Home · Method · Healthcare · Hospitality · Engagement · About · Book a discovery call

Fractional CTO for healthcare

Same engagement as the rest of this site: Learn, Assess, Strategy, Translate, and DevOps. This page is the estate those steps are pointed at. It is not a second service.

The customer path is the patient. The money path is longer than the visit. A map that ends when the patient leaves the room misses the claim, the denial, and the unsigned note.

What gets shadowed

One product family, not “patient care.” An established-patient office visit at one clinic, from the request for a slot to a payer decision on the claim, is a usable charter. New patients, procedures, and referrals stay off that map. If the business is imaging, the boundary is one modality, from referral to a delivered report.

People to stand next to:

• Front desk and schedulers. Phone, portal, fax referral, slots booked and then unwound.
• Medical assistant and clinician for a full session, including the inbox after the session.
• Revenue cycle: charge capture, coding query, claim, denial, resubmit.
• Whoever is on call for the EHR, or the analyst who files the vendor ticket. Shadow. Do not take the pager.

Systems go on the map only when they appear in the work: EHR schedule and chart, orders, payer portal or clearinghouse, fax or direct referral, identity. HIPAA is a constraint on those arrows. Who can see electronic protected health information, where it sits, and whether a vendor or a model receives it. It is an access rule for the shadowing, and a property of the handoff. It is not a backlog of security products.

Failure demand you should expect to hear

Count these in the caller’s words, at the point of contact:

• You never called me back.
• The referral is not here.
• The authorization is missing.
• The claim was denied.
• The portal lost the form.
• The result is not in the chart.

Value demand sounds different: book this visit, refill, refer, pay this claim the first time.

What an assessment looks for

A two-week assessment samples. It does not finish the practice’s HIPAA risk analysis. HHS requires that analysis to cover all ePHI the organization creates, receives, maintains, or transmits. The check in this engagement is whether the document exists and whether the three in-scope systems appear in it.

Other samples, only when the artifact is in the room:

• The paper downtime set, and the last time anyone used it.
• One order that did not reach the ancillary system, or one result with no documented follow-up, and the person who is supposed to notice.
• One week of charges, marked where each one stalled: eligibility, documentation, the clearinghouse interface, a portal payment that did not post.
• An AI feature inside the EHR: which feature, whose note it writes into, whether a human reviews it, and whether the data stays inside the business-associate agreement.

ONC’s SAFER Guides are the source for the downtime, orders, results, and AI-accountability samples. Completing a SAFER checklist is not a HIPAA determination. The guides say so.

What a strategy looks like here

One intake stream before a new channel or a model. A specialty group’s referred patients for one service line do not become attended visits, and staff type the same demographics into the schedule and the record. The policy is to close conversion on that stream. The order is: count the drop-off and name the handoff owner, stop the double entry using the EHR’s existing API, and only then automate the slowest step inside the current HIPAA boundary.

EHR replacement, a data platform, and an “AI front door” are the examples of what that strategy declines. A bet that calls a certified EHR’s patient-access API is integrating with the record. The adopted standard in 45 CFR 170.215 is HL7 FHIR Release 4.0.1. That is a reason to integrate, not a reason to replace the record.

When a clinical change ships

During DevOps, EHR, e-prescribing, results, and any integration that writes into the chart change after the last booked patient, with someone still available who has executed the rollback, and with the pipeline green. A charting outage at the open of clinic stops the work the patient showed up for. Portal copy can move in a quiet hour when rollback is real.

An agent session that might include a note, a name, or an image stays prohibited unless the tool is in the permitted-with-guardrails bucket and the vendor arrangement covers ePHI. The security official remains the client’s.

Book a discovery call

The call is to decide whether this engagement fits. The answer can be no.