Building a HIPAA-Compliant Healthcare Platform at Scale
Meridian needed to replace a legacy patient management system with a modern platform that could handle 50K+ monthly appointments while meeting strict HIPAA compliance requirements.
-40%
Admin Overhead
Reduction in time spent on scheduling and billing tasks
99.97%
Uptime
Over 18 months of production operation
<800ms
Page Load
Average for the patient-facing portal
50K+
Appointments
Monthly appointments processed across facilities
The Business Challenge
The existing system was a monolithic PHP application with no test coverage, manual appointment scheduling, and a database schema that made multi-facility support nearly impossible. Patient data was stored in a single database with no encryption at rest, and the system regularly went down during peak hours.
Our Engineering Approach
We designed a microservices architecture with clear domain boundaries - scheduling, patient records, billing, and telehealth as separate services communicating via event-driven messaging. Each service owned its data store, enabling independent scaling and deployment.
Key Architecture Decisions & Tradeoffs
Event-driven architecture over synchronous APIs
Appointment scheduling triggers events consumed by billing, notifications, and analytics services. This eliminated the cascading failures that plagued the monolith and enabled real-time dashboard updates without polling.
PostgreSQL with row-level security over application-level access control
HIPAA requires audit trails and fine-grained access. Rather than implementing this in application code (which is error-prone), we leveraged PostgreSQL's row-level security policies to enforce data access at the database level.
Server-side rendering for the patient portal
The patient portal needed to work on low-bandwidth connections in rural areas. We chose Next.js with aggressive server-side rendering and edge caching to ensure sub-second load times regardless of the patient's connection quality.
“We interviewed eight agencies. Pixelpath was the only team that asked about our data model before asking about our budget.”
Sarah Chen
CTO, Meridian Health