Secure Patient Portal for a Telehealth Platform
Ashish Sharma
Building a Secure Patient Portal for an Asynchronous Telehealth Platform
Overview
aa.health is an asynchronous telehealth platform designed to help patients complete medical intake, communicate with healthcare providers, receive treatment plans, and manage their care through a secure digital experience.
I worked on the backend architecture and patient portal, building the systems required to securely manage sensitive healthcare information while keeping the experience simple for patients and providers.
The Challenge
Healthcare platforms must balance two priorities: protecting sensitive patient information and making the product easy enough for patients to use without assistance.
The platform required secure and reliable workflows for:
Patient registration and authentication
Medical intake and health questionnaires
Provider review and clinical decision-making
Treatment plans and prescriptions
Secure patient-provider communication
Role-based access to medical information
Auditability of actions involving patient data
The backend also needed to support a clean frontend experience while maintaining strict controls around protected health information.
My Role
I worked on the backend systems and patient portal architecture, collaborating with the frontend team to design secure and intuitive healthcare workflows.
My responsibilities included:
Designing and developing backend APIs
Structuring patient and clinical data
Implementing authentication and authorization
Building role-based access controls
Supporting patient intake and provider-review workflows
Developing secure messaging functionality
Adding audit logging for sensitive actions
Integrating backend services with the React patient portal
Improving reliability, validation, and error handling
The Solution
Patient Intake and Clinical Workflows
I built APIs supporting the patient journey from initial registration through medical review and treatment.
The workflow enabled patients to:
Create and access their accounts securely
Submit medical history and intake information
Complete health-related questionnaires
Provide information required for provider review
View treatment plans and care-related updates
Access prescriptions and clinical information where applicable
The APIs were structured to keep patient-facing workflows separate from provider and administrative operations.
Authentication and Access Control
Healthcare data should only be accessible to users with the correct permissions.
I implemented authentication and role-based authorization for patients, providers, and internal users. Access rules were enforced at the API level so users could only retrieve or modify information relevant to their role and assigned records.
This reduced the risk of sensitive data being exposed through frontend manipulation or incorrectly configured user interfaces.
Secure Patient-Provider Messaging
I worked on secure messaging functionality that allowed patients and healthcare providers to communicate within the platform.
Messages and related actions were associated with the appropriate patient records and protected through authenticated access controls.
Audit logging was added for operations involving sensitive healthcare information, providing visibility into who accessed or changed data and when the action occurred.
Healthcare Data Protection
The platform was designed with HIPAA-oriented security safeguards, including:
Encryption for stored data
TLS encryption for data transmitted between clients and services
Role-based permissions
Access and activity logging
Secure authentication
Input validation and controlled API responses
Separation of patient, provider, and administrative permissions
Sensitive information was handled carefully across API responses, application logs, and database interactions to reduce unnecessary exposure.
Database and API Architecture
I designed and maintained backend data structures for patient accounts, medical intake, portal interactions, provider workflows, and treatment-related information.
The API architecture was designed to provide predictable interfaces for the React frontend while keeping business logic and authorization checks within the backend.
This made the platform easier to maintain and helped the frontend team build a consistent experience across patient and provider workflows.
Patient Portal Experience
Beyond backend functionality, I helped shape the portal architecture and user flow.
The focus was to make complex healthcare processes feel straightforward by organizing information clearly and reducing unnecessary steps for patients.
The resulting portal provided a secure and user-friendly experience for managing intake, communication, and treatment-related information.
Results
The project delivered:
A secure patient portal for asynchronous healthcare workflows
Structured medical intake and provider-review processes
Role-based access for patients, providers, and internal users
Secure patient-provider communication
Audit logging for sensitive actions
Protected storage and transmission of healthcare data
Reliable APIs supporting the React frontend
A simpler and more accessible patient experience
The system created a strong backend foundation for delivering digital healthcare services while maintaining security, privacy, and clear access control.
Technology Stack
Node.js, TypeScript, Express, NestJS, Python, FastAPI, Django, PostgreSQL, MySQL, React, REST APIs, authentication, role-based access control, audit logging, encryption, and TLS.
Like this project
Posted Sep 20, 2025
The site allows providers to manage patient scheduling and assign prescriptions. The application is fully HIPAA complient.
Likes
0
Views
3
Timeline
Aug 1, 2025 - Aug 31, 2025
