Agency Needed: Custom HIPAA-Compliant Medical Records Intake Platform (Filevine Integration)

We are looking for a development agency (not an individual freelancer) to build a custom, HIPAA-conscious web application that streamlines medical-record retrieval for personal injury law firms. This is a purpose-built intake-to-case-management platform — not a WordPress site, not a form plugin. It is a real software product with a multi-phase roadmap, and the right agency partner will have the opportunity for ongoing maintenance, support, and future phase development after launch. WHAT YOU ARE BUILDING Phase 1 (MVP) is a secure, multi-step intake application that allows law firms to submit medical-record requests online. The application collects firm information, patient details, record requests, and supporting documents through a guided, multi-step form — then securely relays everything (including uploaded files) directly into the firm's Filevine case-management system via the Filevine API. A new Filevine Project is auto-created on each submission, fields are mapped, and documents are uploaded into the correct location — all without manual data entry. Key constraints: • Zero PHI storage — Stateless PHI (Protected Health Information): no patient data is stored on our servers — ever. All PHI is encrypted in transit and relayed directly to Filevine. This is a hard architectural requirement. • DEEP Filevine API integration — The Filevine integration is the core differentiator. On every form submission the app must: authenticate via the Filevine API, create a new Project under the correct project type, map every form field to the corresponding Filevine field, upload attached documents into the Project's Docs section, and handle errors / retries gracefully. https://support.filevine.com/hc/en-us/sections/28543097895835-API • Returning-firm recognition — The system should recognize returning law firms (by email or login) and pre-fill firm-level details to streamline repeat submissions. • Secure intake UX — Multi-step guided form with strong client-side validation, file uploads (PDF, JPEG), a review/confirm step, and a post-submission confirmation screen with request ID + email. • Admin panel — An internal admin dashboard for the business to view, filter, and manage submitted requests (non-PHI metadata only — firm name, timestamps, status, request ID). • Security hardening — End-to-end TLS, Web Application Firewall, secure headers (CSP, HSTS), rate limiting, input sanitization, audit logging, session management, and idle timeout. WHY WE WANT AN AGENCY This project needs a senior full-stack developer at the helm, but also dedicated UI/UX support and independent QA testing. We are looking for a small agency or development shop that can provide: • A senior developer / tech lead who owns architecture, the Filevine integration, and security — this person must be able to make sound technical decisions independently. • Front-end / UI support for the intake flow and admin dashboard — clean, responsive, modern UX. • Independent QA / testing — someone other than the developer who wrote the code. Cross-browser, cross-device, integration testing, and client UAT support. We are not looking for a massive agency. A tight team of 3–5 people who ship quality work is ideal. AI-ASSISTED DEVELOPMENT (IMPORTANT) We want this application built by experienced human developers — not generated entirely by AI. However, we do expect the team to be proficient with AI coding tools like Claude Code, OpenAI Codex, Cursor, Copilot, or equivalent. The goal is to leverage AI to reduce cost and turnaround time while maintaining the quality and security standards a HIPAA-adjacent project demands. What this means in practice: • Use AI for boilerplate, scaffolding, tests, and documentation — speed up the routine work. • Security logic, HIPAA handling, API integrations, and architecture decisions are human-led. AI-generated code in these areas must be reviewed and understood, not blindly shipped. • We will ask your lead developer to walk us through their process for using AI tools effectively and safely. If the answer is "I paste the requirements into ChatGPT and deploy what comes out," that's a pass. REQUIRED TECHNICAL SKILLS Your team should have demonstrable experience with most of the following: Core Stack: • Frontend: React / Next.js (or equivalent modern framework — the app is a custom build, not WordPress) • Backend: Node.js / TypeScript preferred; Python or similar also acceptable for backend services • Database: PostgreSQL or similar relational database (for non-PHI data: firm profiles, request tracking) • API Integration: REST API integration — specifically consuming and posting to external APIs with auth, error handling, and retry logic Security & Compliance: • TLS/SSL, CSP, HSTS, WAF configuration, rate limiting, input sanitization • Secure file handling — encrypted upload relay without server-side persistence • Audit logging and session management • Understanding of HIPAA technical safeguards (you do not need to be a compliance officer, but you must understand stateless PHI architecture and how to build for it) Frontend / UX: • Multi-step form design with client-side validation and error recovery • Responsive design (desktop, tablet, mobile) • File upload handling (drag-and-drop, progress indicators, type/size validation) • Clean, professional UI — this is used by attorneys, paralegals, and case managers DevOps & Infrastructure: • HIPAA-eligible hosting setup (AWS, GCP, Azure, or equivalent with BAA support) • CI/CD, staging/production environments, environment variable management • Monitoring, error alerting, and backup/disaster recovery AI Coding Tools: • Proficiency with Claude Code, OpenAI Codex, Cursor, GitHub Copilot, or equivalent • Demonstrated ability to use AI tools productively while maintaining code quality and security BONUS EXPERIENCE (NOT REQUIRED, BUT A BIG PLUS) • Filevine experience — Previous work with the Filevine API (project creation, field mapping, document upload) • HIPAA / healthcare compliance — Prior projects handling PHI, building for HIPAA compliance, or working in healthcare/legaltech • Legal industry experience — Prior work building intake, onboarding, or workflow applications for law firms or legal operations SCOPE & TIMELINE Phase 1 (MVP) is scoped at approximately 8 weeks and includes: • Secure multi-step intake form with file uploads • Full Filevine API integration (project creation, field mapping, document upload) • Returning-firm recognition • Admin dashboard (non-PHI request management) • Security hardening + pre-launch review • QA and cross-device testing • Google Analytics with intake-funnel tracking • Deployment to production on HIPAA-eligible hosting This is a milestone-based engagement. Payments are tied to deliverables, not hours. We will define milestones together before kicking off. LONG-TERM OPPORTUNITY This is not a one-and-done project. The product has a multi-phase roadmap: • Phase 2 — Client portal with real-time status tracking, notifications, and firm accounts • Phase 3 — AI-powered features: automated medical chronologies, provider discovery, treatment gap detection • Phase 4 — Automation, bulk requests, e-signatures, SLA tracking • Phase 5 — API access, multi-tenant support, enterprise readiness The agency that delivers Phase 1 well will have first opportunity for Phases 2–5 development, plus an ongoing retainer for maintenance, security patching, and support after launch. We are looking for a long-term development partner, not a vendor. TO APPLY — WHAT WE WANT TO SEE • A brief intro to your agency: team size, who would work on this, and their roles. • Portfolio examples of similar work: API integrations, secure/compliance-sensitive apps, or healthcare/legaltech projects. Live links preferred. • Your approach to AI-assisted development — how does your team use AI tools, and where do you draw the line? • A rough timeline and how you'd structure the milestones. • Any relevant Filevine, HIPAA, or legal-industry experience. We are ready to move quickly. If your team has the right experience and can start within 1–2 weeks, we want to hear from you.