before recording, and recording that stops on request
  • Speech to text and a structured note in the clinic's own templates
  • The clinician reviews, edits and signs; nothing is filed without them
  • Notes filed to the EMR through its interface
  • An evaluation set from real, de-identified visits, run before every change

// Stack

  • Whisper (open-source)
  • Llama or Qwen (open-source)
  • vLLM
  • Next.js
  • Lenovo GPU server on site

// estimate

Build
≈ US$155,000 to US$236,000, delivered within 39 weeksCAD 221,000 to 336,500
Hosting
≈ US$176 a monthCAD 250 a month
Support
≈ US$2,500 a monthCAD 3,565 a month
Hardware
≈ US$47,800 to US$197,000CAD 68,000 to 280,800

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

AI route
Open-source model
Model running cost
≈ US$176 a monthCAD 250 a month

Timeline by milestone

Discovery
2.9 to 3.4 weeks
Specification and evaluation plan
0.4 weeks
Design approved
2.4 to 4.4 weeks
Core features
1.4 to 2.4 weeks
Full build
0.9 to 1.4 weeks
Working pilot
4.9 to 8.4 weeks
Testing and fixes
0.4 to 0.9 weeks
Controls built and evidenced
0.9 to 1.4 weeks
Readiness review
2.9 to 14.4 weeks
Launch
0.9 to 1.4 weeks
Production
0.9 to 1.4 weeks

Outside our hands, and added to the calendar

Hardware delivery, after it is ordered
2 to 6 weeks
EHR vendor approval and test access
1 to 4 weeks
Business associate agreements with your vendors (HIPAA)
2 to 6 weeks
Booking a penetration tester and their report
2 to 4 weeks

How it is paid

Deposit 20%
CAD 44,140 to 67,240
Discovery 1.5%
CAD 3,310.50 to 5,043.00
Specification and evaluation plan 8%
CAD 17,656 to 26,896
Design approved 1.5%
CAD 3,310.50 to 5,043.00
Core features 4.6%
CAD 10,152.20 to 15,465.20
Full build 3.1%
CAD 6,841.70 to 10,422.20
Working pilot 24.2%
CAD 53,409.40 to 81,360.40
Testing and fixes 1.5%
CAD 3,310.50 to 5,043.00
Controls built and evidenced 7.7%
CAD 16,993.90 to 25,887.40
Readiness review 7.7%
CAD 16,993.90 to 25,887.40
Launch 1.5%
CAD 3,310.50 to 5,043.00
Production 8.7%
CAD 19,200.90 to 29,249.40
Holdback, 30 days after launch (10%)
CAD 22,070 to 33,620
GPU time for training and testing, at cost
CAD 300. Billed up front, at cost, outside the milestones
GPU server for AI, for the model
CAD 68,000 to 280,800. Billed up front, at cost, outside the milestones
Start from this example

// questions

Questions we get about this.

Can software be certified for HIPAA?

No. HIPAA is a law, and there is no certification for it. We build HIPAA-ready architecture and support your compliance work; your organization remains responsible for compliance.

Where is patient data stored?

In the region you need, usually Canada for Canadian providers, documented with every backup and service provider.

Can you sign a business associate agreement?

For US work where we handle protected health information on your behalf, we discuss the agreement with you before any data is shared.

Back to the industry: HealthcareAbout the service: Compliance and security engineering

// next

Not quite your project?

Tell us what you have in mind. We will come back to you with a range and the questions that would narrow it. Or book a call and talk it through.

Start a projectBook a call
HIPAA-ready and PHIPA-aware healthcare software engineering | Atheron Network Labs