Skip to content
§
§ · hiring guide

How to Hire a Disease Surveillance Software Development Company

Hire a firm that can describe an unmerge which restores original records before it shows you a dashboard. A first release covering lab intake, person matching, case creation and condition workflow runs $90,000 to $200,000 in 16 to 24 weeks.

Custom Software Development code editor and API illustration for Public Health Surveillance Software.
The short answer

Hire a firm that can describe an unmerge which restores original records before it shows you a dashboard. A first release covering lab intake, person matching, case creation and condition workflow runs $90,000 to $200,000 in 16 to 24 weeks. Start your interface agreements in week one, not at the sprint that needs them.

Hiring a firm to build surveillance software is like hiring a plumber for a building whose water pressure changes by a factor of a hundred without warning. On an ordinary Tuesday the system handles a few hundred results and everybody is satisfied. Then an event starts, the lab feed becomes the first thing to collapse, and you find out what the architecture was really made of while your epidemiologists are triaging by hand and a temporary workforce hired last week is being trained over video.

The category is hard to buy because you evaluate it under exactly the conditions where every product looks fine. Demos run on clean messages from one sender. What decides whether the system is worth its cost is invisible in that setting: how the master person index scores a match when the same person was tested at three sites with three spellings and two dates of birth, whether your own analysts can publish a new condition during an event, and whether a message that fails validation is quarantined for a human or silently dropped. None of that appears on a feature comparison sheet.

What a disease surveillance software development company actually does

The visible build is a case queue and an investigation form. The value is underneath it.

They build a master person index with probabilistic matching, tunable weights, an automatic merge band, a manual review band and an unmerge path that restores the original records rather than approximating them. Every match decision stores the score and the rule version that produced it, so a threshold change can be evaluated against history rather than argued about. The weights should reflect your jurisdiction's naming conventions, transliteration patterns and the share of records arriving with no reliable address, which is not what a vendor default was tuned for.

They also make your own staff the authors. Conditions, case definitions, questionnaires and routing rules become versioned configuration with an approval step, publishable by a trained analyst in an afternoon, with earlier versions preserved so a case investigated in March still shows the March form. Statutory timeframes become objects that page the person on call rather than reports you run afterwards to discover what you missed. Contacts and exposures become a graph with typed edges, including genomic relatedness returned from the state laboratory, so a cluster is a query rather than something noticed in a Tuesday meeting.

What it really costs in 2026

Project tierCostTimeline
Feed assessment and matching prototype run against your real message sample$40,000 to $90,0004 to 8 weeks
First release: lab intake, person index, case creation, condition workflow with clock$90,000 to $200,00016 to 24 weeks
Full platform: contact graph, clusters, portals, notifiable messaging, mobile, surge$250,000 to $700,0009 to 18 months
Maintenance, new feed onboarding and rule updates15 to 20 percent of build cost per yearOngoing retainer

Two costs are absent from most quotes. The first is per sender feed onboarding. Proposals price HL7 support once, as though the standard removed the work. It does not. Every sending facility is its own mapping, testing and validation exercise, and a hospital that switches laboratory information systems or changes the identifier it reports under restarts that exercise from the beginning. Ask for feeds priced per sender, plus a published rate for adding one after launch, because you will be adding them for years.

The second is the agreements and the authority to operate. Obtaining a test feed from a hospital or your state laboratory is a negotiation with an organisation that has no stake in your schedule, and hosting a system holding condition restricted records requires a security review running on its own calendar. Neither belongs to your developer, and both determine your go live date more reliably than any sprint plan. In government work these are the timeline, not an overhead on it.

Signals of a strong partner

  • They ask for a sample of your real messages before quoting. Including the malformed ones, which is the only sample that tells them anything.
  • They describe the unmerge before you ask. Anyone who has run a person index in production knows a bad merge is a genuine harm and hard to reverse.
  • Matching weights are treated as yours to tune. Your demographics, not a vendor's default profile.
  • Bad messages are quarantined for review. Silently dropping a message is how a case never exists.
  • Analysts publish conditions and questionnaires without a developer. Versioned configuration with an approval step, and prior versions preserved.
  • The statutory clock pages rather than queues. They ask which of your conditions are immediately reportable in the first conversation.
  • Condition level access control comes up unprompted. Restricted records carry stricter state disclosure rules, and surge is exactly when someone sees what they should not.

Red flags

  • They say they support HL7 and have no story about a broken feed. Everyone supports HL7. Nobody who has done it talks about it that way.
  • Matching is exact match on name and date of birth. That design will both overcount cases and merge two people.
  • Changing a questionnaire requires a change request. You are buying the constraint you are trying to escape.
  • Contacts are rows with a parent case identifier. The link between two investigators' caseloads is then invisible by construction.
  • No answer on restricted conditions or hosting authorisation. A firm that has worked with health departments raises both first.

Questions to ask on the first call

  1. Two records merged that should not have been. Walk me through the unmerge, step by step.
  2. What matching weights would you propose for our jurisdiction, and how would you tune them against our data?
  3. A sending facility changes the identifier it reports under overnight. What happens to that feed?
  4. Where does a message that fails validation go, and who is responsible for looking at it?
  5. How does one of our epidemiologists publish a new condition and questionnaire without calling you?
  6. How does the system page the person on call for an immediately reportable condition at 11pm?
  7. Show me how a new positive result is scored against existing clusters at intake rather than at a weekly meeting.
  8. How do we provision a temporary contact tracer with access to exactly one job, in minutes rather than through a ticket?
  9. Who owns the repository, the cloud accounts and the matching rule sets when this ends?

A simple way to decide

Buy a paid discovery phase of four to eight weeks whose deliverable is a written specification you own, plus one concrete artefact: a matching prototype run against a de-identified sample of your own real messages, with match, review and miss rates measured and reported. That single exercise tells you more about a firm than any reference call, and the numbers become the acceptance criteria for the build.

The specification should cover the person index and its weights, the condition and questionnaire authoring model, the statutory clock and escalation rules, the contact and exposure graph, and the sender by sender feed inventory with the agreement each one needs. Digital Heroes works specification first, hands over the repository and the cloud accounts from the first commit, and can be checked through D-U-N-S, Clutch and Trustpilot when your procurement office asks who it is dealing with.

Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.

Research & sources

The evidence behind this guide

Independent findings on why this investment pays off. Every link goes to the primary source.

  1. McKinsey found that tech debt can amount to 20-40% of the value of a company's entire technology estate before depreciation, and CIOs report that 10-20% of the budget for new products is diverted to resolving tech-debt issues. Source: McKinsey & Company (2020) →
  2. This World Bank report argues that digital technology adoption raises SME competitiveness, productivity and resilience, while documenting that smaller firms consistently lag larger ones in digital adoption - a gap that constrains their growth and market reach. Source: World Bank (2022) →
  3. An analysis of enrollment and completion data for 221 MOOCs (Katy Jordan, published in the International Review of Research in Open and Distributed Learning, IRRODL, 16(3), 2015 - not the Journal of Distance Education) found completion rates ranging from 0.7% to 52.1%, with a median completion rate of 12.6%, and completion negatively correlated with course length (longer courses had lower completion rates) - underscoring how unsupported self-paced online courses struggle to finish learners. Source: Journal of Distance Education (via ERIC / Katharina Jordan) (2015) →
  4. Sensor Tower's State of Mobile 2026 reports that global users spent 5.3 trillion hours in iOS and Google Play apps in 2025 (+3.8% YoY), roughly 3.6 hours per day per mobile user. (Note: the page does not itself contrast app time vs. mobile-browser time, so the 'overwhelming majority of time in apps vs browsers' framing is not directly supported by this source.). Source: Sensor Tower (2026) →
FAQ

Frequently asked questions

How much does custom disease surveillance software cost to build?

A feed assessment with a matching prototype run against your real messages runs $40,000 to $90,000 in four to eight weeks. A first release covering lab intake, the master person index, case creation and condition workflow with the statutory clock runs $90,000 to $200,000 in sixteen to twenty four weeks. A full platform with contact graph, clusters, portals and notifiable messaging runs $250,000 to $700,000.

What is the single best question to ask a surveillance developer?

Ask what happens when two records merge that should not have. A firm that has run a master person index in production will describe an unmerge that restores the original records rather than approximating them, and will explain why a bad merge is a real harm rather than a data cleanup. A vague answer means you will discover the gap during an outbreak.

Why does HL7 support not mean the lab feeds are cheap?

Because the standard defines structure, not quality. Names get truncated, an ordering facility gets sent as the performing lab, result values differ across senders for the same organism, and coding varies between LOINC and free text. Every sending facility is its own mapping and validation exercise, and a hospital changing its laboratory information system restarts it. Price feeds per sender with a rate for adding more later.

Should we stay on the NEDSS Base System instead of hiring a developer?

For a smaller jurisdiction with standard reportable conditions and moderate volume, yes, and it carries the national reporting plumbing you would otherwise implement yourself. Hire a developer when your epidemiologists need to publish a new condition, questionnaire or routing rule during an event and the current path is a change request, or when deduplication consumes professional staff time every single morning.

What determines the go live date on a health department build?

Rarely the engineering. Interface agreements with hospitals, laboratories and other state systems are negotiations with organisations that have no stake in your schedule, and the security review for hosting condition restricted records runs on its own calendar. Both should start in week one. Treat them as the timeline rather than as overhead on it, and hold your developer to a plan that reflects that.

We run everything on Airtable and spreadsheets. When is it time to go custom?

The switch usually makes sense when you hit one of two walls: Airtable's record caps (125,000 records per base on the Business plan) or logic the tool cannot express, like multi-step approvals with conditional pricing. There is also a simple cost signal: 25 people on Business at roughly $45 per seat per month is about $13,500 a year, forever, for a tool you are already fighting. Custom is worth it when the workflow is core to how you make money; for peripheral processes, staying on Airtable is the right call.

What questions should I ask a development agency on the first call?

Ask who exactly will build it, what happens when scope changes mid-project, what their maintenance terms are after launch, and what they will need from you every week. Then ask them to describe a project that went wrong and what they changed afterward; teams that have shipped at real volume have war stories, and teams claiming a perfect record are hiding something. The scope-change answer matters most: a disciplined shop describes a written change-order process, not a vague promise to be flexible.

What does a $50,000 custom software budget actually buy?

One core workflow done properly: 10 to 15 screens, two or three user roles, a couple of integrations, an admin panel, and automated tests, delivered in roughly 12 to 14 weeks. What it does not buy is that workflow plus a mobile app plus AI features plus five more integrations. The discipline of picking the one workflow that matters is what separates $50,000 projects that ship from $50,000 projects that stall at 70% complete.

How many people should be working on my software project?

Three to five for a typical focused build: a project lead, one or two engineers, a designer, and part-time QA, which is the standard shape across 2,000+ Digital Heroes projects. Larger platforms justify 6 to 10, but a ten-person team on a small first version usually signals bill padding rather than horsepower. What predicts success is whether a senior engineer is writing your code daily, not the headcount on the proposal.

What does it cost to keep custom software running after launch?

Budget 15-20% of the original build cost per year, which on a $100,000 system means $15,000 to $20,000 for security patches, dependency updates, bug fixes, and small improvements as real usage reveals what the spec missed. Cloud hosting for a typical business application adds $50 to $300 a month on top. Skipping maintenance does not save the money; in Digital Heroes rescue work, unmaintained systems typically need a far more expensive rebuild within about three years.

Is it cheaper to customize Salesforce than to build a custom CRM from scratch?

If you use less than a third of what Salesforce does, a custom CRM is often cheaper by year three. Salesforce Enterprise lists at $165 per user per month, so 25 seats cost about $49,500 a year before admin and consultant fees, while a focused custom CRM runs $60,000 to $100,000 once plus 15 to 20% a year in maintenance. If you genuinely need Salesforce's ecosystem, reporting, and app marketplace, customizing it beats rebuilding it; the mistake is paying enterprise prices to use it as a glorified contact list.

What should I have ready before I contact a development agency?

Three things, none of them technical: a one-page description of the problem in your own words, a list of the tools and spreadsheets the new system must replace or connect to, and a must-have versus nice-to-have split of features. Add a budget range, even a wide one, because it changes the conversation from fantasy to engineering. You do not need a formal specification; producing that is what a discovery phase is for.

What are the biggest mistakes first-time software buyers make?

Choosing the lowest bid, paying more than 30-40% upfront instead of on milestones, skipping a written specification, and having no maintenance plan for after launch. The most expensive of the four in Digital Heroes rescue projects is the missing spec: without written acceptance criteria, done becomes an argument instead of a checklist, and every disagreement resolves in the vendor's favor. Fix those four and you have avoided most of the ways these projects fail.

If we build for 20 users now, will the software cope with 500 later?

It should, without a rewrite, if it was built on a standard cloud stack; going from 20 to 500 users is mostly a hosting configuration change costing hundreds a month, not a second project. What actually breaks under growth is sloppier work: database queries never indexed for volume and features designed assuming one office's worth of data. Before signing, ask the vendor what happens to the system at ten times today's data, and listen for a specific answer.

How do I make sure custom software is secure and compliant with rules like HIPAA?

Start with the baseline every business system should have: encryption in transit and at rest, role-based access control, and audit logs. If HIPAA applies, the hosting provider must sign a Business Associate Agreement, which AWS, Azure, and Google Cloud all offer, and access controls have to be designed in from day one, not bolted on. SOC 2 certifies a company's operating practices, not a codebase, so ask vendors what they have shipped in your regulated domain rather than which logos are on their website.

Our developer disappeared mid-project. Can another team pick up the code?

Yes, this is a routine engagement, provided the code exists somewhere you can access, so your first move is securing the repository, hosting, and domain credentials today. A takeover starts with a one to two week paid code audit that ends in one of three verdicts: continue the build, keep the design but rebuild the weak parts, or start over. Digital Heroes has inherited enough projects to say plainly that sometimes the rebuild is cheaper than the rescue, and an honest agency will tell you which one you have before taking your money.

Should we build an MVP first or go straight to the full system?

MVP first, for almost everyone: ship the single workflow that carries the business value in 10 to 16 weeks, learn from real users, then fund phase two from evidence instead of guesses. The caveat is that an MVP is a small version of a well-built system, not a badly built version of a big one; the data model must already support what comes next. An agency that cannot tell you what they deliberately left out of your MVP has not designed one.

Who can build a custom software system?

Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.

Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.

What makes Digital Heroes different from other software companies?

Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.

Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.

How can I check Digital Heroes is legitimate before getting in touch?

Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.

Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.

Keep reading

Published · Last updated .

Online now

Hi there. How can we help you today?

Reply