HIPAA
The US law that protects patient health information. We build in access controls, audit logs, and encryption wherever patient data is stored or shared.
HITECH
Extends HIPAA with breach notification and stronger enforcement. We design alerts and incident records so you can meet reporting deadlines.
FDA Part 11
FDA rules for electronic records and signatures. Software for regulated use gets validated workflows, secure sign-off, and tamper-evident histories.
EU MDR
The European rules for medical devices, including software. We keep technical documentation, risk files, and traceability current from the first sprint. This is a core part of how we approach medical software development for device makers, and a question many teams ask when comparing medical device software development companies.
42 CFR Part 2
Extra confidentiality rules for substance use disorder records. Consent and data-segmentation controls keep these records limited to the right people.
ONC Cures Act
US rules against information blocking and for patient data access. We build open APIs so patients and partner systems can get data lawfully and easily.
GDPR
Europe's data protection regulation. We build consent, data export, and deletion into the product, and keep personal data to what is needed.
SOC 2
An audit of how a company protects customer data. Our delivery process produces the change records, access reviews, and monitoring evidence auditors ask for.
ISO 27001
The international standard for managing information security. We follow documented risk assessment and control practices across every project.
HITRUST
A certifiable framework that combines HIPAA, NIST, and ISO controls. We map your software's controls to it so assessments move faster.
NIST CSF
A US framework for identifying, protecting, detecting, and responding to cyber threats. We use it to structure security planning and incident response.
PCI DSS
Rules for handling card payments. We keep card data out of your systems by using hosted payment providers wherever possible.
HL7 v2
The long-standing messaging standard used by hospital systems. We build and test interfaces for admissions, orders, and results.
FHIR R4
The modern web API standard for health data. We expose and consume FHIR resources so apps and record systems can exchange data cleanly.
DICOM
The standard for medical images and their metadata. We build viewers and image pipelines that work with scanners and archives.
SNOMED CT
A clinical vocabulary for coding diagnoses, findings, and procedures. We map your data to it so records mean the same thing across systems.
LOINC
Standard codes for laboratory tests and clinical measurements. We use them to make results comparable across labs and providers.
ICD-10
The international classification of diseases used for diagnosis and billing. We build code search and validation that cut coding errors.