DocVilla: Building and Running a HIPAA-Compliant EHR and Telehealth Platform

This DocVilla case study is different from most on a software company’s website: the client is us. PS3G designed, built and operates DocVilla, a HIPAA-compliant cloud EHR, telehealth and practice-management platform used by medical practices across the United States. It is the clearest evidence we can offer of how we build: the same engineers, security reviews and release discipline we bring to client work run a regulated clinical system every day.

Product: DocVilla · Role: product owner, design, engineering, testing, operations · Status: live, actively developed

The problem

Independent medical practices run on a patchwork: a scheduler, a video tool for telehealth, a charting system, an e-prescribing service, a patient portal, a billing clearinghouse and a messaging app, none of which share a record. Every hand-off costs staff time and creates a compliance gap, because protected health information moves between vendors that were never designed as one system.

Practices needed one secure, cloud-based place for scheduling, the visit (in person or by video), the record, prescriptions, patient communication and billing, built to handle protected health information under HIPAA from the first line of code, and priced and sized for a practice rather than a hospital.

What we built

DocVilla is an all-in-one cloud platform for independent practices. Providers chart, schedule, see patients in person or by video, prescribe electronically, communicate securely and bill from a single system, with a patient portal and companion apps for patients and providers.

• Electronic health records: customizable, multi-specialty charting with templates and forms, e-prescribing and lab integration.
• Telehealth: HIPAA-compliant video visits built into the chart, on the same schedule as in-person visits.
• Practice management: scheduling, online booking, text and email appointment reminders, intake forms and a patient portal.
• Billing and revenue cycle: eligibility checks, claim submission and scrubbing, ERA posting, denial management and reporting.
• Integrations: health information exchanges, ICD-10 code sets, e-prescribing networks, labs, insurance eligibility and payment services.
• Security and compliance: HIPAA-compliant infrastructure, role-based access, audit trails and encryption in transit and at rest.

Practices can adopt the whole platform or start with one piece, such as the portal, the EHR or e-prescribing. The platform serves primary care, pediatrics, cardiology, dermatology, mental health and other specialties, and cash-based and insurance-based practices alike. DocVilla is a registered trademark of PS3G Inc.

Architecture and compliance

Three decisions shaped the build. First, it is cloud-hosted, because a practice should not run servers and because telehealth demand is uneven across a day and a week. Second, the platform was built on open-source and big-data technologies, which kept technology costs low, a saving passed on to the practices and patients using it, and gave us the data foundation for the reporting that practice management needs. Third, HIPAA was treated as an engineering requirement, not a policy document.

In practice that meant the Security Rule’s administrative, physical and technical safeguards were designed into the architecture: protected health information encrypted in transit and at rest, role-based access for each type of user, audit logging of who viewed and changed what, and business associate agreements with every vendor that touches that data. This is general information, not legal advice; the current HIPAA text and guidance are published by the US Department of Health and Human Services.

The platform is tested by the same testing center of excellence we use for client work, covering functional, security, performance and compatibility testing, because a defect in a clinical system is not a minor bug.

Results

DocVilla is in daily use by medical practices across the United States, and it is still being developed: new features ship on a regular release cadence, integrations are added as practices need them, and the platform has grown from telehealth into a complete EHR, practice-management and billing system. We do not publish usage figures.

The result that matters most to a prospective client is operational. Running a clinical platform means uptime commitments, release management, support, security reviews, business associate agreements and audits, every month, for years. That is the discipline we bring to the systems we build for others.

What this means for your healthcare project

Most vendors offering healthcare software development or EHR software development have built for a healthcare client. We have built and operated a regulated healthcare product, which changes the advice we give. We know which HIPAA controls cost the most to retrofit, where EHR and HIE integrations break, how e-prescribing and eligibility connections behave in production. That experience is available to clinics and groups, health-tech founders, medical-device and digital-health companies, payers and labs, at whatever scale the project needs.

• Healthcare software development: patient and provider apps, portals, telehealth, HL7 v2 and FHIR integrations, HIPAA-ready cloud architecture.
• HIPAA compliance consulting: risk assessment, policies and the technical controls a health-tech product needs before its first customer asks.

A founder planning a telemedicine software development project can start with a fixed-scope first version. A practice group that wants a custom portal usually needs a defined project with a maintenance plan. A device company or payer with EHR integration work may want a dedicated team that works inside its security and procurement rules. Each starts with a first conversation, a short assessment and a written proposal.

More build stories, including an IoT fall-detection system and our kids’ learning app, are in our case studies.