Built with
- Next.js 15
- React
- TypeScript
- Tailwind CSS
- Node.js
- Docker
- zod
- ExcelJS
A modern web app with strict type checks, so mistakes are caught before they reach anyone.
A private billing portalfor an adult family home.
Years of billing spreadsheets became one secure place to find any claim, payment or check in seconds. It was built with care for the privacy of residents.
The home is kept anonymous. No resident information appears on this page, and all testing used made-up data.
- Who
- A family-run adult family home that bills Medicaid managed-care plans.
- Challenge
- Claim, payment and follow-up history lived in spreadsheets. Answering an insurer meant digging.
- What we built
- A private web portal for billing, payments and follow-ups, fully HIPAA compliant.
- Status
- Built, tested and live on Google Cloud.
The challenge
An adult family home cares for a small number of residents in a real home. Behind the care sits a lot of paperwork: monthly claims to insurers, checks that cover many claims at once, denials to chase and corrections to resubmit.
All of it lived in spreadsheets. When an insurer asked about a claim, finding the reference, submission date or check number took time. The home wanted one private place to keep it all. Because it handles health information, it needed that place to be built safely from the start.
What we built
- Monthly claims, built for youEach month's claims are built from residents, authorizations and absences, following the billing rules. They're exported in the format the home's claim tool expects.
- Payments that add upRecord each check once and split it across many claims. Insurers' electronic remittance files (X12 835) import with a review step first.
- One month at a glanceA grid of residents by month: paid, partial, missing, denied, written off or not yet billed, with what's owed.
- Nothing slips throughFollow-up tasks for unpaid or denied claims, ready-to-send email templates, and daily reminders that never include patient information.
- History, safely moved inMore than a year of spreadsheet history imported through a draft-and-review flow that can be safely undone.
- Paperwork, read for youPhotograph or upload a document and AI suggests the details. A person confirms every value before it's saved.
How we kept it safe
Security wasn't added at the end. Every layer was planned around one idea: only the right people see the right things, and every action leaves a record.
- Strong sign-inEvery account needs an authenticator app (TOTP multi-factor authentication). Idle sessions end after 15 minutes.
- Only what each person needsRole-based access is checked on the server for every request, and each part of the system has only the permissions it needs.
- A record of everythingAn audit trail of who viewed, changed or exported what. The owner is alerted to emergency access or changes to permissions.
- Encrypted everywhereStored data and backups are encrypted with AES-256. Data in motion travels only over TLS 1.2 or 1.3 with HSTS, and older, weaker connections are refused. File downloads use signed links that expire quickly.
- Watched by Google Cloud's security toolsSecurity Command Center checks for risky settings. Cloud Audit Logs record data access, and Cloud Monitoring raises alerts. Secrets live in Secret Manager, and deploys need no stored keys, thanks to Workload Identity Federation.
- Private and backed upThe database can't be reached from a browser directly. Nightly backups are copied to a second region, and a restore drill recovered every record.
Under the hood
The technology, in plain words.
Hosted on Google Cloud
- Cloud Run
- Firestore
- Cloud Storage
- Identity Platform
- Secret Manager
- Security Command Center
- Cloud Audit Logs
- Cloud Monitoring
- Workload Identity Federation
- Cloud Scheduler
- Terraform
Runs under a signed Business Associate Agreement (BAA), with separate staging and production. All of it is set up as code, so it can be reviewed and rebuilt.
Security
- AES-256 at rest
- TLS 1.2+ & HSTS
- Signed URLs
- TOTP MFA
- RBAC
- Least-privilege IAM
- CSP headers
- Audit logs
- Point-in-time recovery
HIPAA-compliant safeguards, including strong sign-in, tight permissions, encryption, a full audit trail and tested backups.
Testing & checks
- GitHub Actions
- Vitest
- axe-core
- Stryker
- Semgrep
- Trivy
- SBOM
Every change is tested and scanned automatically. Even the tests are tested.
AI, with a person in charge
- Claude Code
- Gemini on Vertex AI
- Document AI
AI helped write and review the code, and it reads uploaded paperwork. A person approved every change and confirms every value.
Billing & messages
- X12 835 (ERA)
- Amazon SES
Reads insurers' electronic payment files and sends reminders that never include patient information.
What do these words mean?
- HIPAA
- The US law that protects health information. Being HIPAA compliant means meeting its privacy and security rules.
- BAA
- Business Associate Agreement. A contract in which a vendor agrees to protect health information.
- MFA / TOTP
- Signing in needs a password plus a short code from an authenticator app.
- RBAC
- Role-based access control. People see only what their role needs.
- Least privilege
- Every person and part of the system gets only the access it needs, and nothing more.
- AES-256
- A strong, widely trusted standard for encrypting stored data, including backups.
- Signed URLs
- Download links that only work for a short time, so a shared link stops working.
- TLS / HSTS
- The lock in your browser. Everything sent between you and the portal is encrypted.
- CSP
- Content Security Policy. Browser rules that block untrusted code from running on the page.
- X12 835 / ERA
- The standard electronic file insurers send to explain a payment.
- Security Command Center
- Google Cloud's security dashboard. It flags risky settings and threats across the project.
- Workload Identity Federation
- Deploys prove who they are without stored passwords or key files.
- Terraform
- The cloud setup is written as code, so it's repeatable and easy to review.
- Point-in-time recovery
- The database can be rewound to any moment in the past few days.
- Mutation testing (Stryker)
- Small bugs are planted on purpose to prove the tests catch them.
- SBOM
- Software bill of materials. An ingredient list of every software package used.
What this means for you
If people trust you with private information, the tools you use should earn that trust too. You don't need a huge team. You need clear goals, careful choices and honest testing. Whether you're replacing spreadsheets or protecting what you already have, we can help you start.
Something similar on your mind?
Tell us what you're building or what you're worried about. A short note is plenty.
Start a conversation