HIPAA-compliant clinical-research EHR built from idea to production for a French pharma
An EHR for clinical trials at a French pharmaceutical company: patient data, dosage charts and billing, built with HIPAA safeguards on Java and MongoDB.
- safeguards built in: unique user IDs, emergency access, automatic logoff, encryption
- HIPAA
- plan, specification and delivery by one Erbis team of four
- Idea to production
- spent by trial teams searching for patient and dosage data
- Less time
Context
Erbis implemented an EHR system for a France-based pharmaceutical company that runs clinical research. Below are the details of the process that led to the final result.
Challenge
Despite recent progress in medicine, the nature of some diseases is still not fully understood, and healthcare relies on technology to study their causes and develop treatments.
Our client, a large pharmaceutical company in France, asked us to build software for collecting, aggregating and analysing clinical data. The project came to us at the idea stage, so we had to produce the development plan and the specification and then deliver the functionality to the agreed deadlines.
Pre-development
We started with data collection: client interviews and research into the pharmaceutical technology market. Our business analyst identified the product goals and the benefits it would bring users, and turned them into a product concept.
The agreed concept was an EHR system that aggregates clinical research results. It would help doctors running clinical trials record information on the patients taking part. Our analyst held several meetings with doctors to understand the required functionality, and once the details were agreed, created the project roadmap.
Solution
We appointed a team of four: Front-end Developer, Back-end Developer, QA Engineer and UI/UX Designer. They worked in Scrum, reporting every few weeks. Our business analyst, who also acted as project manager, kept the client informed of progress.
The back end was written in Java, the front end in jQuery, and MongoDB was chosen as the database.
We built the EHR to HIPAA requirements, which means the system has:
- Unique user identification
- Emergency access procedures
- Automatic logoff
- Encryption and decryption
A secure development lifecycle minimized potential security gaps and produced a reliable system that can be trusted with sensitive data.
End product
The EHR system lets doctors collect information for clinical research quickly and conveniently. The data includes patient data, dosage charts and billing data.
The application has an advanced commenting system and data export capabilities. It uses object-relational mapping and a querying framework built on EclipseLink JPA.
Architecture and tech stack
A Java EE 7 back end persists clinical records to MongoDB through EclipseLink JPA, with the HIPAA safeguards (identification, emergency access, automatic logoff, encryption) implemented in the application layer. Doctors work in a jQuery-based web front end.
- Java EE 7
- EclipseLink JPA
- MongoDB
- jQuery
Results
The EHR system was built first of all for scientific purposes. It helped doctors manage data effectively and prepare the information needed for critical clinical research.
It also reduced the company’s costs. Employees spend much less time searching for information and have quick access to data they can use immediately for mission-critical study and analysis.
What made it work
Erbis’s takeaways from this engagement:
- Interview the end users, not only the sponsor. Sessions with trial doctors defined the functionality that made the system usable in practice.
- Build compliance into the specification. HIPAA safeguards were requirements from the first roadmap, not a certification exercise at the end.
- One analyst as product owner and project manager. On a four-person team, a single point of accountability for scope and progress kept the idea-stage project on schedule.