Cipher Medical operated several outpatient clinics and was running patient administration on phone calls, paper forms and a legacy scheduling system that patients could not touch. Appointment bookings consumed the front desk; patients who needed referral letters or test results collected paper copies in person. Leadership wanted a modern portal, but healthcare is the sector where 'move fast and break things' is a lawsuit: anything touching patient data had to be structured around HIPAA from the first schema, not retrofitted after a breach.
The brief therefore split into two inseparable halves. The functional half: appointment booking against real provider calendars, and a secure patient document vault where results and letters could be delivered instead of printed. The compliance half: encryption at rest and in transit, complete audit logging of every record access, role-based permissions, and hosting arrangements that could operate under a Business Associate Agreement. Accessibility mattered too — a patient population skews older, so the portal was built to WCAG 2.1 AA rather than the usual lip service.
Encryption in transit and at rest, field-level protection of health records, immutable audit logs of every access, and role-based permissions separating front-desk, clinical and patient views — designed for BAA-covered hosting from day one.
Real-time booking against provider calendars with specialty and location filtering, plus automated reminders that cut the no-show rate within the first quarter.
Test results, referral letters and discharge summaries delivered to an authenticated patient vault with expiring access links — replacing printing, posting and faxing.
Full keyboard navigation, screen-reader semantics, and contrast and type systems built for older patients — audited against the standard, not just claimed.
No-show rate within two quarters, driven by online booking and automated reminders replacing a single confirmation phone call.
Front-desk phone booking volume, releasing staff hours equivalent to a full-time hire across the clinic group.
Critical findings in the external security assessment conducted before go-live — the compliance-first architecture passed its first independent test intact.
// results vary by project — ask us how we measured this one
“Our assessor finished the audit early — there was nothing left to find. Patients book at 11pm, collect their own documents, and the front desk finally answers the phone.”
Practice Manager, Cipher Medical · name withheld under NDA — reference call availableLocal SEO, sub-second pages and a site that turns searches into booked work. Tell us what a new client is worth to you — we will build the machine that finds them.