HIPAA-Compliant Prescription E-Commerce Site

I am building an MVP for a telehealth platform similar to HenryMeds / StartWillow.
The platform will allow users to:

Complete an online eligibility quiz

Fill out a secure multi-step medical intake form (PHI involved)

Select a treatment plan

Pay via Stripe

Have their information transmitted securely to a medical provider through an API

Receive status updates via webhooks

The system must be built with HIPAA-compliant engineering practices, including secure handling of PHI, encrypted database storage, and strict logging rules.

You will develop the complete frontend, backend, database, and integrations based on our technical specifications.

What Needs to Be Built
1. Frontend (React / Next.js)

Responsive landing page

Multi-step quiz

Multi-step medical intake form with validations

Plan/pricing selection + Stripe checkout

Confirmation page

“Check My Status” page

Strong attention to UI/UX and privacy-friendly flows

2. Backend (Node.js / Express or Next.js API Routes)

Backend responsibilities:

Handle PHI securely (HIPAA-minded architecture)

Create/update patient records

Save medical intake into secure database

Create Stripe Checkout session

Process Stripe webhook for successful payment

Call an external medical provider API to initiate evaluation

Receive and process webhook events from medical provider

Update evaluation/exam status in database

Expose secure endpoint for status page

Implement robust error handling (NO PHI in logs)

3. Database (PostgreSQL)

Database requirements:

Tables: patients, intakes, payments, evaluations, webhook logs

Encrypt PHI at rest (recommended: pgcrypto or external KMS)

Enforce field-level access control via backend

No plaintext PHI anywhere outside DB

4. Third-Party Integrations
Stripe

Checkout session creation

Webhooks for payment success and invoice events

External Medical Provider API

(Detailed documentation shared after hire)

Create evaluation requests

Transmit patient + intake data securely

Store returned IDs & statuses

Process webhook updates for evaluation outcomes

5. HIPAA & Security Requirements (Critical)

You must follow HIPAA-aligned engineering practices:

HTTPS only

No PHI in logs, errors, analytics, or console output

PHI encrypted at rest in PostgreSQL

Environment variables for all secrets/tokens

Secure webhook implementation with signature verification

RBAC or tokenized access for patient status endpoints

Least-privilege principle for backend services

Secure deployment architecture (guidance provided if needed)

You do not need to sign a BAA for development, but your coding practices must be HIPAA-oriented.

Deliverables

Fully functional, staged MVP environment

Clean, well-documented GitHub repository

API documentation for internal routes

Database schema & migrations

Working Stripe test mode integration

Working webhook integration (medical provider + Stripe)

Deployment support (Vercel + secure DB, or your recommended architecture)

Skills Required

React / Next.js

Node.js / Express (or Next.js API routes)

PostgreSQL (schema design + PHI storage)

Stripe Checkout + Webhooks

External API integrations

Secure backend development

Experience with HIPAA or healthcare apps is highly preferred