A HIPAA-ready telehealth platform for employer health plans

The challenge

360 Medical serves employers whose employees and dependents are the patients. They needed a platform that could take in employer eligibility rosters, link patients to their EHR charts, and support chat and telehealth, without turning the backend into a store of clinical records.

What we built

• ✦Patient app for iOS and Android in React Native with Expo and EAS, and a Next.js portal for the care team
• ✦A single Fastify API on ECS Fargate as the trust authority, with the dev, staging, and prod AWS accounts fully isolated
• ✦Eligibility ingestion from per-client, IP-allowlisted SFTP through S3 and SQS
• ✦Live athenahealth EHR lookups, plus chat, telehealth, and payments through vetted processors

Security & compliance

• ✦Clinical records are fetched live from the EHR and cached in memory for at most 60 seconds. They are never written to disk
• ✦Everything stored at rest is KMS-encrypted in RDS and S3, with pgAudit and WORM audit logs
• ✦Separate Cognito pools for staff (MFA required) and patients
• ✦WAF and TLS 1.3 at the edge, private subnets for compute, and no PHI in push notification payloads
• ✦A documented trust-boundary review for BAA scoping, plus SOC 2 change-control evidence

Stack