HIPAA-Compliant Telehealth Infrastructure

The Challenge

A US-based health system operating 120+ clinics needed to launch telehealth services that met HIPAA, HITECH, and state-level telemedicine regulations across 8 states. Their existing video solution was a commercial SaaS product that could not integrate with their Epic EHR instance, forcing clinicians to manually transcribe visit notes — adding 12 minutes per encounter.

The platform needed to support 15,000 concurrent video sessions during peak hours (Monday mornings), maintain end-to-end encryption with no intermediate decryption, and produce structured encounter documentation that flowed directly into the patient's electronic health record.

Our Approach

We built the platform on a WebRTC mesh architecture using Mediasoup as the selective forwarding unit (SFU). All media streams are encrypted end-to-end using SRTP with DTLS key exchange. The SFU forwards encrypted packets without decrypting them, satisfying the HIPAA requirement that no intermediary has access to protected health information in transit.

EHR Integration: We implemented a bidirectional HL7 FHIR R4 integration with Epic. Before each visit, the system pulls the patient's problem list, medication list, and recent lab results into the clinician's telehealth interface. After the visit, a structured FHIR Encounter resource — including ICD-10 codes, CPT codes, and clinical notes — is written back to Epic via the FHIR API.

Clinical Documentation: An ambient listening module (deployed on-device, never cloud-processed) generates a draft SOAP note from the consultation audio. The clinician reviews and signs the note within the platform, and the signed note is transmitted to Epic as a DocumentReference resource.

Infrastructure: The entire platform runs on AWS GovCloud with FedRAMP-equivalent controls. We deployed across us-east-1 and us-west-2 with active-active failover. Session state is stored in Amazon ElastiCache (Redis) with cross-region replication.

Results