The Compliance Trap: What Health Tech Founders Get Wrong About AI

[00:00:02] Evan Kirstel: Hey, everybody. Fun chat today as we talk about best practices and the cutting edge of building secure and scalable healthcare platforms and digital health products with a true industry insider. Ghazenfer, how are you?

[00:00:18] Ghazenfer Mansoor: I’m doing great. How are you, Evan?

[00:00:20] Evan Kirstel: I’m doing well. Thanks for joining. Very timely as we run up into industry events like ViVE and HIMSS and others. Of course, software and AI is at the center of much of the innovation these days. Before that, maybe introduce yourself, your background. You wear a number of different hats, so maybe you could share a bit about your journey, as well as who Technology Rivers is, your firm.

[00:00:45] Ghazenfer Mansoor: Okay, thanks. My name is Ghazenfer Mansoor. I’m a founder and CEO of Technology Rivers; our software development company primarily focused on healthcare software development. We work with health tech companies building HIPAA-compliant software products, and work with healthcare service businesses, helping them improve operations through AI and technology.

[00:01:09] Ghazenfer Mansoor: That includes building AI agents, clinical workflows, automation, that kind of stuff. So, the goal is to help them get 10X growth through AI and technology, because that’s really the differentiator in service businesses. Everybody has access to all those different tools and technologies, but the automation and the workflow improvement are the ones that create the differentiator that brings more efficiency into your processes.

[00:01:40] Ghazenfer Mansoor: That’s how you differentiate, because those are your very specific flows. So, we come in, and we help unlock those strategies, unlock those bottlenecks, look at all the manual stuff, and create those automations. Other than that, I am an author of a book, Beyond the Download: How to Build Mobile Apps That People Love, Use, and Share Every Day.

[00:02:04] Ghazenfer Mansoor: I’ve been involved in mobile since 2000, even before the iPhone and Android. Based on all those different experiences, we built around sixty different mobile apps since we started Technology Rivers in 2015. So there are thirty-plus different strategies that I shared in that book, including some of the latest AI technologies that you could use.

[00:02:32] Ghazenfer Mansoor: That book is really good for anybody who’s looking to build a mobile app, any app owner, if you’re looking to grow the app, because you can get people to download the app, but then are they coming back? That’s the main gist of it. And I’m working on two other books, one on 10X growth strategies, and one on healthcare in the AI era.

[00:02:59] Evan Kirstel: Brilliant topics. I’ll be sure to check those out. So why healthcare? What attracted you to problems in the healthcare space, in your work here, versus other industries or challenges?

[00:03:12] Ghazenfer Mansoor: I personally worked at the Veterans Health Administration before starting this business as a consultant. Then our second customer was a health tech company, and that’s how we got into more and more healthcare. Then we did a project for startups that came out of the Johns Hopkins Innovation Center, and that’s how we learned HIPAA. So once we started doing that, we got more and more leads in that space.

[00:03:38] Ghazenfer Mansoor: So gradually, our focus became healthcare and health tech, and that’s the area that requires a lot more innovation, a lot more work. It’s still way behind compared to many other industries.

[00:03:53] Evan Kirstel: Way behind. But let’s talk about software in general now. We’re in the midst of a revolution literally as we speak. You can’t help but notice the headlines in the media every day about software development being changed and disrupted fundamentally, about the impact on developers and software development. Before we talk speeds and fees in healthcare, what’s your take on this revolution, and how does it impact you and the way you design and build software?

[00:04:21] Evan Kirstel: How does it impact your clients? What’s your hot take, I guess, as we stand today?

[00:04:28] Ghazenfer Mansoor: I would say AI has impacted, or is impacting, everyone, but more in a good way. It’s empowering people rather than just doing things a different way. So, on our side, we look at it like we have a team of developers, and we’re using AI everywhere in different ways.

[00:04:52] Ghazenfer Mansoor: There’s a part you see on the content side, but then on the development side, we use different tools like Cursor for doing quick development. Claude Code is one of the most popular ones. We create POCs using these different vibe-coding tools, like Replit and Lovable, and there are quite a few others, like Emergent and a few more.

[00:05:14] Ghazenfer Mansoor: Then we also use tools like UX Pilot and Visily for creating quick POCs for the UX part, improving that. So everywhere in our whole development cycle, we’re using AI. We’re using AI for code coverage, for test cases, for unit testing. In many of these places, AI is helping us do things that we weren’t previously able to do. So it’s obviously changing the game everywhere.

[00:05:48] Ghazenfer Mansoor: It does come with its own challenges as well, because if you just upload documents into ChatGPT and run a query, a lot of people are still using AI like a Google search. But how you use it better makes a difference.

[00:06:07] Ghazenfer Mansoor: And it’s the same on the development side. You can use AI to generate code, but how do you take that code and convert it into something usable for your specific use case? Or are you using these vibe coding tools to just generate something that’s throwaway? No.

[00:06:26] Ghazenfer Mansoor: There are techniques, and that’s where only a small percentage, maybe 5% of people, are using it in a way where they figure out the depth of these tools, get to know the specifics of how they work, so that as they’re building, they’re not making it throwaway code, but extending it to the next level. Another place where we use it, we use the design and convert it into code, which in the past was also available, but the code quality was bad.

[00:06:54] Ghazenfer Mansoor: Now you can use our own code and train AI to give you code out of the design that is similar to our own coding standards and practices, and that will help it grow and expand rather than just getting something done quickly.

[00:07:10] Evan Kirstel: Interesting. So obviously, so many benefits. What are the risks and challenges? You’re intimately involved with making HIPAA, compliance, security, and data protection into products and services. Does it slow things down a lot, or does AI really help in this regard?

[00:07:32] Ghazenfer Mansoor: I think the industry is going through a phase where there is a hype that AI can do everything, that you can do projects in hours and days compared to how it used to be. And now people have come to the realization that it’s not that easy. It has its own complications as well. Not every use case is a ChatGPT chat case where you just put in everything and load it. Because it’s like when you’re uploading.

[00:07:57] Ghazenfer Mansoor: You’re testing your application with maybe two users, and when you have a million users on your application, suddenly there’s a different case. With ChatGPT, you’re loading two documents and doing a query, and you get the results. But what if you’re loading your whole company’s data, and now you have millions of those documents, and suddenly it’s going to fail?

[00:08:18] Ghazenfer Mansoor: It’s not practical. So now you have to use different strategies. Those are the complications. There are different use cases for how you use AI to review or analyze your internal data, whether it’s PHI data or any other internal data. And how do you use AI to query it? And so that’s where most of those AI projects are also failing, because that’s a use case not everybody is familiar with, in terms of the different architectural implementation strategies that you have to follow.

[00:08:55] Ghazenfer Mansoor: You can’t just be uploading, because anything you upload into AI, whether through an API or another way, is being used for training the LLM.

[00:09:04] Ghazenfer Mansoor: That’s your private data. So, you have to use different strategies, whether it’s using RAG architecture, vector databases, whatever. These are different strategies that you have to use. And even then, you can’t just be getting any type of data out of it. You have to train the data, save the data in such a way that you can also search it later on.

[00:09:24] Ghazenfer Mansoor: So, you have to know those use cases. The other challenge on the development side is that as you’re generating the code, let’s say AI generates the code, it may override the existing one. It has to know the context. So again, the same challenge: just getting the query and getting the result doesn’t mean…

[00:09:44] Ghazenfer Mansoor: You get the good thing, but now you have existing data as well. You have millions of lines of code already doing certain things. There has to be human involvement. Without the human involvement, you’re going to be making more mistakes. And that’s where people started generating things faster and then suddenly realizing, oh, now it started behaving something different, because there were certain things that were done in a way the developer didn’t pay attention to, and now you have to go back, figure out, fix it.

[00:10:12] Ghazenfer Mansoor: Then you realize you’re spending more time identifying those problems than what it took initially to build that. So, knowing the context, having the right strategy, having the right mapping, those things do make a difference.

[00:10:28] Evan Kirstel: I bet. So, it sounds like you’ve seen a lot in your many years in this space. You mentioned some of the mistakes. What other big mistakes are health tech companies or startups making when developing their first product? You must see some themes over and over again.

[00:10:45] Ghazenfer Mansoor: I think the bigger one is really a lack of clarity, clarity of the requirement. Because if you don’t define what you want to build, you’re usually not going to be getting the right output. So you have to know initially, before starting, what the expected outcome is that you’re trying to reach. But the majority of projects fail because of unclear requirements. Once the requirements are not clear, obviously it could be interpreted in many different ways. That’s a very common thing. Ownership is another one.

[00:11:16] Ghazenfer Mansoor: Who actually owns it? Who actually drives the direction of those projects? Those are the common mistakes. It could come down to bad design. It could be a bad user experience. It could be a crashing product. It could be not being able to launch because there are too many features, too complicated. All of those are the specific reasons that come out of those core things. Once you have the right requirements, the right product management, the right direction, then these things automatically get fixed.

[00:11:52] Evan Kirstel: Interesting. You mentioned you do a lot of app development, and of course, user interface and user experience are a big part of that. Historically, healthcare has been terrible, you’d call it, patient experience, but really it’s user experience. Just look over your doctor’s shoulder over the years, and you’d see what they’d have to go through in various portals and other interfaces to get things done. It was really tough to watch.

[00:12:21] Evan Kirstel: I think the industry seems to be getting better, but how do you approach UX and UI? What’s your philosophy there, not just for patients, but for admins, clinicians, and all the people who need to use this software?

[00:12:43] Ghazenfer Mansoor: Everybody wants a simple, slick experience, but anything that’s simple is the hardest, and that’s the part. And then there’s a balance between what is simple versus what information is needed. Simple doesn’t mean you don’t have the main information. So there’s a balance that needs to be struck. I think the most important part is really figuring out who your users are. Are you building something for senior citizens?

[00:13:10] Ghazenfer Mansoor: Are you building something for kids? Are you building something for patients of a certain age, a certain education level? All of those things matter. I’ll share one example. We’ve been through the age of Craigslist, which was very traditional. Everybody used it. People were on it all the time.

[00:13:33] Ghazenfer Mansoor: But it had a horrible interface. It worked for what it was. So, what the users want isn’t always a nicer interface, but what works for them. That’s the most important part. You can have a beautiful application, but if it’s not really fulfilling the need, it’s not giving the experience, it’s not going to be useful.

[00:13:58] Ghazenfer Mansoor: And if you have an amazing experience but it looks horrible, it will probably still work, but it depends, because the other side comes into play too. So, it’s a combination of both. Since the iPhone, Apple changed all of this, and now people look for both of those.

[00:14:21] Ghazenfer Mansoor: Having the right experience, building a remarkable app experience, does make a difference, and that’s one of the things I also talk about in my book, because having a nicer interface does bring more attraction from the user, and there will be more adoption, as long as it’s doing the core thing that it’s supposed to do.

[00:14:39] Evan Kirstel: Yeah. You only have to look at Apple Health and the major breakthroughs that they’ve achieved just through user interface design and accessibility. It’s been amazing to watch. I heard you reference Lovable and low-code, no-code kinds of approaches. Do you see customers scaling from an MVP right to production without having to actually write code, with things like Lovable? Or are they more for prototyping in healthcare, or maybe early design?

[00:15:16] Ghazenfer Mansoor: It’s doable, but not many people are able to do it. As I was mentioning earlier, probably a very small percentage of people are able to get to that level. Again, that’s where you need more of a solution architect type of person, or a product person, who can actually articulate those things, how you want it. It’s like when you’re doing the right prompting, obviously you can get the results, but that also means you need to know how you want your code to be generated.

[00:15:51] Ghazenfer Mansoor: So, for example, as you’re generating these applications with Lovable, Replit, and other tools, there’s a database structure behind it, like whether it’s Supa base or whatever you use. It creates a database structure. For example, let’s say our requirement is that the reference table should be in a certain format, the column names should be like this, or you need audit fields, any of those kinds of things. Or how do you want your functions to be written so that you can convert them into APIs later on?

[00:16:25] Ghazenfer Mansoor: Only technical people know that pattern. There’s a gap, because the product people are the ones who can articulate those things well, and developers are the ones who can execute them better. It’s a combination of those people that gets it done well. What we’ve seen mostly is non-technical people, entrepreneurs and others, building their ideas. So, for me, that seems more like a replacement of your traditional requirement clarification process, a replacement of sketches.

[00:16:53] Ghazenfer Mansoor: Rather than having those sketches, now you can articulate the problem through these tools and say, “Okay, here’s my first version that I’m envisioning,” but it’s bare bones. It has the front end, the back end, the admin, everything in different tabs, and you’re just able to elaborate on your idea. Okay, this is what I want. Now I want it converted into a real production application. And that’s where I think the opportunity is.

[00:17:22] Ghazenfer Mansoor: You can take those POCs and convert them into a real production one. It could be enhanced right there. And then there is a time when you actually take that and convert it, maybe moving into Cursor and using other tools to actually do the build and deploy, because as you keep vibe coding, it will get you to a certain state, and at some point, you have to convert.

[00:17:49] Ghazenfer Mansoor: But you don’t want to be throwing away what you already built. You want to take that and move it to production. And that’s where we come in. We not only convert those into production-ready applications, but we also make them HIPAA compliant, because the tools will just give you the flows, but these applications don’t by default follow HIPAA regulations, whether it’s audit logging or authentication audit.

[00:18:18] Ghazenfer Mansoor: There are certain things, but they’re not following HIPAA regulations. So we take those vibe-coded tools and convert them into HIPAA-ready, production-ready applications.

[00:18:30] Evan Kirstel: Brilliant. Sounds like a great formula for success. I’m sure you’re intimately familiar with integrating with EHRs and all the various healthcare data standards. Where are we? Are things opening up? Are you getting the kind of integrations you need for clients? And are we finally getting the interoperability that we’ve been talking about for years and years?

[00:18:57] Ghazenfer Mansoor: I think it really depends on the vendors. There are a lot of those EMRs, EHRs, and they have APIs. So that part is already there. People are already building applications and integrating. If those vendors aren’t providing that, they’re probably not going to get the market share, because if people can’t integrate, nobody’s going to use those. So that problem isn’t there. I think what AI is bringing is building something on top of that, a concept called MCP, Model Context Protocol.

[00:19:31] Ghazenfer Mansoor: So MCP is like an API for AI, just like APIs are your interface to a typical application. MCP would let you query your database, your application, through any AI console, like the Claude console or ChatGPT. And then, obviously, you can also integrate it with your application. So now, if applications are exposing MCP, your application can connect, and include chatbot functionality inside your application. So that’s a big innovation, and it’s a very exciting innovation that people are leveraging now.

[00:20:19] Evan Kirstel: Brilliant. Sounds like a great opportunity. So what’s next? What are you looking forward to over the next weeks and months? I know you’re headed to ViVE, the big meeting of healthcare IT and practitioners. What are you thinking about as you head into ViVE, and what are you excited about for the rest of the year?

[00:20:39] Ghazenfer Mansoor: Thanks. Going to ViVE, there are a lot of opportunities in the healthcare space. There are a lot of things happening. I think one of the opportunities we’re seeing is that a lot of people are talking about clinical workflow implementation. That’s one of the most in-demand areas at this time, as well as building applications that have more predictability. We’re building different applications. We’re loading personal health data, using AI for deep research, prediction of medicine, and other things. Obviously, the recommendation has its own…

[00:21:20] Ghazenfer Mansoor: There are caveats in terms of what could be shared and what not. That’s a legal matter, but those types of applications are in more demand nowadays. So we’re creating those different applications. We’re excited about all of these opportunities, and I’m sure they’ll increase more and more. So our goal is to go to ViVE, HIMSS, and other conferences, and talk about what we’re working on, whether it’s workflow implementation with AI agents, or converting vibe-coded applications into HIPAA-compliant applications.

[00:21:55] Evan Kirstel: Brilliant. Well, have a great show. Thanks for giving us your insight and opinion, your unfiltered experience. Really helpful, and I appreciate it. Let’s keep in touch on social media.

[00:22:08] Ghazenfer Mansoor: Absolutely. Thanks for having me, Evan.

[00:22:10] Evan Kirstel: Thanks for being here, and thanks everyone for listening and sharing. Also, check out our TV show, TechImpact.tv, on Bloomberg Television and Fox Business. Thanks, everyone. Thanks, Ghazenfer.

[00:22:23] Ghazenfer Mansoor: Thank you.