Hurraira Nasir

Hurraira NasirJun 30, 2026

If you're about to launch a "vibe coded" healthcare app... read this first. I keep seeing people build patient-facing tools with Cursor, Claude, GPT, whatever, and push them live fast. That's fine for most software. It's genuinely dangerous for healthcare. Not trying to gatekeep, I think it's great more people are building. But there are a few basic things that get missed constantly, and they show up as breaches. For context: I have spent over three years building HIPAA-compliant EMRs and billing platforms for US therapy practices, live in production, handling real patient data daily. Most of what breaks is mostly things that are overlooked. So if you're building something that touches patient data, here's a quick sanity check. 1. You need to protect the patient, not just the app If you’re storing anything that identifies a patient and relates to their health, and you have US users or clients, you’re in HIPAA territory. Not eventually. Immediately. (Other countries have their own equivalents, GDPR for health data in the EU, PIPEDA in Canada, so check what applies to you.) Most people don't think about this until something goes wrong. At minimum: - encryption at rest and in transit - a real audit log of who accessed what, and when - signed Business Associate Agreement with every vendor touching that data You don't need a compliance department. You do need to not be reckless. 2. Basic compliance posture (the part everyone skips) You can get a real baseline just by being deliberate about a few decisions before you start prompting your AI tool. Something like: which fields actually count as PHI, who gets access by default, and what happens in your logs the day someone asks "who looked at this patient's record." If you can't answer that last one in five minutes, you're not ready to launch. 3. Your error logs are probably leaking patient data right now This one gets almost everyone. Your stack trace crashes, and it dumps the full request object into your error tracker. That request object had a patient's name, date of birth, and diagnosis in it. Now that PHI is sitting in a third-party logging tool you never signed a BAA with. Scrub PHI from logs before it ever leaves your server. 4. Sending data to an LLM API is not a gray area If you're piping patient data into an AI API for summarization, notes, or anything else, that vendor is now touching PHI. Most consumer AI APIs are not HIPAA-eligible by default. Check if the provider offers a BAA-covered tier before a single real patient record touches that endpoint. If they don't offer one, don't send real data there. Use synthetic data while you build. 5. Access control is not optional, even for an MVP "Everyone with a login can see everything" is a common shortcut early on. In healthcare, it's also a violation waiting to happen. Role-based access, even a simple version, needs to exist before real patient data does. #vibecoding #AIinHealthcare #HIPAA #HealthcareSoftware

Hurraira NasirJun 4, 2026

I spent 3 years building and maintaining an EMR + billing platform for a US rehab therapy practice. This article is everything that experience taught me about what these systems actually require. Inside: → The 5 jobs every therapy platform must do (and why treating them as separate features fails) → The full claims lifecycle, from eligibility to paid claim — with diagrams → Where AI genuinely belongs in practice software, and the guardrails it needs → The HIPAA compliance stack, layer by layer → The bug class nobody puts on a feature list: silent data corruption in clinical systems Written for practice owners evaluating their software and founders building in healthcare. If you run a PT/OT/SLP practice — what's the one thing your current software makes harder than it should be? #HealthTech #HIPAA #PhysicalTherapy

Hurraira NasirJun 24, 2026

The most common PT claim denials I see and how to fix them: Missing or expired prior auth : automate renewal reminders 30 days before expiration. Do not rely on someone remembering. KX modifier applied incorrectly : your system should flag when a patient crosses the $2,330 threshold automatically, not after the claim is denied. Wrong therapy discipline modifier : GP for PT, GO for OT, GN for SLP. One wrong modifier on a claim means automatic denial. Eligibility not verified on date of service : verify the morning of every appointment, not once at intake. Most practices fix these manually. All four can be automated. #physicaltherapy #ptbilling #privatepractice