A HIPAA-Compliant Platform for Opioid Crisis Response Teams

Opioid response teams lacked a standardized, digital solution for managing caseloads and tracking interventions. Many relied on spreadsheets and paper records, limiting their ability to measure what works and improve outcomes. Without centralized systems, policies couldn’t be tested at scale, and data remained fragmented across counties.

Goldie needed to centralize critical workflows into a single secure platform that would work reliably both online and offline, support regional differences, and maintain full HIPAA and 42 CFR compliance.

Akveo team handled end-to-end development, including system architecture, backend and frontend development, real-time messaging, mobile offline sync logic, and infrastructure deployment on AWS to ensure security, compliance, and scalability.

HIPAA compliance

To achieve HIPAA compliance the application follows these key practices:

1. Database Security: Multi-Tenant Architecture: Isolate tenant data via separate schemas and apply proper role-based access control. Backups: Ensure automated and secure backups are in place.
2. Authentication and Access Control: User authentication with strong password policies. Implement role-based access control in the app, following the least privilege principle.
3. Data Transmission Security: Ensure all data transmitted between clients and the server is encrypted using HTTPS.
4. Monitoring and Auditing: Logging activities for monitoring suspicious activity.

Multi-tenancy

The application supports data segregation at the company (tenant) level. This segregation makes it impossible for users from one tenant to access data from another tenant.

The tenant to which a user belongs is determined at the moment of authentication.

Logical data separation is implemented at the database level: each connection is established separately for each tenant and access to foreign data is restricted both at the API level and at the database level. At the API level, it is verified whether the user belongs to the requested tenant. At the database level, restrictions are enforced through separate connections and access control mechanisms.

For file storage the application uses AWS. Data segregation at this level is ensured by a strict storage structure. Tenant file access rights are verified at the API level.

Offline first

The application is based on the offline-first principle. This means that the app should work offline. Data synchronization with the global system state occurs when an internet connection is available.

To implement this approach, it was decided to divide the API into two types: read and write APIs.

The read API works only online. It loads up-to-date data onto the user's mobile device, where the data is stored in a local database. This ensures that the information remains accessible regardless of internet availability, allowing the app to work in offline mode. To optimize performance when handling large amounts of data, partial synchronization is used: with each subsequent request, only the changes that occurred in the global system state while the device was offline are downloaded.

The write API is designed to collect and store user actions while offline. These actions are recorded in the device’s database in the same order they were performed. As soon as the application connects to the internet, all saved operations are sent to the server and executed sequentially. If the application is online, data is sent directly to the server without being stored locally.

Sending emails

The application provides the ability to send emails to patients on behalf of the tenant. To do this, administrators enter their email address in the control panel, which is then used as the sender's address.

SMS chats

Users and patients can communicate via SMS, implemented in a chat format. Each tenant is assigned a phone number used for sending and receiving SMS messages. The chat is updated in real-time.

Notifications

Users of the application receive notifications about changes via push notifications and in-app notifications. They can interact with the notifications to navigate or quickly perform actions within the app.

Scheduled jobs

The system has an automatic logic that allows actions to be performed without user involvement, such as status changes, task creation, report generation, and so on.

Integration with Analytics services

For data analysis, the application integrates with third-party services, providing access to data in a format suitable for analysis. These systems use the provided data to visually display various business process metrics.

Public API

In addition to using the system within the mobile application, there is the possibility of integration with other solutions and teams through a public API.