From HIPAA To AI Agents: How To Scale Secure Digital Health Products

Building great health tech isn’t about stacking features. It’s about clarity, secure architecture, and the courage to automate the real bottlenecks. We sit down with Technology Rivers founder and CEO to unpack how AI is changing the way we design, build, and scale HIPAA-compliant digital health products without cutting corners on privacy or performance.

We talk through the full development lifecycle and where AI actually pulls its weight: rapid proofs of concept, code generation that respects standards, unit testing and coverage, and fast UX prototyping that gets teams aligned. Then we draw a hard line around risk. If you’re uploading sensitive docs to generic endpoints or treating PHI like search fuel, you’re setting yourself up for trouble. We break down practical strategies like retrieval-augmented generation, clean vector design, strict access control, audit logging, and the human-in-the-loop practices that keep systems safe as they scale.

From there, we tackle the real reasons projects fail: blurry requirements and no single owner. You’ll hear a playbook for defining outcomes, narrowing scope to a lovable version one, and building for specific users—clinicians, patients, and admins—with interfaces that are simple, informed, and fast. We also explore how to graduate low-code MVPs into production systems without tossing your work: evolve schemas, enforce coding standards, add encryption and RBAC, and ship with CI and observability. On interoperability, we go beyond EHR APIs and highlight model context protocol—the next step in connecting AI agents to your data and workflows in a controlled, auditable way.

If you’re planning for VIVE or HIMSS, or you’re mapping your next quarter, this conversation gives you a sharp lens: build automation where it matters, protect data by design, and use AI to amplify well-defined processes. Subscribe, share with your team, and leave a review with the one build challenge you want us to unpack next.

Transcript

Setting The Stage: Health Tech Now

SPEAKER_01 0:01

Hey everybody. Fun chat today as we talk about best practices and the leading edge, the cutting edge of building secure and scalable healthcare platforms and digital health products with the crew industry insider. Kizentra, how are you?

SPEAKER_00 0:18

I'm doing great.

Guest Intro And Background

SPEAKER_01 0:18

How are you, Elon? I'm doing well. Thanks for joining. Very timely as we run up into industry events like Vise and HIMS and others. Of course, software and AI is at the center of much of the innovation these days. Before that, maybe introduce yourself, your background. You wear a number of different hats. So maybe you could share a bit about your journey as well as who is Technology Rivers, your firm.

AI Across The Dev Lifecycle

SPEAKER_00 0:45

Okay. So thanks. So my name is Gazan Furmansur. I'm a founder and CEO of Technology Rivers, our software development company, primarily focused on healthcare software development. We work with health tech companies building HIPAA compliant software products, work with healthcare service businesses, helping them improve operations through AI and technology. That includes building AI agents, clinical workflows, automation, that kind of stuff. So the goal is to help them get 10x growth through AI and technology, because that's really the differentiator in the service businesses, because everybody has access to all those different tools, technologies, but the automation, the workflow improvement, those are the ones that create differentiators that bring more efficiency in your processes. That's how you differentiate from your because those are your very specific flows. So we come in and we help unlock those strategies, unlock those bottlenecks, looking at all the manual stuff and create those automations. Other than that, I am an author of a book Beyond the Download, How to Build Mobile Apps that people love, use, and share every day. I've been involved in mobile since 2000, even before iPhone and Android. So based on all those different experiences, and we build around 60 different uh mobile apps uh since we started Technology Divers in 2015. So all those experiences, there are 30 plus different strategies that I shared in that book, uh, including um uh some of the latest AI uh technologies that you could use. So that book is really good for anybody who's looking to build a mobile app, any app owners, um, if you are looking to grow the app, because you can download the app, everybody download, but then are the people coming back? So that's the main uh gist of it. And I'm working on the other two books, which is on the 10x growth strategies as well as uh healthcare um in the AI era.

SPEAKER_01 2:58

So um brilliant topic. So be sure to check those out. Um so why healthcare? What attracted you to problems in the healthcare space of your work here versus other industries or challenges?

SPEAKER_00 3:12

So I personally worked at Veterans Health Administration before, um before starting uh this business as a consultant. And then our second customer was with health tech companies, and that's how we got into more and more healthcare. Then we did uh some project for startups that came out of Johns Hopkins Innovation Center, and that's how we learned HIPAA. So once we started doing, we got more and more uh leads in that space. So gradually our focus total became healthcare and health tech. And that's the area that requires a lot more innovation, uh a lot more work. Uh still way behind compared to many other industries.

SPEAKER_01 3:53

Way behind, but let's talk about software in general now. We're we're in the midst of a a revolution, literally as we speak. Uh, you can't help but notice the headlines and in uh the media every day about software development being being changed, disrupted fundamentally, about the impact on developers and software development. Before we talk, you know, speeds and fees in healthcare. What's your take on this revolution and um how does it impact you and the way you design, build software? How does it impact your clients? What's your hot take, I guess, as we stand today?

Risks, Compliance, And Data Strategy

SPEAKER_00 4:28

I would say AI has impacted or is impacting everyone, but more in a uh in a good way. So uh it's um obviously it's empowering people rather than just doing it different way. So on our side, we look at it like we have a team of developers and we're using AI everywhere in different ways. Like, so obviously there's a part that you see on when it comes to using in a car on the content side, but then on the development side, we use different tools like cursor for uh doing the quick development. The cloud code is one of the most popular ones. We create POCs using these different wipe coding tools, uh Replit, Lovable, um, and um there are quite a few others, uh Emerging and then a few other. Then we also use the tools like uh UX pilot, Visually for creating um quick POCs for like for the UX part, improving the so everywhere in our whole life development cycle, we're using AI. We are using AI for uh code coverage, for um test cases, for unit testing. For many of the places, um AI is helping us do the things that we were previously not able to do. So, and it's obviously it's changing the game everywhere. It does come with its own challenges as well, because if you just as like if let's say if you just upload the documents in ChatGPT and you do a query, a lot of people are using AI still like a Google search. But it's so how you can use it better would make a difference. And the same is the case in the development side. You can use AI to generate a code, but how do you take that code and convert it into something that is usable for your specific use case? Or are you using these wide coding tools to just generate something that's throwable? No, so there are techniques, and that's where very small percentage, maybe 5% of the people are using it in a way where you can figure out the depth of these tools, getting to know the specifics of how these tools work, so that as you're building, you're not making it a throwaway code, but it's also extended to the next level. Another place where we use it, we use the design and convert it into a code, which in the past was also available, but the code quality was up. Now you can use our own code and train AI to give you the code out of the design that is similar to our own coding standard of our own practices. And that will help grow, expand it rather than just getting something done quickly.

SPEAKER_01 7:10

Interesting. And so, you know, obviously, so many benefits. What are the risks and challenges? I mean, you're intimately involved with, you know, making HIPAA and compliance and security and data protection into products and services. Does it slow things down a lot? Or does AI really help in this regard?

SPEAKER_00 7:32

So I think the industry is going through a phase where there was a hype of, oh, AI can do everything, you can do projects in hours and days than it used to be. And now people came to realization that oh, it's not that easy, it has its own complications as well. Not every use case is a ChatGPT chat case where you just put in everything and load because you're it's like one of those where you're uploading, you're testing your application with like maybe two users, and when you have a million users on your application, suddenly there's a different case, right? So ChatGPT, you're loading two documents and doing a query, you got the results. But what if you uh loading your whole company data and now you you you have millions of those docs, and suddenly it's gonna fail. It's not practical. So now you have to use different strategies. So those are the complications, like there are different uh use cases. How you uh use AI to uh to review or to analyze your internal data, the sensitive data, whether it's PHI data or any other internal data. So, and how do you use AI to query? And so that's where most of those AI projects are also failing, because that's the use case not everybody is uh familiar with in terms of like there are different architectural implementation strategies that you have to follow. You can't just be uploading because anything you upload in AI through whether API or through other way, it's being used for training uh the LLM. That's your private data. So you have to use different strategies, whether it's using RAG architecture, vector databases, whatever. So these are different strategies that you have to use. And even then, you cannot just be getting any type of data out of it. You have to um train the data, save the data in such a way so that you can also search it later on. So you have to know those use cases. The other challenges on the development side is as you are generating the code, let's say AI generates the code and it may override existing one. Like so it has to know the context. So again, the similar challenge, just getting the query and getting the result doesn't mean I mean you get the good thing, but now you have existing data as well. You have millions of lines of code already doing certain things. Now there's a human involvement do come in. Without the human involvement, you're not you're gonna be making more mistakes. And that's where these things, like people started generating things faster, and then suddenly realizing, oh, now it started behaving something different because there were certain things that were done in a in a way that the developer didn't pay attention, and now you have to go go back, figure out fix. Then you realize you're spending more time identifying those problems than what it took initially to build that. So knowing the context, having the right strategy, having the right mapping, those things do make a difference.

Why Projects Fail: Clarity And Ownership

SPEAKER_01 10:28

I bet. So it sounds like you've seen a lot in your many years in this space. Uh, you mentioned some of the mistakes. What other big mistakes are health tech companies or startups making when developing their first product? You must see some themes over and over again.

SPEAKER_00 10:45

I think the bigger one is really not clarity, clarity of the requirement. Because if you don't uh if you don't define what you want to build, um you you usually not gonna be um getting the right output. So you have to know initially before starting what is the expected outcome that you're trying to. But majority projects fail because of the unclear requirements. Once the unclear the requirements are not clear, obviously it could be interpreted in many different ways. That's the very common thing. The ownership is another one. Who actually owns it, who actually drives that the direction of those projects? Those are the common mistakes. Yes, it boils down to maybe coming down to oh, the bad design, it could be the bad user experience, it could be a crashing product, it could be uh not able to launch because too many features, uh too complicated. All of those are the specific reasons that will come out of those core things. Once you have the right requirements, right product management, right direction, then these things automatically get fixed.

Designing UX That Truly Serves Users

SPEAKER_01 11:52

Interesting. You mentioned that you you did do a lot of app development, and of course, user interface, user experience is a big part of that. Uh historically, healthcare is, you know, terrible, you know, patient experience, you call it, but really is user experience. I mean, just look over your doctor's shoulder over the years and you'd see what they'd have to go through in various portals and other, you know, interfaces to get things done. And it was it was really tough to watch. I I think the industry seems to be getting better. But uh, you know, how do you approach UX and UI? Um, what's your sort of philosophy there when it comes not just for patients, but for admins and the clinicians and all the people that need to use the software?

SPEAKER_00 12:41

So obviously everybody wants uh a simple, slick experience, but anything that's simple is the hardest. And that's the part. And then there's a balance between what is simple versus what information does that need. Simple doesn't mean you don't have the main information. So there's a balance that needs to be uh I think the more the most important part is really figuring out what you who your users are. Are you building something for senior citizens? Are you building something for kids? Are you building something for patients, what age, what education? So all those things do matter. I share one of the examples uh that if I mean we have seen that we have been to the age of uh the Craigslist, where the Craigslist was very traditional, everybody used it like people were on it all the time. But the horrible interface, but it worked. It worked for that. So it's what the users want really is not always a nicer interface, but what works for them. That's the most important part. You can have a beautiful application, but if it's not really fulfilling the need, it's not giving the experience, it's not gonna be useful. And if you have an amazing experience but it looks horrible, it probably still would work, but it depends on, because then the other will come in in and card. So it's a combination of both. So I think since the iPhone, the Apple, all of these things change. Now people do look for all of those. So having a right experience, building a remarkable app experience does make a difference. And that's one of the things I also talk in my book about this one, because having a nicer interface does bring more attraction to the user. And there will be more adoption for sure, as long as it's doing the core thing what it's supposed to do.

Low Code To HIPAA-Ready Production

SPEAKER_01 14:39

Yeah, you only have to look at Apple Health and the major breakthroughs that they've achieved just through user interface design, accessibility. It's it's been amazing to watch. I heard you just in reference, you reference like lovable and low-code, no code kind of approaches. Do you do you see customers scaling from you know an MVP right to production without having to uh to actually write code? I mean, with things like lovable, or are they more for prototyping and in healthcare or maybe early design? What's they do?

SPEAKER_00 15:18

Um, but not many people are able to do it. That's where, as I was mentioning earlier, probably very small percentage of the people are able to get to that level. Again, that's where you need more um I would say a solution architect type of person who can actually, or a product person who could articulate those things how you want it. Just like when you are doing the right prompting, obviously you can get the results, but then that also means you need to know how you want your code to be generated. So for example, um, as you are generating these applications with lovable, uh Replet and other tools, there's a database structure behind, like whether it's a SOPA-based or whatever you use. So it creates a database structure. For example, let's say our requirement is oh, that the reference table should be in certain formats. The the column name should be like this one, or you need the audit fields, any of those kind of things. Or how do you want your functions to be written so that you can convert it into APIs uh later on? Or so that pattern only the technical people know. So not only that, so but then there's a gap because the product people are the ones who can articulate those things well. Developers are the ones who can tell better. It's a combination of those people who are able to do well. What we have seen mostly is non-technical people are building, entrepreneurs and different people are building, they have ideas. So for me, that seems like more like a replacement of your traditional requirement clarification replacement of the sketches. Rather than having those sketches, now you can articulate the problem through these tubes, and you say, okay, here's my first version that I'm envisioning, but it's bare bone. It has the front end, the back end, the admin, everything in one in a different tab, and you you just now you just were able to elaborate your idea. Okay, this is what I want. Now I want it converted into a real production. And that's where I think that's where the opportunity is. You can create those um uh uh you can take those POCs and convert it into a real production one. It could be enhanced right there. And then and there is a time when you actually take that and convert it, maybe moving into a cursor and using other tools to actually do and deploy. Because um as you keep wipe coding, it will get you a to a certain state. Then some state you have to convert. But do you you don't want to be throwing away what you already built. You want to take that and move it to a production. And where we come in, we also not only convert those into a production ready, but we also make it HIPAA compliant because uh the tools will just give you the flows. But these applications are not by default going to follow the HIPAA regulations in terms of whatever are the HIPAA um steps that you need to follow, whether it's the audit logging, whether it's authentication. A lot of those things. There are certain things, but they are not following the HIPAA regulations. So we take those white-coded tools and convert it into uh HIPAA ready, production ready applications.

Interoperability And MCP Explained

SPEAKER_01 18:30

Brilliant. That sounds like uh a great formula for success. Um, I'm sure you're intimately familiar with integrating with two EHRs and all the various healthcare data standards. Where are we? Are things opening up? Are you are you getting the kind of integrations you need for clients? And are we getting interoperability finally that we've been talking about for years and years?

What’s Next: Workflows, Prediction, Conferences

SPEAKER_00 18:57

I think it really also kind of dependent on the vendors. So there are um a lot of those EMRs, EHRs, and then there are they have an API. So um so that part is already there. People are already building applications, integrating. If not, if those are not providing, those are probably not gonna get the market share because if people can't integrate, nobody's gonna use those. So that problem is not there. I think what AI is bringing is building something on top of that, which is um a concept called MCP, model context protocol. So MCP is like an uh API for AI, just like APIs are your interface to your typical application. So MCP would let you query your database, your application, uh through any AI console, like Cloud Console or ChatGP. So, and then obviously you can also integrate with your application. So if now applications are exposing as MCP so that your application can connect, include the the chatbot uh functionality inside your application. So that's a big, uh I think um a big innovation, and that's a very exciting innovation that people are uh leveraging now.

SPEAKER_01 20:19

Brilliant. Sounds uh like a great opportunity. Uh so what's next? What are you looking forward to over the next weeks and months? I know you're headed to Vive, the big meeting of healthcare IT and practitioners. Uh what are you what are you uh thinking about as you head into Vive and what are you excited about the rest of the year?

SPEAKER_00 20:39

So I yeah, so the thanks. Yeah, so going to Vive, uh there's there are a lot of opportunities in the healthcare space, there are a lot of things happening. I think what the opportunities where we are seeing is uh a lot of people are talking about the clinical workflow implementation. So a lot like that's the one of the most um demanding at this time, uh, as well as building applications that has more predictability. So we are building uh different applications where loading the personal health data, doing using AI for deep research, prediction of medicine, and other things. Obviously, the recommendations has its own, there are caveats in terms of what could be shared and what's not. That's the legal part. But um but those types of applications are in more demand nowadays. So we're we're creating those different applications. We're excited about all of those opportunities, and I'm sure they'll increase more and more. So our goal is to go to YF HIMS and other conferences, talk about what we are working on, um, whether it's uh workflow implementation with AI agents or these uh wide coding to HIPAA compliant applications.

Closing And Listener Resources

SPEAKER_01 21:55

Brilliant. Well, have a great show. Thanks for uh giving us your insight and opinion. Your unfiltered experience, really helpful and uh appreciate, you know, let's keep keeping touch on social. Absolutely. Thanks for having me, Alan. Thanks for being here. Thanks everyone for listening and sharing. Also, check out our TV show, Techimpact.tv on Bloomberg Television and Fox Business. Thanks, everyone. Thanks, Kenford. Thank you. What do you think?