How To Build HIPAA-Compliant Healthcare Software

apple
spotify
partner-share-lg

About The Guest

Ghazenfer Mansoor is the Founder and CEO of Technology Rivers, a software company developing HIPAA-compliant web, mobile, and cloud-based healthcare software applications. As a seasoned advisor and investor in technology and healthcare, he has fulfilled roles as an architect, programmer, software engineer, user experience specialist, product developer, growth hacker, and chief technology officer.

About The Episode

Developing software in regulated industries presents both opportunities and risks. Founders and leaders are pressured to innovate while protecting sensitive data, meeting compliance standards, and delivering adoptable products. How can you balance speed, innovation, and long-term performance without compromising trust or usability?

 

Mobile software developer Ghazenfer Mansoor urges leaders to start with clear requirements, workflows, and compliance guardrails before writing a single line of code. He also recommends focusing on retention over features, using AI to empower teams rather than replace them, and reducing friction through UX and conversational interfaces. Through these approaches, teams can build secure, scalable, and valuable software for users.

 

In this episode of Lessons From The Leap, Chad Franzen of Rise25 hosts Ghazenfer Mansoor, Founder and CEO of Technology Rivers, to discuss building scalable, compliant, and user-focused software. Ghazenfer talks about HIPAA compliance challenges, why retention matters more than launch, and how AI and conversational UI are reshaping modern product design.

What You Will Learn
Quotable Moments:
Action Steps:
  1. Define clear requirements before development begins. This prevents misalignment between teams and stakeholders. They reduce rework, control costs, and significantly increase the chances of building the right product.
  2. Prioritize user retention over feature expansion: Focusing on retention ensures the product delivers ongoing value, not just a successful launch. Retained users validate product-market fit and drive sustainable growth through referrals.
  3. Use AI to empower teams, not replace them: Leveraging AI to accelerate coding, testing, and documentation improves efficiency and quality. This approach reduces burnout while allowing teams to focus on higher-level problem-solving.
  4. Build compliance into workflows from day one: Embed security, audit logging, and access controls early to prevent costly retrofits later. It also builds trust with users and stakeholders in regulated industries.
  5. Design workflows before designing interfaces: Starting with workflows ensures the product solves real operational problems. This leads to simpler interfaces, faster adoption, and more scalable solutions.
Sponsor for this episode...

This episode is brought to you by Technology Rivers, where we revolutionize healthcare and AI with software that solves industry problems.

We are a software development agency that specializes in crafting affordable, high-quality software solutions for startups and growing enterprises in the healthcare space.

Technology Rivers harnesses AI to enhance performance, enrich decision-making, create customized experiences, gain a competitive advantage, and achieve market differentiation. 

Interested in working with us? Go to https://technologyrivers.com/ to tell us about your project.

Episode Transcript

[00:00:15] Chad Franzen: Hello and welcome to Lessons from the Leap. I’m Chad Franzen. Today I will be your host and I’ll be interviewing your regular host Ghazenfer Mansoor.

On this show, we sit down with entrepreneurs, founders, and business leaders to talk about the bold decisions, pivotal moments, and innovative ideas that shape their journeys. This episode is brought to you by Technology Rivers. At Technology Rivers, we bring innovation through technology and AI to solve real world industry problems.

We do this in two main ways. First, by helping businesses streamline and automate their operations and second, by partnering with startup founders, entrepreneurs, and product owners to create innovative software products from SaaS platforms to web and mobile apps. A big part of our focus is in healthcare, where we work with health tech companies to build secure and HIPAA compliant software products.

If you’d like to learn more and work with us. Head over to technologyrivers.com and tell us about your project. Hey, Ghazenfer, it’s great to talk to you again. How are you?

[00:01:11] Ghazenfer Mansoor: I’m doing good. Thanks Chad. Thanks for hosting the show today.

[00:01:16] Chad Franzen: Sure. Thanks for having me. Hey, I’m looking forward to diving into a few of the things that you specialize in.

Why don’t we just get started with maybe some challenges. What are the biggest challenges, would you say when building a HIPAA compliant software for mobile and web? As I just alluded to in the intro.

[00:01:32] Ghazenfer Mansoor: So I think the bigger part is understanding the compliance part. Because HIPAA is not new.

It’s been a while. So it started with obviously the traditional paper, the rules and regulation, they got updated. Now you have a web, then mobile. So if you mobile device, you could lose any time. So obviously there are different rules and then AI comes in and then there are a whole lot of regulations that need to be, the regulations need to be updated, so if they’re not updated, obviously there are still loopholes in that.

But in comes in terms of building those, building the applications, it’s really knowing what that process is. How do you make sure the app is HIPAA compliant? There are so many complicated scenarios that come in terms of HIPAA compliant, like what tool you’re using, where do we should sign base? So where the data, there’s a data, where the data is residing in terms of caching, storage, transit, like all of those things.

So there are so many nuances along the way, so you need to be familiar. So in our business we have a multiple checklist for different people in the company. Like so for example, for developers, there’s a checklist they have to go through in terms of what needs to be looked at when it comes to developing for PMs and requirements.

There are QA people, everybody in the company has to be familiar with those checklist items that are related to their specific task.

[00:03:18] Chad Franzen: I know Technology River started in mobile app development. How has kind of the evolution to web, a cloud and AI driven products changed your approach?

[00:03:27] Ghazenfer Mansoor: Naturally, every mobile application will have some kind of a backend portal, like so there are APIs, there are portals, there are integrations.

So mobile is just another interface to the backend system. So and it’s obviously more complicated than just the traditional simple web application because now you have a device which has its own storage as well. So you treat a web application as a desktop application that you download, for example, on a Microsoft Word or Zoom software, anything on your computer.

You need updates. You need to make sure the day people who are using the older version, they are familiar. The people who are using the older version, as the apps get updated, they update their data or that your app has to be backward compatible with those. So all those nuances can make it a little bit more complicated.

So now if you’re saying, going from mobile to web, obviously that’s actually an easier transition because we all come from web, mobile was an add-on. So we started mobile because that’s a uniqueness we had in our business. I came from a mobile background, so I started mobile in 2000 way before iPhone and Android came.

So based on those experiences, that’s why we started as a mobile app to open a company. So, and then I think now AI comes in, AI is everywhere, not just in the mobile or web, it’s pretty much everywhere in all the fields.

[00:05:15] Chad Franzen: Yeah. Very interesting. So when you’re working with clients or other businesses and you’re advising them, how do you kind of help them decide whether to build custom software or to use existing tools?

[00:05:30] Ghazenfer Mansoor: There are many factors. So, and there’s no, one solution fit all. Every business has their own challenges. So naturally if there’s an existing tool available, there’s no point in writing it on. So, for example, if somebody comes in because they wanna build a CRM, there are so many existing ones, why do you wanna build another CRM?

Because now not only that there existing cloud-based offerings that are much cheaper, but they’re also open source pretty much in every type of software. So you can download, install it if you really want to have your own version of any software. So there are pros and cons. There are cost consequences.

So when we look at build versus buy, you have to look at all those factors and say, what is the reason behind that? Everybody wants to build their own, but there’s a cost component comes in, but at the same time. You lose some opportunities as well. It’s your asset, it’s your value. So, you have to see what the uniqueness is.

So most of the time when people come to us, we spend time going through their processes and looking at, what are they actually trying to achieve? The deeper discovery helps us identify that and then we define then we come up with a strategy of what to build and sometimes it’s a combination.

Sometimes it may just be an integration rather than just building a whole new application.

[00:07:03] Chad Franzen: So AI has invaded everybody’s life and people are using it in different ways and finding new ways to use it. What role does AI and machine learning play in your current projects, and where do you see it headed?

[00:07:14] Ghazenfer Mansoor: AI is everywhere in our processes nowadays. So starting from, I would say even the documentation in our marketing, in our sales, in our development. So it is helping us improve our development processes. We can write better code, we can write faster code, like tool like claude code, they’re helping and then there are tools like name slip up from your mind cursor for example they help you expedite your development and then there are tools that help you convert your design into code. So a lot of those things now it’s much faster. We can test applications faster, code coverage, all of those things. There are so many things, so we’re using in many different places in our business.

So it’s helping us do things better. We’re looking at, it is empowering our people, our developers, our designers, our analysts, our project managers. It’s empowering everybody.

[00:08:24] Chad Franzen: So everybody loves innovation. I’m sure you pride yourself on the innovative things that you guys have done. How do you balance, maybe innovation with regulatory compliance in software products for healthcare?

[00:08:37] Ghazenfer Mansoor: It’s, I would say even on top of that there’s a pushback or innovation from in every company because of the change. No, nobody likes change. The change management. It’s hard. So people like to stay where in their comfort zone. So any new thing comes in. AI is one of the biggest revolution that I’ve seen with all these changes.

Many people are not ready. People are pushing back on those things. So obviously you have to have I mean the way we look at it, you have to show that it’s empowering, it’s not replacing people, there is a fear There are misconceptions. So when it comes to regulatory, there’s a bigger pushback because a lot of times we say our data, we have a PHI data.

Our data cannot go to cloud some or to LLMS, or we cannot use AI because we have sensitive data. So there are regulations, there are ways of doing it. So there is a pushback always, and there will be. So, and it is more challenging because you can’t allow people also to just put the data the same way as they’re just putting any other data because that has a sensitive information.

And LLMS are training on those. So if you blindly upload, obviously there, there are all those violations. So, but at the same time, I think it’s important. How do you build applications for those compliance industries that follow those rules as well as they are leveraging the power of AI?

So, in the AI world, there are many different ways like for example, we’re working on multiple AI projects where there’s a lot of PHI and sensitive data. So you can have the vendors sign a BA for you so that they are committing that they have a zero retention policy that data is not being used to train.

So that’s one way you, there are ways you can architect the applications where you have your internal data that doesn’t touch the LLMS, or not all the time. You just only you vectorize it, tokenize the data and then give it limited data to LLM for searching or for recommending. So, all those different techniques that we have to use.

So the companies who are building like ours, who have built many applications such, are familiar with the process of creating those kinds of applications. So once you know how that process works, you feel more confident. So we have to bring that confidence to our customers that, oh, whatever we are doing for them, or whatever they are doing.

Is not risky. It has its own challenges. It has its risk, but you, it’s just the regulations that you have to define. I think as you have that governance around it, you can get past that. So, and then additionally, if the cloud is not an AI word, you, there are other options you can have your local AI LLMs, you can have a hosted option.

So there are ways of doing it. You just have to figure it out.

[00:12:04] Chad Franzen: So you know, we, you, when Technology Rivers you and technology rivers develop a new software, a new product or something like that, a new application, and you test it out and it works. That’s awesome. What are some other measures of success you have beyond, you know, just it working?

[00:12:22] Ghazenfer Mansoor: So it’s like anything like when you build that doesn’t mean everybody will use it, right? So I have a book on that’s just coming out in December. It’s called Beyond the Download, how to Build Mobile Apps that people use, love and share everyday. So, the core concept is retention. So it’s not about building, it’s about using as well.

So the bigger challenge we have seen, like people build these applications, whether it’s app or web application and if you’re not able to get users. What’s the point? All that effort is gone. So the customers are important, your users are important, and in order to build those, obviously, then you have to have the strategies.

How do you retain it? How do you bring it, and how do you retain them and how do you excite them? How do you make them your ambassadors or your evangelist so that they keep referring you? So it’s like any other business referral is key in a service business. But the same in the software world. If you have a nicer application, people will refer.

If I’m looking for a recommendation from you about a plumber, you will likely, if you had a good experience from an app, you would recommend that. Now I’m going to that app. Right? So the same is the case in every application that you build, your users have to love it, and that’s the only way they will come back.

So finding that, so building is one piece. So, and building is not the harder part. It’s about bringing and retaining those customers on that app. That’s the key challenge.

[00:14:06] Chad Franzen: So when you’re working on some of these projects, what are some, maybe some common reasons that a software project might fail, and how do you mitigate those risks?

[00:14:15] Ghazenfer Mansoor: There are many I can’t cover in this podcast alone. So we have an ebook on this topic called Top Eight Reasons Software Projects Fail and How to Bring Them Back On Track. So this is where we talk about the top eight reasons. I mean now with AI there are many more, and then obviously for each regulatory there are others as well, but some of the reasons that make the project fail.

But I think the biggest one I’ve seen is unclear requirements and in fact, it’s not really just the software, it’s about anything. If you see the roles fail in a company, that’s many times is not because the person is not good. It’s many times because the roles are not clear, you are expecting that person to do one.

The person is expecting something else and that misalignment after sometime you realize, this person is not a right match. Right? But that’s not that person’s fault, right? So same as the case in the software. You gave a requirement one way it was understood differently, and now you built something that you didn’t want, or you built something that you thought it’s a good idea, but your customers didn’t want.

So getting the clarity from a customer, that’s another one. Right? So the unclear requirement is like what needs to be built is the most important part. So in our business we have a blueprint process where we map the flows interfaces, we define the foundation, look at all those flows, and then come up with a plan to build.

Because if your requirements are not clear, if you don’t have a right blueprint for your application, same as the blueprint for your house. Imagine building a house by just guessing and then and giving a highlight of the appointment. Oh, I want a house with five rooms and then realize you just build it up very differently.

So that’s very important part. Another one is which is another common building too much, too early. The feature race is always problematic because you are going after features. You think, oh, if I have this feature, customers will come. Oh. My competitors do not have this thing. But in reality, your customers don’t care about all those features, they need to solve that one specific problem, whatever is that.

So you have to identify what are the gaps there that you are trying to fill and one of the recommendations we do is even if you have whatever is that list of all the things you wanna do, start with just one thing that others do not have and then that is the most important one. You start bringing users and then gradually enhance.

So all these big applications or good applications, they grow like that. Another one is communication, like again, but that, I would say it’s more like a requirement or like how do you communicate with your team how you, our side? Like what are your goals? You keep building it.

Never have a launch strategy. Like again, goes back to the feature thing, right? So, and then again, there’s a big list of things like different types of, you could have a user experience problem, you could have a design issues, you could have a quality problem. There’s so many, we have seen a good amount of our work is fixing broken projects.

That’s where most of the customers come to us. They say, we already have this app web application, or We’ve been building this for a year. It’s not working. It has these X, Y, Z issues. So we work with them to bring those back on track.

[00:18:19] Chad Franzen: I know you’ve been talking a fair amount recently about conversational UI becoming the new interface for founders.What does that mean?

[00:18:29] Ghazenfer Mansoor: Well, conversational UI, meaning removing friction. So instead of you force the users to learn menus, tabs, or workflows. You let them communicate in a way they already think and talk. So for founders, this means you no longer design your screens first. You design your intent first, right?

So it’s like your, I would say GPT or your chat interface, like you rather than just user clicking on anything you want them to ask or converse with your application, and that’s helps you build something that expands your product reach. So any conversation can sit on top of any workflow so users can get something done with one click instead of 10 clicks.

So for early state products, this is powerful because you can validate your value without building a full interface. For mature products, it’s becomes a competitive ad that makes the experience exceptional faster and more personal. So I think the founders should not view the conversational UI as a feature, but a new way to deliver the product.

[00:19:55] Chad Franzen: Yeah, I’m, I know maybe most of your listeners know this, but for those who don’t, what is proprietary tech? 

[00:20:03] Ghazenfer Mansoor: Sorry, can you repeat that? 

[00:20:05] Chad Franzen: What is proprietary tech?

[00:20:09] Ghazenfer Mansoor: Oh, proprietary tech. So proprietary technology is some, it’s really that you are private technology. It’s not something available to everybody. This is something you build

[00:20:23] Chad Franzen: and I know that you believe that is the single most important differentiator for service businesses. Why do you say that?

[00:20:31] Ghazenfer Mansoor: Oh yeah. This is one of my famous topics that I talk. So in a service business, really the difference between one business and another business is not much other than like, okay, better service, better team.

So, as you are growing your business, you look for improving your processes and everything. Your competitors can also do the same thing. It’s a race of people. It’s a race of processes, so your competition is so you have to create a differentiator in order to create a differentiator, you have to do something different.

We believe creating a proprietary technology in your business can increase your value much more significantly than any other way. Yes, all those other things are also important, but when you have a proprietary technology that’s creating a differentiator for your business, that’s creating a value. So when you create a differentiator obviously your value will automatically, it brings more efficiency in your processes, so, well, it doesn’t mean you just create another CRM for you or the tool that is available in the market.

So all those tools are great. You have to look at what each of those are doing for you, like for example, I’ll say for example, you are recording a time for your business, like your employee’s time. There are probably hundreds of time tracking tools. You just pick one of those. I’m not saying replace those, you use a CRM use sorry, Pipedrive, Salesforce or whatever are the tools.

But you may have a very specific need. So for example, one of our customers deal with Medicaid and they had those very specific log notes, tracking rules that cannot be added into any of the existing time tracking tools. So like how people work if there are multiple people working on a similar task.

There are rules in terms of what number of hours, what time they can work on. So a lot of those rules that makes it super complicated to have the compliance. So that’s when you need to build something custom that could solve that one problem, because if you’re not doing it, then you have a humans validating all of that because all those mistakes meaning more mistakes you may get rejected.

And you still have to pay your people because they worked on it. So you want to identify those things. So in order to do that where the proprietary comes in. So you have to identify, and this is very specific to your business and well, this may be for that multiple businesses, but in reality, your proprietary could be many other things that are specific in your business.

For example, it could be how your lead changing and from coming in from the website to your SDR, to your marketing, to salespeople, to account or to your presale. All of those different people are dealing with different things or there’s a request came from a customer through a different way. 

Whatever this channel, how do you, so whatever are the things your team is doing, they are doing in a certain ways so you could bring more efficiency into that process and once you have that efficiency, that automatically, that means you are keeping your customers for longer, you are creating more value for your customer, you are making them more excited because your service is better. So this is the way to move from people power growth, to a system powered growth.

[00:24:22] Chad Franzen: Very nice. So an example of proprietary tech could be a new app. I know you’ve written a lot about app growth strategies. What do you see as essential for an app to thrive rather than just have a good launch?

[00:24:35] Ghazenfer Mansoor: This is similar to the software projects we were talking earlier.

There are so many different strategies that you can apply, so the book that I wrote beyond the download we covered about 32 different strategies where. How to build the mobile app that people use, love and share. So I think if I say one thing that may be that may not be fair to the other, I would say but I think the book starts with the one first thing is create a remarkable app.

That’s the bottom line. So when you say a remarkable app meaning doesn’t mean just a UI. It is something that excite people. So it has to have an exceptional user interface. It has to have exceptional design. It does what it’s supposed to do. You can easily find it makes your life easier, it gives you it solves all the problems that you are using this app for, whatever that, but be it a dating app, be it a social networking app, be it a patient care app. So if it is solving all the problems, so that’s, so when you think of the app and it says, well, you want to build really remarkable app, I would say the characteristics are many.

So, yeah, create a remarkable app that people use. That obviously, meaning you will have a lot more usage, you’ll have a retention and one, it’s once, it’s a great app. You may even get Apple, Google, and other companies feature it. It will get picked up by publications and now you have a brand

[00:26:39] Chad Franzen: I know the process and processes are very important for businesses of all sizes especially for mid-sized service businesses in healthcare, what type of process automation are most effective?

[00:26:51] Ghazenfer Mansoor: In healthcare applications,so I think we talked earlier about the checklist part that we have for our company, so it is very important.

For the healthcare businesses as well to know what are the steps that are needed to build those applications. Right. So knowing that makes a difference because then you are not skipping any of those steps in terms of building your application. So the key part is knowing the compliance and then building it according to those, whatever are those steps, whether it’s audit, logging, whether it’s authentication, whether it’s authorization, whatever are those, you have to make sure you cover all of those.

[00:27:39] Chad Franzen: What role does user experience or UX design play in your software development process, and how do you ensure it’s aligned with business goals?

[00:27:50] Ghazenfer Mansoor: User experience is the very first thing in every application, so the very first thing you, if you go to the app store and you’re downloading the screenshots, you see is the UI right? The information, what is it for? Why I should download this app, why should sign up for this application when I go?

Right? So those are important, like if it resonates with me, I’ll go forward. I start learning more about it. So the user experience is and design are the most important pieces of any software project. So last question. Obviously that goes along with the foundation part the architectural foundation, but still yeah, I would rate one or other higher.

[00:28:49] Chad Franzen: Last question for you as you kinda look into the future, what trends do you see as disruptive in healthcare software development, maybe over the next three to five years?

[00:28:59] Ghazenfer Mansoor: Well, the challenge is, I don’t even know in the next two, three weeks or months. I know because healthcare is changing so fast, like whatever we said or did three months ago, now it’s changing.

So obviously there are a lot of shifts happening, but the bigger one, at least and the foreseeable feature I see of like the agent AI. So we’re moving from AI that answers questions to AI that complete tasks. So like, it’s not like just querying or asking or doing, so you have like, when it comes to agentic, you’re actually completing the whole task.

It understands, it learns. How you’re, what you’re doing and make a determination and decisions based on that. It’d be scheduling prior authorization, care coordination. So you will have agents with automation, the whole with automating the whole workflow across the scene, not just provide the insight.

Second is the clinical decision assistant that’s becoming a standard. So what I mean is like, for example, you have a lot of documentation. For example, you have PDFs, you have word docs, you have portals, you have charts, different data. So you don’t want to be spending time reviewing all of those.

So now the software will interpret labs. It gives you notes from all of your devices, all of the data you have, and it will give you a summary. It will give you a recommendation. Right. So we’re working on a multiple predictive health applications, especially on the personal healthcare space where you upload your lab results, healthcare data and all of that, and it gives you recommendations.

So a lot of the stuff happening in that space already, but this is becoming more and more and I think the biggest one is it’s in the AI, but I think because as the AI is changing everything in terms of the development and everything the notion of workflow first instead of a feature first, that thing is changing now.

I mean, if, what I mean is in a traditional way, people are built like defining the features they’re building ’cause they have to plan all of that. Now, many times you can just build a workflow because AI is making it simple, like, so you’re creating those smaller agents, smaller automation, and creating those workflows first.

So that change is, and then gradually you may be combining those, maybe creating a multi-agent. So rather than going for these endless features and like you just start building those smaller agents and then combining them as needed at some stage but the focus is that start fixing those auto those manual workflows, right?

And again, as it could be a small, your proposal management, it could be your time tracking related stuff or again, so any of those documentation, review improving document, whatever are those, you have to look at what those specific flows are.

[00:32:24] Chad Franzen: Okay. Well, hey Ghazenfer, it’s been great to talk to you today.

These are very interesting and valuable insights. Really appreciate you having me and all of your time today. Thanks so much.

[00:32:35] Ghazenfer Mansoor: Thanks for having me

[00:32:36] Chad Franzen: So long, Everybody.