In healthcare software the compliance claim is the product decision, and most buyers are shown the wrong one. “HIPAA compliant” is a self-assessment. SOC 2 Type II, ISO 27001, ISO 13485 and HITRUST involve an independent auditor and produce a report with a date on it. HIPAA has no certifying body, so nothing and nobody can be “HIPAA certified”, whatever a sales page says.
No certifying body exists, so nothing can be “HIPAA certified”, whatever a sales page claims.
An outside auditor, and a report or certificate carrying a date you can ask for.
FHIR has dialects and HL7 v2 is still everywhere. Test against the instance, not the spec.
Sthenos is not SOC 2 attested. We build to the controls and hand you the evidence trail.
What we build for healthcare organisations
- EHR and EMR integration. Getting data in and out of Epic, Cerner, athenahealth and the rest, through HL7 v2, FHIR APIs or, when that is what exists, a nightly file drop.
- Patient-facing applications. Scheduling, intake, portals, messaging and remote monitoring, built so that the accessibility and consent requirements are designed in rather than audited out.
- Clinical workflow tools. Software that sits inside how clinicians already work, because anything that adds clicks to a consultation will not be used regardless of how good it is.
- Revenue cycle and operations. Eligibility, claims, coding support and the reporting that finance actually needs.
- Data platforms. De-identification, analytics and research datasets, with lineage you can show an auditor.
Interoperability is where healthcare projects actually fail
The engineering problem in this sector is rarely the application. It is that the data lives in a system somebody else controls, under a standard that permits enormous local variation.
- FHIR is a standard with dialects. Two conformant servers will still differ on extensions, cardinality and which fields are populated in practice. Budget for testing against the specific instance, not against the specification.
- HL7 v2 is still everywhere. A large share of real integration work is pipe-delimited messages, and the segments each site uses are a local decision.
- Access is a scheduling problem. Getting a sandbox, an interface engine slot and a willing counterpart at the vendor takes longer than writing the integration. Start it before you need it.
- Patient matching has no clean answer. There is no national identifier, so duplicates and near-matches are permanent operational realities that need a designed workflow.
What a compliance-ready build actually includes
| Requirement | What it means in the code | Cheap now, expensive later |
|---|---|---|
| Access control | Role and purpose-of-use checks on every route, enforced centrally | Retrofitting authorisation across an existing API is close to a rewrite |
| Audit logging | Who saw which record, when, and why, in a store nobody can quietly edit | You cannot reconstruct history you never recorded |
| Encryption | In transit and at rest, with keys managed outside the application | Key rotation designed in later means downtime |
| Data retention | Rules per data class, and deletion that reaches every copy including backups | Deletion requests are the hardest thing to bolt on |
| Business associate agreements | Every subprocessor that touches PHI, enumerated and covered | An unlisted vendor discovered during diligence stalls a deal |
We are explicit about our own posture rather than implying more: Sthenos is not SOC 2 attested, and we will tell you that in the first conversation rather than at procurement. What we do is build to those controls and hand you the evidence trail, so your organisation’s own audit has something to stand on.
How to compare healthcare software vendors
- Ask which certifications are audited and which are self-declared. Then ask for the report date. This one question separates most of the field.
- Ask what they have integrated with, by name and version. “Epic experience” and “we have been through an Epic App Orchard review” are different claims.
- Ask who on the team has worked under a BAA before. Handling PHI is a habit, not a policy document.
- Ask how they handle a deletion request. Watch whether backups come up unprompted.
- Ask where the engineers physically are. Data residency and BAA coverage both depend on it.
We published the side-by-side of what the visible firms in this category actually publish about themselves: healthcare software development companies, compared, with the gaps marked rather than filled.
Working with Sthenos on healthcare software
Sthenos Technologies builds healthcare software for organisations across Maryland and the Washington DC region, delivered through an established engineering partnership with NeoSOFT. If you are scoping an integration, a patient-facing product, or an audit trail you will have to defend, talk to our engineers. Related: what SOC 2 compliance actually requires and the production readiness checklist.