Built a HIPAA-compliant healthcare platform with zero coding experience

Overview

This project was built as a direct result of the four AI Mastery classes with Sarah and Tyler, which introduced me to vibe-coding and AI-assisted software development.

As a non-technical founder, this was my first exposure to building production software through natural language collaboration with AI. What started as an exploration during the course evolved into a fully deployed, HIPAA-compliant healthcare SaaS platform serving real practitioners and patients.

Expand Health AI Copilot is a production-ready, AI-native clinical operating system built primarily through Claude Code as a senior engineering partner.

---

Built a comprehensive web-based documentation site for ExpandHealth AI, a HIPAA-compliant healthcare platform featuring AI-powered lab analysis, protocol generation, and patient management. The documentation spans 30+ pages across 8 major sections covering practitioner workflows, patient portal usage, AI features (OpenAI, Claude, Gemini integration), technical architecture, security compliance, and troubleshooting—complete with responsive design, client-side search functionality, embedded video walkthroughs, and step-by-step guides. Deployed to staging via Railway with automated CI/CD pipeline, the site provides end-to-end guidance from initial setup through advanced features like semantic knowledge base search, wellness score calculation, and Google Calendar-synced appointment scheduling, serving as the definitive resource for practitioners, patients, administrators, and developers working with the platform.

Built a production-ready, HIPAA-compliant healthcare SaaS platform from scratch using Claude Code as the primary development tool - transforming a healthcare practice management vision into a fully functional multi-tenant application serving real practitioners and patients.

Key Accomplishments:

-  Full-stack production platform deployed on Railway with PostgreSQL database

-  Multi-tenant architecture supporting multiple healthcare practices with complete data isolation

-  AI-powered clinical features: Lab PDF analysis, treatment protocol generation, AI knowledge base, and intelligent chatbot

-  Comprehensive security: JWT authentication with refresh tokens, rate limiting, SQL injection prevention, XSS protection, invite-only registration, and PHI encryption

-  CI/CD pipeline: GitHub Actions with CodeQL, TruffleHog secret scanning, automated security audits, staging-first deployment workflow

-  HIPAA compliance readiness: BAA registry, sub-processor inventory, PHI audit trails, Sentry error monitoring with PHI scrubbing

-  Real-world impact: Client management, appointment scheduling, intake forms, wellness scores, clinical notes, patient messaging, and task management

Tools Used

Primary Development:

- Claude Code (Anthropic) - 95% of codebase built through vibe-coding conversations

- Claude Sonnet 4 - AI pair programming partner for architecture, debugging, and feature implementation

AI Integrations:

- Claude API (Anthropic) - Fallback for summaries and clinical text generation

- OpenAI GPT-4 - Primary AI for lab summaries and protocol generation

- Gemini 2.0 Flash (Google) - Knowledge base queries and semantic search

- PDF.js - Lab document parsing and rendering

Tech Stack:

- Backend: Node.js, Express.js, PostgreSQL

- Frontend: Vanilla JavaScript, HTML/CSS (intentionally simple for rapid iteration)

- Deployment: Railway (auto-deploy from GitHub)

- Email: Resend (OTP authentication)

- Monitoring: Sentry (error tracking), Axiom (log aggregation)

- Security: express-rate-limit, helmet, express-validator, bcrypt, JWT

 Methodology

Vibe-Coding Development Process:

1. Conversational Architecture - Used Claude Code to discuss and design the entire system architecture, database schema, API structure, and security model through natural language conversations

1. Iterative Feature Building - Each feature built through vibe-coding sessions:

- Describe the feature goal in plain English

- Claude Code generates implementation code

- Immediate testing and refinement through conversation

- Claude Code handles edge cases, error handling, and security considerations

1. AI-First Debugging - When issues arose, described the problem to Claude Code and received:

- Root cause analysis

- Proposed solutions with trade-offs

- Implementation fixes

- Prevention strategies for similar issues

1. Security Hardening - Conducted security audit conversations with Claude Code:

- Identified vulnerabilities (SQL injection, XSS, auth bypass, tenant isolation)

- Generated fixes with parameterized queries, input validation, CSP headers

- Implemented rate limiting, account lockout, password policies

- Set up automated security scanning (CodeQL, TruffleHog, Snyk, Dependabot)

1. Production Deployment - Claude Code helped:

- Design staging-first deployment workflow with GitHub Actions

- Configure Railway environments (staging + production)

- Set up environment-specific variables and secrets

- Create deployment scripts and PR automation

- Implement branch protection and required status checks

Key Insight: By treating Claude Code as a senior engineering partner rather than just a code generator, I could tackle enterprise-grade complexity (multi-tenancy, HIPAA compliance, CI/CD) that would typically require a team of developers.

Key Learnings

1. Vibe-coding can handle production complexity - Initially skeptical that AI-assisted coding could build a HIPAA-compliant healthcare platform, but Claude Code excelled at:

- Complex database schema design with proper foreign keys and indexes

- Multi-tenant data isolation with middleware enforcement

- Security best practices (parameterized queries, input validation, encryption)

- Enterprise deployment patterns (staging environments, CI/CD, monitoring)

1. Prompt engineering is the new debugging - Spent more time crafting clear problem descriptions than writing code. The better I explained the desired outcome, the better Claude Code's implementation.

2. AI accelerates learning - Claude Code became a real-time mentor, explaining why certain patterns are better (e.g., JWT refresh tokens vs long-lived tokens, rate limiting strategies, CSP configuration) while implementing them.

3. Iterative refinement beats perfect upfront specs - Embraced "build → test → refine" cycles with Claude Code. Started with basic features, then added complexity (pagination, search, filtering, security) through follow-up conversations.

4. AI-native architecture - Designing the platform to use multiple AI providers (Claude, GPT-4, Gemini) for different use cases (clinical summaries, knowledge base, chat) - essentially building an AI orchestration layer.

5. Documentation as development - Writing the CLAUDE.md file (project instructions for Claude Code) became a forcing function for clear thinking about architecture, deployment, and security policies.

6. Security can't be an afterthought - Even with AI assistance, security requires intentional focus. Had to explicitly ask Claude Code to audit for vulnerabilities - it won't automatically make every choice secure without prompting.

 Relevant URLs

- GitHub Repository: https://github.com/emilianpopa/expandhealthai

- Production Deployment: https://expandhealth-ai-copilot-production.up.railway.app + https://app.expandhealth.io/

- Test tenant credentials:

- Email: demo@expandhealth.io

- Password: ExpandHealth2026!

- Railway Project: https://railway.com/project/5d2b70a6-b4d5-4c5d-8f89-064ad32d4adb

- Demo Video: https://youtu.be/DSON0dFolBw

 Why This Represents Vibe-Coding Excellence

This project demonstrates the transformative power of vibe-coding:

- Zero traditional coding experience required to build enterprise-grade software

- Natural language → production code pipeline that actually works at scale

- Solo developer → full platform in a fraction of the time traditional development would take

- AI as collaborative partner rather than just autocomplete tool