Skip to content

Healthcare software development company for providers, payers and health-tech products.

We build and integrate clinical and patient-facing software: consultation platforms, remote and home monitoring, research interfaces, and the HL7 v2, FHIR and vendor-API layers that make one patient the same patient in every system.

On most healthcare projects the integration is the largest line item and the worst estimated one, because what a standard says and what your partner's system actually sends are rarely the same thing. We ask to see real examples before we quote.

  • 120+Projects delivered across 12 countries since 2012
  • 100+Senior in-house engineers, six countries
  • 5.0Unified rating across 61 client reviews on Clutch
  • 2 to 4 weeksTypical time from signature to start
  • ISTQBCertified QA inside every sprint
  • ISO 27001Certified security practice, audited by Quay Audit UK

01Overview

What healthcare software development involves, and where the time actually goes

Healthcare software development is the design, build and integration of clinical and patient-facing systems: consultation platforms, remote and home monitoring, and the HL7 v2, FHIR and vendor-API layers that reconcile one patient's record across every system holding part of it. The integration, not the application, is usually where the time goes. In this sector we publish two builds: CancerDocs, a HIPAA compliant consultation platform, and a US home health monitoring platform we were brought in to stabilize and still run.

  • See and consultEverything a clinician or a patient touches directly: the visit, the message, the record in front of them.
    • Telemedicine and consultations
    • Scheduling and messaging
    • Patient and clinician portals
  • Measure and monitorData arriving from outside the building: devices, home programmes, and the third parties who send it.
    • Remote and home monitoring
    • Device and feed ingestion
    • Alerting and escalation
  • Exchange and reconcileThe unglamorous half, and the one that decides the timeline. One patient exists in several systems at once.
    • HL7 v2 interfaces
    • FHIR APIs and vendor apps
    • File feeds and reconciliation
  • Protect and proveWhat you have to be able to show afterwards: who saw which record, when, and under whose authority.
    • Isolated PHI environments
    • Access control and audit trails
    • Retention and erasure

02Routes

Four ways patient data reaches your system, and one case for not connecting it

The decision that governs a healthcare budget is not which framework, it is which route your data takes into and out of the record. There are four in practice, and each one fails differently when the partner's implementation and the specification disagree. The fifth row is the one nobody sells you: sometimes the honest answer is that the interface is not worth building.

The route in and outWhat it costs youWhen it is the right route
HL7 v2 over MLLPADT, ORM and ORU feedsEvery site profiles the standard differentlyAn interface layer built against the messages your partner actually sends, Z-segments and locally-required optional fields included, normalized before anything downstream reads them.Platform development and integrationOr book a meeting
FHIR REST APIsR4 resources over HTTPRead is broad, write is usually narrowA client written against the endpoint you will actually call. We check which resources the site has enabled, and which of them accept a write, before the estimate is written.How we build custom systemsOr book a meeting
A vendor app programmeEpic, Oracle Health, your client’s platformYour timeline becomes somebody else’s calendarIntegration through the vendor’s own programme, with registration, review and sandbox access sequenced first, because they are the part of the plan you cannot compress.A platform we wired to third-party feedsOr book a meeting
Flat files over SFTPCSV, fixed width, nightly batchIt works, and it is a day oldAn ingestion pipeline that treats every file as unreliable: duplicate detection, a record of what arrived when, and a reconciliation path a human can read when the counts disagree.Data and pipeline engineeringOr book a meeting
No interface at allSomebody re-keys itNothing, while the volume stays lowCount the records per week first. Under a certain volume an interface costs more to keep running than the typing it replaces, and we would rather say that at discovery than build it.Scope it with business analysisOr book a meeting

03Solutions

What we build for providers, payers and health-tech products

Six kinds of work, each drawn from something we have delivered rather than from a category list. Every card names the situation it is right for, because most of these are wrong for most products.

  • Consultation, messaging and scheduling software for the people actually using it. For CancerDocs we built private online medical consultations, real-time chats with doctors and nurses, and payment integration with Authorize.Net and PayPal, inside an environment built to the HIPAA Security Rules.

    Right when
    No product fits how care is delivered
  • Ingesting data from devices and third-party services, deciding what counts as an alert, and putting it in front of a clinician in a form they will act on. The home health platform we run processes incoming third-party data where dependable delivery is the whole proposition.

    Right when
    Care continues outside the building
  • The HL7 v2 feeds, FHIR clients, vendor app registrations and file pipelines that make one patient the same patient everywhere. On most healthcare projects this is where we start, because everything else in the plan depends on it.

    Right when
    One record lives in five systems
  • Somebody else built it, the outages are yours now, and the original team has gone. We read the codebase, stop the bleeding, then modernize module by module while the product keeps serving the people who depend on it.

    Right when
    It works until the week it does not
  • Isolated per-product infrastructure rather than a shared box. On CancerDocs each stack ran in its own AWS Virtual Private Cloud, with databases and internal services in a private subnet inaccessible from the internet, the database encrypted, and developers holding no database access at all.

    Right when
    You will be asked to show the controls
  • A screen a nurse uses forty times a shift is a different problem from one a patient uses twice a year. We design for the one under time pressure first, where a mis-tap becomes a record somebody has to unwind.

    Right when
    Staff are working around the software

04Obligations

What a clinical system inherits, and what we bring to it

A system that touches patient data inherits obligations whether or not anyone planned for them, and several of them decide the architecture rather than the feature list. Six below that constrain a build, then the three things unicrew brings to them.

Your productWhat the system inheritsObligations that arrive with patient data, and what each one settles about the build.
  • Protected health information under HIPAA

    The Security Rule is five areas, not a checkbox: access control, audit controls, integrity, authentication, and transmission security. On CancerDocs we read them in full before writing code, because they decide the infrastructure.

    In a build
    Settled in the infrastructure, not the UI
  • Business associate agreements

    Every vendor in the data path needs one, and that includes the cloud, the logging service and the analytics tool. It is a constraint on your supplier list before it is a piece of paperwork.

    In a build
    It narrows the tooling you may use
  • The interoperability rules

    US certified electronic health record systems must expose standardized FHIR APIs, which is why that route exists at all. What a given site has actually switched on is still a question for that site.

    In a build
    Ask the site, not the specification
  • Health data under GDPR and UK GDPR

    Health data is a special category, so a lawful basis, a retention position and a workable erasure path have to exist in the data model rather than in a policy document nobody can execute.

    In a build
    Retention designed in, not bolted on
  • Products that become medical devices

    Where software diagnoses, or drives a treatment decision, it can fall under Software as a Medical Device rules in the US or the EU. The classification changes your documentation and change control, not your code.

    In a build
    Classify before the roadmap, not after
  • Audit trails and record retention

    Who read which record, when, and under whose authority, kept for as long as the record itself is kept. Event logging is cheap to design in at the start and expensive to reconstruct afterwards.

    In a build
    Costly to retrofit, cheap to design in
unicrewWhat we bring to itThe certifications we hold, how delivery is tested, and how we work inside your systems.
  • ISO 27001:2022 and ISO 9001:2015

    Information security and quality management, both renewed through a multi-stage audit with Quay Audit UK. It is usually what a hospital, payer or insurer security questionnaire is reaching for.

    What it gives you
    A document trail that already exists
  • ISTQB-certified QA inside every sprint

    Certified QA engineers work inside the sprint rather than after it. That matters most on anything that writes to a patient record, where a defect does not stay a defect for long.

    What it gives you
    Defects caught before a record is written
  • Least-privilege access, agreed first

    Contracts and NDAs before anyone starts, access agreed with your technical contact, read-only wherever the work allows, and no write access to production during discovery. On CancerDocs the developers had no access to the databases at all.

    What it gives you
    No production write during discovery

In healthcare the integration is the project. You exchange data with systems set up years ago by people who have left, and no two are the same even under the same standard. An estimate written before anyone reads what your partner actually sends is a guess. We ask for real examples early. The alternative is finding out in month four.

Vuhar MamedovManaging Partner for Europe, unicrew

05Proof

The healthcare work we can point at

Two published healthcare builds, one of them running since 2024, and the client's own account of what that has been like. Nothing below is inferred: each item is either countable from the collection or in the client's own words.

  • A regulated platform, and the environment underneath itCancerDocs is a HIPAA compliant platform for private, online medical consultations on cancer-related topics. Each PHI-ready stack ran in its own AWS Virtual Private Cloud: databases and internal services in a private subnet inaccessible from the internet, the database encrypted, deployment fully automated, and developers holding no database access at all. We read the HIPAA Security Rules in full before writing code.
    HIPAAthe rules read before the code
  • A product we were brought in to steadyA US home health monitoring platform came to us with periodic outages. We updated the infrastructure, added monitoring, cut AWS costs and stayed on. Founder Kevin Terry writes in his verified Clutch review: "We've been working with unicrew since June 2024, and the engagement is ongoing." "The team stays on budget and meets deadlines." "We feel like we have a partner, and that's been incredible."
    2024the year this client brought us in
  • The certification a hospital's security review asks forunicrew holds ISO 27001:2022 and ISO 9001:2015, renewed through a multi-stage audit with Quay Audit UK, and runs ISTQB-certified QA engineers inside the sprint rather than as a pass at the end. A hospital, payer or insurer security review asks for exactly that, and it runs on their timetable rather than yours.
    ISO 27001plus ISO 9001, audited by Quay Audit UK

07Questions

Questions we get asked before a healthcare build

Usually more than one. Which ones only becomes clear once somebody reads what your partner actually sends. HL7 v2 over MLLP is what most installed hospital systems emit, and every site profiles it differently, so one hospital's interface rarely works at the next. FHIR is cleaner, but read access is usually broader than write. A vendor's app programme reaches data the others do not, on the vendor's calendar rather than yours. We ask for real sample messages at discovery.

We work on three engagement models: time and materials billed hourly and quoted per project, fixed price quoted per project against an agreed outcome, and team extension billed monthly per team member. Which fits depends on how firm the scope is, and we recommend one at the end of discovery. We do not publish a project price band: the range between one FHIR read integration and a regulated platform with its own isolated PHI environment is too wide for a number to help.

Most engagements start within two to four weeks of signature. The constraint on duration is rarely the application, it is the partner: a vendor app registration, a hospital IT security review or a sandbox credential sits on somebody else's calendar. We sequence those first and build everything that does not depend on them in parallel, aiming to put one working workflow in front of real users before the rest of the scope is committed.

We build to the HIPAA Privacy and Security Rules and sign a business associate agreement for engagements involving protected health information. HIPAA compliance is a shared responsibility, not a certificate somebody hands you: we engineer the controls and document them so you can demonstrate them. unicrew holds ISO 27001:2022 and ISO 9001:2015, renewed through a multi-stage audit with Quay Audit UK. We do not hold SOC 2, and we tell you that rather than let you assume it.

Yes. A US home health monitoring platform came to us with periodic outages, needing a team that could take over the codebase without an extensive handover. We updated the cloud infrastructure, added monitoring, brought AWS costs down, ran a full UI and UX redesign, integrated further third-party data sources, and stayed on. The first weeks are deliberately unglamorous: stop the outages, get tests around what breaks most, and map what the system genuinely integrates with before anything is rewritten.

Yes, and the version worth doing first is usually retrieval, documentation and analytics rather than anything inside a treatment decision. The moment software diagnoses or drives care it can fall under Software as a Medical Device rules in the US or the EU, which changes your documentation and change control rather than your code. Settle which side of that line a feature sits on before it is built, not after it ships. See our AI integration services.

You own both. Put it in the contract rather than assume it. The code lives in your repository from the first commit rather than being handed over at the end, and the infrastructure runs in your cloud account where the work allows. Fixed-scope work carries a post-launch warranty whose length is agreed in the contract. If you would rather your own team ran it afterwards, say so at the start: it changes how much we document and when.

Send us the systems it has to talk to, and we will tell you what is realistic

A call with a senior engineer who has shipped regulated health work, not a sales qualifier. You leave with an opinion on the integration route, the obligations it drags in, and the order to build them in.

Let's talk

What happens after you contact us

  1. We reply within one business dayA senior engineer reads your message, not a bot.
  2. A call about the integrationWhat systems you have to reach, and what they actually emit.
  3. Route and engagement model, in writingThe integration route, priced as time and materials, fixed price, or team extension.
  4. NDA, then discoveryMost engagements start within two to four weeks of signature.

Thank you

Thanks for your message. We will get in touch with you shortly.

Book a call