Case Study: Building a HIPAA-Compliant Telehealth Platform for a Dallas Clinic

“

Meerako — Dallas-based 5.0★ experts in secure, HIPAA-compliant healthcare software.

Telehealth stopped being a "nice to have" line item on a hospital IT roadmap around 2020, and it has never gone back. Patients now expect a video visit to be as easy as booking an Uber; providers expect it to be as secure as a bank vault. A prominent, multi-location Dallas-based specialty clinic came to Meerako because their existing patient portal delivered neither. It was a bolted-together mix of a scheduling widget, a generic video-conferencing embed, and a fax machine for anything involving actual medical records.

They needed a new, custom-built telehealth platform that was secure, user-friendly, and 100% HIPAA-compliant — not "HIPAA-compliant" in the loose marketing sense vendors like to use, but compliant in the way that survives an actual audit.

This is a high-stakes field, and the numbers back that up starkly. Healthcare data breaches exposed 168 million patient records in 2025, and the average cost of a healthcare breach reached $10.93 million — the highest of any industry for the fourteenth consecutive year. HIPAA enforcement isn't theoretical either: OCR issued $148 million in total fines in 2025 alone, driven largely by the $126 million Change Healthcare/UnitedHealth settlement, the largest in HIPAA history, with the average settlement landing around $1.2 million. A data breach involving Protected Health Information (PHI) isn't just a bug fix and an apology email — it can mean six- or seven-figure fines, mandatory breach notifications to every affected patient, and a state medical board inquiry. Here's how Meerako's team delivered a platform the clinic's compliance officer could actually sign off on.

• The key challenges of building HIPAA-compliant software from the ground up, and what real enforcement data reveals about where breaches actually happen.
• The specific AWS architecture Meerako chose for security, auditability, and scale.
• How we built a seamless, real-time video experience without third-party video vendors.
• Our discovery-to-launch process, and why compliance review happened before a line of code shipped.
• The measurable results for the Dallas clinic and its patients.

Our client had three core problems, and the hard part was that solving any one of them in isolation was easy. Solving all three together, on a fixed budget, was not.

1. Compliance. Any system that creates, stores, or transmits PHI must adhere to the HIPAA Security Rule's technical, physical, and administrative safeguards. That governs everything from how data is encrypted at rest to who is allowed to see an access log — and it had to be true on day one, not retrofitted after a security review flagged problems. This matters even more given that risk analysis failures remain the single most cited HIPAA violation in enforcement actions industry-wide — meaning the organizations that get fined most often aren't the ones with exotic security failures, they're the ones that never did a rigorous risk assessment in the first place.
2. Scalability. The system had to support hundreds of concurrent video appointments across all of the clinic's Dallas-area locations, during the exact hours (early morning, lunch, and after 5 p.m.) when demand spikes hardest — without lag, dropped calls, or downtime that would send frustrated patients back to the phone queue.
3. Usability. The legacy tool was so unintuitive that both patients and physicians were avoiding it. The new app — web, iOS, and Android — had to work for a 25-year-old patient joining from a phone in a parking lot and a 65-year-old physician who wanted something closer to a landline than a tech product.

Before committing to a custom build, the clinic evaluated several turnkey telehealth SaaS platforms. Two problems ruled them out. First, most bundle video, scheduling, and billing into a rigid workflow that didn't match how this clinic's front desk actually operated across multiple locations — forcing the staff to adapt to the software instead of the other way around. Second, several vendors were vague about exactly which parts of their stack were covered under their Business Associate Addendum (BAA), which is precisely the kind of ambiguity a compliance officer cannot accept. A custom build meant the clinic owned its data, its infrastructure, and its audit trail outright — no third party in the loop who could change pricing, get acquired, or shut down a feature they depended on.

Our team of AWS-certified architects designed a zero-trust infrastructure — meaning no service trusts another by default, every request is authenticated, and every access to PHI is logged — to ensure HIPAA compliance at every layer, not just at the perimeter.

1. HIPAA-Eligible AWS Services, Under a Signed BAA

We signed a Business Associate Addendum (BAA) with AWS and used exclusively HIPAA-eligible services throughout the stack. This sounds like a formality; it isn't. Plenty of popular AWS services (and most third-party SaaS tools) simply aren't covered by AWS's BAA, and using one anywhere in a PHI-handling workflow creates an automatic compliance gap. We audited every service against AWS's published HIPAA-eligible list before it went near the architecture diagram.

2. The Core Architecture

• Data storage: All PHI (patient records, visit notes, charts) was stored in Amazon RDS (PostgreSQL) with encryption at rest (AES-256) and in transit (TLS 1.2+). Patient-uploaded files — medical imagery, lab PDFs — were stored in a separate, access-controlled S3 bucket with server-side encryption and versioning, so nothing could be silently overwritten or deleted.
• Backend API: The backend ran as a set of stateless, serverless AWS Lambda functions (Node.js) behind an API Gateway. We chose serverless specifically because it scales to zero cost during quiet overnight hours and scales out automatically during the after-work appointment rush, without anyone paging an on-call engineer to add capacity.
• Authentication: We used Amazon Cognito to manage every patient and provider identity, enforcing Multi-Factor Authentication (MFA), strict password policies, and automatic session timeouts — a HIPAA requirement that's easy to overlook until an auditor asks for it.
• Real-time video: We built on the Amazon Chime SDK, a HIPAA-eligible service that provides secure, encrypted peer-to-peer and group video/audio streaming. This let us build a fully white-labeled video experience inside the clinic's own app, rather than bouncing patients out to a generic Zoom or Doxy.me window with someone else's branding.
• Logging and auditing: Every API call and every access to PHI was written to CloudTrail and CloudWatch as immutable logs. When the clinic's compliance officer asks "who viewed this patient's chart, and when," the answer is a query, not a guess — a capability directly aimed at the risk-analysis and access-tracking gaps that drive the majority of real-world enforcement actions.

3. A Genuinely Usable Mobile and Web App

Architecture that's secure but unusable just pushes staff back toward insecure workarounds (email, personal phones, sticky notes). We used React Native to build a single, unified mobile app for both iOS and Android, which cut development cost and time-to-market roughly in half compared to two separate native codebases. The provider-facing dashboard was built with Next.js for a fast, SEO-friendly, and secure web experience.

Our design team ran structured interviews with the clinic's front-desk staff and a patient focus group before drawing a single screen. The result was an interface built around one clear action at a time — a single, unmistakable "Join Your Appointment" button rather than a dashboard full of competing options — because in usability testing, that was the single biggest source of patient confusion in the legacy tool.

Healthcare projects fail more often from scope and compliance surprises mid-build than from bad code. So before writing production code, we ran a structured discovery workshop with the clinic's clinical, administrative, and compliance stakeholders to map every workflow PHI would touch — intake, visit, follow-up, billing — and get sign-off on the compliance approach in writing. That upfront week saved weeks of rework later: two workflow assumptions we'd made in the initial proposal turned out to be wrong once we sat with the actual front-desk team.

From there, we worked in two-week sprints with a demo at the end of every sprint, so the clinic's team was using real, working software from month one — not reviewing static mockups. Security review wasn't a final gate before launch; it ran continuously, with our architects re-checking every new AWS service or third-party dependency against the BAA before it was approved for use. This continuous approach directly addresses the risk-analysis-failure pattern behind so much real-world enforcement activity — a one-time security review at the end of a project catches far less than ongoing review woven into every sprint.

One specific technical challenge is worth calling out in detail, because it's the kind of thing that separates a genuinely HIPAA-ready system from one that merely looks compliant. The clinic operates across multiple locations, and different staff roles — front desk, nursing, physicians, billing — legitimately need different, narrower slices of access to the same patient record. A front-desk staffer needs to see appointment and contact information but has no legitimate reason to view clinical notes; a billing specialist needs charge codes but not the physician's full visit narrative. Building role-based access control that's granular enough to satisfy this — and that produces a clean audit log showing exactly which role accessed which specific field, not just which record — took real, deliberate design work in the data model itself, not just a permissions checkbox bolted on at the API layer. Getting this right upfront avoided a genuinely painful retrofit later, since access control patterns woven into the original schema are vastly cheaper to build correctly than they are to add after the fact.

Within 60 days of launching the new platform, the clinic reported:

• A 45% increase in telehealth appointments booked and completed, as patients who'd previously given up on the old portal came back.
• A 70% reduction in patient-reported technical issues logged with the front desk.
• 100% HIPAA compliance with zero security incidents in the first year post-launch.
• A measurable drop in no-shows, since the simplified one-tap join flow removed the last-minute friction that used to cause patients to miss video visits entirely.
• Positive feedback from providers, who could now manage their full schedule and conduct appointments from a single, reliable dashboard instead of switching between three disconnected tools.

What mattered most to the clinic's leadership wasn't any single metric — it was that their compliance officer could finally point to a system with a complete, immutable audit trail, and their front-desk staff stopped fielding "I can't get the video to work" calls every morning. Given that the average healthcare breach now costs nearly $11 million and the average HIPAA settlement runs over $1 million, the value of that peace of mind is measured in avoided catastrophe as much as operational efficiency.

Building healthcare software is one of the most demanding — and most rewarding — categories of engineering work. It requires a partner that isn't just technically skilled, but is also a genuine domain expert in security and compliance, willing to say "no" to a shortcut that would look fine in a demo and fail an audit six months later — especially in a regulatory environment where the average breach costs $10.93 million and enforcement activity remains genuinely serious.

Meerako's 5.0★ rated team in Dallas has the proven expertise to navigate the complexities of HIPAA and deliver healthcare applications that are secure, scalable, and genuinely pleasant to use.

Ready to build your HIPAA-compliant digital health solution?