Comparing vendors for a patient portal, telehealth service or clinic tool? Here is who at Digital Heroes would build it, what we sign and when, and the due diligence to run on any healthcare vendor, with our own answer to every check.
Digital Heroes is a custom software company founded in 2017, with headquarters in New York and Delhi and engineering in Delhi and Lucknow. In healthcare we build the software patients and staff use around the EHR: patient portals, telehealth MVPs, booking and reminders, and practice tools. We do not build EHR integrations, claims engines or medical-device software.
Any time our people will touch protected health information on your behalf, we sign a business associate agreement before the first record moves, and the build is hosted on AWS, Microsoft Azure or Google Cloud under that provider's own BAA. Our HIPAA practices have been reviewed by an independent firm. The rest of this page lets you test those claims, and put the same tests to every other custom healthcare software development company on your shortlist.
Healthcare software firms are not interchangeable. A firm that builds interfaces into Epic can be the wrong hire for a booking app, and a booking app studio is the wrong hire for an Epic interface. Start from what you are building, then shortlist the kind of company that does that work. The matches below are our own judgement, not a measured benchmark.
| What you are building | The kind of company that fits | Digital Heroes |
|---|---|---|
| A patient portal for intake, documents and messages | A product studio or custom software company with its HIPAA paperwork in place | Yes, our core health work |
| Booking and reminders across providers and locations | The same | Yes |
| A first telehealth release for one kind of visit | A product studio that scopes an MVP before the full product | Yes |
| A staff tool: rosters, approvals, training records | A custom software company | Yes. Planivo, further down, is this kind of build |
| A wellness or coaching app | A mobile app studio | Yes, for iOS and Android |
| An interface into Epic, Oracle Health or MEDITECH over FHIR or HL7 | An EHR integration specialist, or the EHR vendor's own services | No. We refer this work to a specialist |
| A claims, billing or revenue cycle engine | A healthcare-only firm with payer experience | No |
| Software the FDA may treat as a medical device | A firm that works under a medical device quality system | No. Medical-device software is outside our scope |
| A hospital-wide rollout or a legacy system replaced across many sites | A large consultancy with a deep bench and heavy procurement | No. A programme that needs dozens of engineers from week one suits them better |
| One small change to an app you already run | A freelancer | Usually no: our smallest team is one senior engineer and one designer |
Every no in the last column is deliberate. What a vendor refuses is one of the checks further down, and a vendor that says yes to every row is telling you something too. For the full scope of what we build in healthcare and the safeguards behind it, read our healthcare software development page.
A focused first release is usually staffed by three to five people: a tech lead, a designer and one or two developers, with QA and project communication covered inside that group. The people below are on our side of a health build, from the founder down, and each name opens a public profile. The developers and QA engineers assigned to you are named in the written scope.
Your day-to-day contact from kickoff to launch: she plans the sprints, guards the scope and keeps you informed. Healthcare and wellness are among the industries on her profile.
Owns the technical calls and decides what is built and what is bought. No engineer starts until he has signed off the architecture.
Heads design across web and mobile. On a health build, the patient view and the staff view are agreed as separate flows before a screen is drawn.
Runs the P&L across India operations and the engineering pods, keeps the fortnightly delivery cadence client work runs on, and reads each scope before it goes out. He signs this page.
Founded Digital Heroes in 2017 and still leads it. The New York office holds leadership and US account directors, and New York clients can hold their kickoff there in person.
Developers and QA engineers work from Delhi, our engineering headquarters, and Lucknow, on hours that overlap New York's. Some mobile engineers sit in Sydney.
On weekdays the New York team replies the same day, between 9 AM and 6 PM Eastern. Delhi and Sydney cover production emergencies at any hour between them, and a message sent after hours reaches someone within one to two hours.
Ask every vendor on your list the same three things in writing: who exactly will work on the build, from which office, and who answers when the software fails at night.
Four documents govern a health build with us, and only countersigned ones bind anyone. Under our terms, nothing said on a sales call, in a deck or in a proposal commits either side until it is written into an MSA or a statement of work. Ask for our standard MSA as early as you like, at legal@digitalheroes.co.in; reasonable changes are negotiated before anyone signs.
It protects your idea and our other clients' work alike, and it is signed before we walk you through any past client system.
Check: that it is mutual, so the duty of confidence runs both ways.
The MSA names the contracting entity, Digital Heroes Technologies Pvt Ltd or Digital Heroesco LLC. For US work it usually names New York law and venue; other choices can be negotiated, among them Delaware, England and Wales, Singapore, or arbitration under JAMS or LCIA rules.
Once you have paid in full, you own what was made for your project: code, designs, copy and custom assets. Libraries we had before, or wrote for reuse across clients, stay ours, and finished work can appear in our portfolio unless you opt out in writing. Strict work-for-hire terms go into the SOW at a price stated up front.
Check: run DUNS 650878346 through the D&B lookup and check that the name it returns matches the party on the MSA.
Discovery is a two-week sprint priced as its own piece of work. It closes with one of two outcomes: a fixed price for the build, quoted against the written scope, or a recommendation that you buy rather than build, with the product named. After that, work outside the scope waits for a written change request, priced and dated.
Check: that every outcome you care about carries an acceptance criterion. If it is not in the SOW, it binds nobody.
If our people will create, receive, store or transmit your patients' health information, the BAA comes first, signed by Digital Heroes before the first record arrives. The cloud host, AWS, Microsoft Azure or Google Cloud, is covered by that provider's own BAA, and any other service that will hold the data is named in the written scope, with its BAA, before you see a price.
Check: read three clauses before you sign, covering how fast a breach must be reported, which subcontractors it binds, and what happens to the data when the contract ends. The next section explains each.
Put these eight checks to every company on your shortlist, in writing, and lay the answers side by side. Each one names the rule behind it, so your counsel can read the regulation rather than our summary of it. Then comes our own answer, including two where the plain answer is that we do not publish the record on this page.
The rule: a vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate under 45 CFR 160.103, and needs a contract with the terms set in 164.504(e).
Ask any vendor: will you sign one before any data moves, and which of your people and suppliers does it bind?
Our answer: yes. Any time our people will touch your patients' data, the BAA is signed first.
The rule: the Security Rule requires an accurate and thorough assessment of the risks to electronic protected health information, as set out in 45 CFR 164.308(a)(1). There is no HIPAA certificate to buy.
Ask any vendor: send your security questionnaire with the brief, and for any certificate a vendor names, ask for the auditor and the report date.
Our answer: we do not claim a SOC 2 report or an ISO 27001 certificate. Inside the two weeks of discovery you receive a threat model, a data-flow diagram and a review of secrets handling for your build, and the five technical safeguards we build are mapped to the rule.
The rule: 164.308(a)(5) requires a business associate to run a security awareness and training program for every member of its workforce, management included.
Ask any vendor: for each person named in the scope, when was their last training, and what did it cover?
Our answer: our HIPAA practices have been reviewed by an independent firm, which we do not name. We do not publish training records on this page, so ask for them by name during due diligence, as you should of every vendor.
The rule: a business associate may hand protected health information to a subcontractor only after that subcontractor gives the same written assurances, under 164.308(b)(2) and 164.504(e)(2)(ii)(D). A subcontractor is anyone it delegates work to outside its own workforce.
Ask any vendor: list every company that will store, process or see the data, with the BAA that covers each one.
Our answer: our engineers and QA team are in-house. The host is AWS, Microsoft Azure or Google Cloud under that provider's BAA, and any other service that will hold the data, such as video or messaging, is named in the written scope with its BAA.
The rule: a business associate must report a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovering it, under 45 CFR 164.410, and the BAA must require that report.
Ask any vendor: what notice period will you write into the BAA, and what will the notice contain?
Our answer: the reporting duty is a required clause of every BAA we sign. This page quotes no standard number of days, so agree one in the BAA before you sign rather than relying on the 60-day outer limit.
The rule: when the contract ends, a business associate must return or destroy the protected health information it holds, where that is feasible, and keep no copies, under 164.504(e)(2)(ii)(J).
Ask any vendor: when does the code become ours, whose accounts hold it during the build, and how is the data handed back?
Our answer: repositories and cloud accounts sit in your name, on your billing, from the first sprint, with our engineers as collaborators you can remove. What we make for you is assigned to you on full payment, and a handover pack of architecture notes and runbooks goes to whoever runs it next.
The rule: HHS's cloud computing guidance says the HIPAA Rules allow a cloud provider to store electronic protected health information on servers outside the United States, under a BAA, when the other requirements are met. Your own contracts can still be stricter.
Ask any vendor: which country is each engineer in, and which roles can open production data?
Our answer: Delhi and Lucknow in India, with some mobile engineers in Sydney; nobody in New York writes code. Should they ever need production data, the BAA we sign covers that access. If your contracts require every engineer to be in the US, we are the wrong firm.
The rule: no regulation requires it. Buyers comparing healthcare vendors in public forum threads ask for it again and again, along with a reference from a year or more back.
Ask any vendor: which live product can we open today, and can we speak to a client from more than a year ago?
Our answer: Planivo, staff scheduling for clinics and hospitals, is live at planivo.me. Once a scoping call is booked and the mutual NDA is signed, we arrange one or two reference calls.
| Check | A weak answer | Digital Heroes |
|---|---|---|
| 1 · BAA | The paperwork can wait until the build starts | Signed before any health data moves |
| 2 · Security work | A HIPAA badge, with no auditor or date behind it | No certificate claimed; threat modelling inside discovery |
| 3 · Training | No dates, or training for managers only | Outside review done; records not published here, so ask |
| 4 · Other companies | Cannot say who hosts the data | The host and every service holding the data named in the scope |
| 5 · Breach notice | The 60-day legal limit offered as the standard | Number of days agreed in the BAA |
| 6 · Ownership | Code in the vendor's accounts until the last invoice | Your accounts from the first sprint; IP assigned on full payment |
| 7 · Engineers | No straight answer on location | Delhi and Lucknow, some mobile engineers in Sydney |
| 8 · Proof | Screenshots only, and no reference | Planivo live; one or two reference calls after the NDA |
The weak answers are illustrations of the pattern, not quotes from any firm. Nothing on this page is legal advice; your counsel decides what your BAA and contracts must say.
Paperwork shows what a vendor will commit to; the first conversation shows how it thinks. In the public threads where buyers and builders compare healthcare vendors, three signals come up again and again.
Our first call costs nothing and lasts 30 minutes. Bookings start five days out, which gives the discovery lead time to read what you send beforehand. When the project fits us, a written scope and quote follow within 48 hours; when it does not, we say so before the call ends.
Most health builds start with discovery and then move into one of the models below. The BAA rule is the same in each: it is signed before our team touches protected health information, however you buy the work, and that includes engineers working inside your own systems.
| Model | How it is priced | Suits a buyer who | Usual length |
|---|---|---|---|
| Discovery sprint | On its own, before any build price | Wants the workflow map, threat model and a verdict before committing a build budget | Two weeks |
| Fixed-bid build | One price against the written scope | Knows the first release, such as a patient portal or a telehealth MVP | An MVP in 8 to 12 weeks is typical; a production platform takes 16 to 28 |
| Dedicated team | Monthly, for a lead, engineers and QA | Has a roadmap that runs for many months | Normally a quarter or more |
| Staff augmentation | Set in the written scope | Runs its own product team and wants engineers who pass its interview and security checks | Engineers in place typically inside two weeks |
| Retainer after launch | Monthly | Has a live product that needs roadmap work, integrations and incident support | Ongoing; the smallest team we staff is a senior engineer and a designer |
On price, a focused first version of custom software typically costs $40,000 to $150,000 with us, and a complex enterprise platform $250,000 to $500,000 or more. In a health build, the number of user roles and the HIPAA safeguards are among the factors that move it. A fixed price for your build is set after discovery, and our custom software cost drivers page explains each factor.
Whichever model you choose, once build sprints start, each week ends with a recorded demo of the software working, alongside a short note on what shipped and what slipped. We do not invoice a week in which that demo did not happen.
Planivo is the closest thing we have built to the software a clinic group runs every day. It plans the workforce of clinics and hospitals. The whole of it is our work, from 2026: the app staff sign in to and the public site. The client gave permission to show it. It has no published results figure, so this page gives none.
Look at it the way you would look at any vendor's health work. Each of its six roles is limited to its own part of the organization. A leave request climbs three approval levels, and the system warns when two people with the same speciality would be away together. Certifications raise reminders before they expire, and every change lands in an audit history.
Access limited by role and a record of every change are two of the technical safeguards in the HIPAA Security Rule, 45 CFR 164.312. Planivo is a staff tool, not a patient app, so treat it as evidence of how we build controls, not as a HIPAA case study.
Every other claim we make, with who keeps each record, is in the verification table on our custom software company page, which also shows two more client builds. Neither of those is a health product.
It is a firm you hire to write software that only your organization will run. You pay for the work rather than for licences, and the contract usually assigns what it builds to you. The useful test is what it hands over at the end: the code, the documents and every login.
For a clinic, that firm might build the intake and booking flow your front desk already follows. Digital Heroes is one, founded in 2017; our general terms are on the custom software development company page.
Counted by US hospitals, Epic Systems. In 2024 it supplied the EHR used by 50.8% of non-federal acute care hospitals, with Oracle Health at 20.1% and MEDITECH at 15.6%, according to ASTP/ONC Data Brief 83. A ranking by revenue could order them differently. Epic sells its own EHR rather than custom builds, so a practice that wants software shaped around its workflow hires a different kind of firm and keeps the EHR it runs.
With us, a focused first version typically costs $40,000 to $150,000, and a complex enterprise platform $250,000 to $500,000 or more. Scope, integrations, security work and data migration decide where a project lands, and in healthcare the number of user roles and the HIPAA safeguards add to the security work. Your own figure is set after the two-week discovery sprint, and our custom software cost guide covers the budgeting factors in detail.
Start from what you are building, not from a ranking: the fit table above matches each kind of project to the kind of firm that does it. Buyers in public threads about picking a healthcare vendor warn that some ranked lists are paid placements, so note who published any list you use.
Then send every name on your shortlist the same brief and the eight checks, listen on the first call for questions about your workflow, and keep only the firms whose answers you can verify.
If it will create, receive, maintain or transmit protected health information for a covered entity, it is a business associate under 45 CFR 160.103, and the rules require a BAA. A firm that only writes code and never receives patient data falls outside that definition, so settle in the written scope whether it ever will, and let your counsel decide.
HHS's cloud guidance adds that a cloud provider storing only encrypted health data, without the key, is still a business associate. Our own position is simple: if our people will touch your patient data, we sign one first.
Yes. Once a scoping call is booked and the mutual NDA is signed, we arrange one or two reference calls. Buyers in public threads suggest asking every vendor, us included, for a reference that goes back a year or more, and how long that client has stayed. Ask too whether the client's software handled health data. You can open Planivo before any call.
HHS answers the nearest question in its cloud computing guidance: the HIPAA Rules allow a covered entity or business associate to use a cloud provider that stores electronic protected health information on servers outside the United States, provided a BAA is signed and the rest of the rules are followed, with the risk analysis covering that choice. Your own contracts may be stricter, so read them first.
Our engineers work from Delhi and Lucknow, with some mobile engineers in Sydney, and the BAA we sign covers any access they need. If your contracts require every engineer to be in the US, we are the wrong firm.
The code stays where it always was, in repositories held in your name, and what we made for you is assigned to you once it is paid for in full. You remove our engineers as collaborators, and whoever takes over receives the handover pack: architecture documentation, operating runbooks and a knowledge transfer session.
The health data follows the BAA: at the end of the contract the rules require a business associate to return or destroy the protected health information it holds, where feasible, and keep no copies.
Last reviewed .
Bring your security questionnaire and your BAA questions to a free 30-minute call. When the project fits, a written scope arrives within 48 hours of the call, naming the people who would build it.
115 people across five studios in New York, Delhi, London, Sydney and Lucknow, shipping ecommerce, web, software and mobile work for founder-led brands. Senior engineers only, no account-manager relay, and the same team from kickoff to launch.
Co-Founder · Lucknow · 27 posts on the site
Published .
Pinch, scroll or double-tap to zoom · drag to pan
Where should we send the proposal?
Please enter your name and a valid email.
Any faster way to reach you? Optional.
Please fill in the one you picked.
