The Myth That Keeps Healthcare Overpaying
Walk into any medical practice in America and ask the office manager why they haven't switched EHR systems despite paying $400/provider/month for a product that crashes weekly. You'll hear some version of the same answer:
"We have to use [Athenahealth / Epic / eClinicalWorks / Kareo] because it's HIPAA-compliant. We can't just build something custom."
That belief is costing the US healthcare system an estimated $12 billion per year in unnecessary SaaS fees. And it's wrong.
HIPAA compliance is not a property of SaaS vs. custom software. It's a property of how software is built, deployed, and operated. Custom software can meet every HIPAA Security Rule requirement — and in many cases, does so more thoroughly than the shared multi-tenant EHR systems practices currently rely on.
This guide walks through exactly what HIPAA-compliant custom software looks like in 2026, what it costs, and how practices are quietly replacing expensive SaaS EHRs with tailored systems that do more for less.
What HIPAA Actually Requires (Spoiler: Nothing About SaaS)
HIPAA's Security Rule (45 CFR §164.302–318) specifies three types of safeguards covered entities must implement:
Administrative safeguards
- Security officer designation
- Workforce security policies
- Information access management
- Security awareness training
- Contingency planning and breach response
Physical safeguards
- Facility access controls
- Workstation use policies
- Device and media controls
Technical safeguards
- Access control with unique user identification
- Audit controls (logging of PHI access)
- Integrity controls (PHI cannot be improperly altered)
- Person or entity authentication
- Transmission security (encryption in transit)
Nowhere in the Security Rule does it say "must be purchased from a certified SaaS vendor." The rule is technology-neutral. Custom software that implements these safeguards is as compliant as a commercial EHR that implements them.
The 6 Technical Requirements for HIPAA-Compliant Custom Software
Here's the checklist we use for every AltStack healthcare build. Miss any of these, and you have a compliance gap. Hit all six, and you have a system that meets or exceeds the security posture of major SaaS EHRs.
1. Encryption at Rest (AES-256)
Every database, file store, and backup containing PHI must be encrypted with AES-256 at the storage layer. On AWS, this means RDS with encryption enabled, S3 with SSE-KMS, and EBS volumes with default encryption. On Azure, Transparent Data Encryption + customer-managed keys. No exceptions, no plaintext PHI anywhere on disk.
2. Encryption in Transit (TLS 1.3)
All traffic carrying PHI must use TLS 1.3 (or TLS 1.2 with strong cipher suites as a fallback). This includes API calls between your frontend and backend, database connections, integrations with labs/pharmacies, and any webhook payloads. Disable TLS 1.0 and 1.1 entirely — HIPAA auditors flag this.
3. Role-Based Access Control (Least Privilege)
Every user has a specific role. Every role has specific permissions. Nobody sees PHI they don't need for their job function. A receptionist sees appointment scheduling; they don't see clinical notes. A billing specialist sees financial records; they don't see lab results. Enforce at the database layer (row-level security), not just the UI.
4. Audit Logging (Immutable)
Every PHI access, every record modification, every permission change is logged with timestamp, user ID, record ID, and action type. Logs are stored in append-only storage that even system administrators cannot edit. Retain for minimum 6 years per HIPAA requirement.
5. Signed Business Associate Agreements (BAAs)
You need a BAA with every third party that touches PHI:
- Hosting: AWS, Azure, GCP, and Vercel all offer HIPAA-eligible services with BAAs
- Email: Resend, SendGrid, and Postmark offer HIPAA-compliant tiers
- SMS: Twilio has a HIPAA-compliant product
- Payments: Stripe signs BAAs with healthcare customers
- Development partner: If your engineers access real patient data during development (they shouldn't — use synthetic data), they need a BAA too
6. Documented Security Policies
Written policies covering: access provisioning and de-provisioning, incident response procedures, disaster recovery and backup, annual security risk assessment, workforce training schedule. These are the paperwork trails HIPAA auditors want to see. Custom software teams produce these; SaaS vendors give you a link to theirs. Both are equally valid.
Why Custom Is Often More Secure Than SaaS
Here's the uncomfortable truth most healthcare IT consultants won't tell you: shared multi-tenant SaaS is a larger attack surface than isolated custom infrastructure.
The 2023–2025 EHR breach list
- NextGen Healthcare (2023): 1.04M patient records exposed via shared infrastructure
- eClinicalWorks (2024): Data exposed through compromised developer credentials affecting thousands of practices
- Henry Schein (2023): Ransomware attack affecting practice management customers
- Change Healthcare (2024): Massive breach affecting ~190M Americans via shared clearinghouse infrastructure
- Kaiser Permanente (2024): PHI exposed through third-party tracking pixels
The common pattern: shared systems amplify the blast radius of any single breach. When one SaaS EHR is compromised, thousands of practices are affected. When a practice's custom software is compromised, only that practice is affected.
Custom software isn't inherently more secure — but properly-built custom software deployed to isolated infrastructure reduces systemic risk dramatically.
The Cost Math for a Typical Practice
Let's work through a real example: a 15-provider specialty practice currently paying $360/provider/month for Athenahealth.
Current SaaS cost (Year 1–3)
- Base platform: $64,800/year ($360 × 15 × 12)
- Projected annual increase: 11–13% (based on Athenahealth's 2024–2025 renewals)
- Year 2: $72,576
- Year 3: $81,285
- 3-year total: $218,661
Custom HIPAA-compliant build + hosting
- Build cost: $68,000 one-time (7-week timeline: EHR core, scheduling, billing, lab integrations)
- AWS HIPAA-eligible hosting: ~$850/month = $10,200/year
- Optional maintenance plan: $1,500/month = $18,000/year
- Year 1: $96,200 (build + hosting + maintenance)
- Year 2: $28,200 (hosting + maintenance only)
- Year 3: $28,200
- 3-year total: $152,600
Savings
3-year savings: $66,061 (30% lower TCO)
And unlike the SaaS subscription, at the end of Year 3, you own a $68,000 asset — software you can continue running for another 5+ years with just the maintenance cost.
Workflows Custom Software Handles Better Than EHRs
Most SaaS EHRs are designed for generic primary care. Specialty practices, boutique clinics, and multi-location groups often spend years building workarounds for workflows the EHR doesn't support natively. Custom software starts from your actual workflow.
Common examples we've built:
- Psychiatry practices: Structured outcome tracking (PHQ-9, GAD-7) integrated with encounter notes and longitudinal patient charts — typically requires 3 separate tools in most EHR ecosystems
- Physical therapy: Custom ROM (range of motion) tracking with photo documentation and progress visualizations
- Dermatology: High-resolution image management with annotation layers and lesion tracking over time
- Concierge practices: Member-centric scheduling with unlimited visit types, no-show protection, and family plan billing
- Addiction medicine: Treatment plan workflows with required reporting to state databases — painful in SaaS, native in custom
The Practical Path Forward
If your practice is evaluating whether custom software makes sense, here's the 3-step path:
Step 1: Audit your current EHR usage (2 weeks)
Map what features your team actually uses vs. what you pay for. Most practices use 25–40% of their SaaS EHR's feature set. The rest is expensive dead weight.
Step 2: Define your must-have workflows (1 week)
List every workflow touching patient data: scheduling, intake, encounter documentation, e-prescribing, lab orders, billing, patient portal. Rank by daily usage. Top 10 are your MVP.
Step 3: Get a fixed-price custom build quote
A competent HIPAA-aware development partner should be able to quote a fixed price for your top 10 workflows within 5 business days. Compare that quote to 3 years of SaaS fees. Decide based on numbers, not narrative.
Who This Is Not For
Custom software isn't the right call for every practice:
- If you need ONC-certified EHR status for Meaningful Use, MIPS, or ACO reporting, custom builds alone don't get you certification. Hybrid approach: custom software for daily operations + lightweight certified EHR for regulatory reporting.
- If you're a large hospital system with 50+ specialties and thousands of users, the integration and certification complexity may justify commercial EHRs like Epic or Cerner.
- If you plan to sell the practice to a PE rollup in the next 24 months, some acquirers insist on specific EHR platforms. Custom software may complicate the exit.
For everyone else — solo practices to 50-provider groups, specialty clinics, boutique practices, and concierge models — custom HIPAA-compliant software is a real, increasingly chosen option.
The 10-Year View
SaaS EHRs dominated 2010–2025 because custom software was expensive and slow. Neither is true anymore. AI-accelerated development has compressed build timelines to 7–28 days for most healthcare workflows. Open-source HIPAA tooling (encryption, audit logging, FHIR libraries) has matured to production-grade. Cloud BAAs are available from every major hosting provider.
The math has flipped. Within five years, we expect a significant percentage of small-to-mid-size practices to run on custom software, with SaaS EHRs relegated to hospital systems and regulatory-reporting use cases.
The only question is whether your practice leads that shift or follows it.
Considering custom software for your practice? Book a free 30-minute scoping call — we'll audit your current EHR, map your workflows, and give you a fixed-price quote for a HIPAA-compliant custom build.