Choosing custom healthcare software companies

Healthcare software conversations collapse three jobs into one sentence. Operations is the day list, the booking, the reminder, and the instruction about what to bring. The clinical record is the notes, diagnoses, medicines, and images a clinician is prepared to rely on. A medical device, in several countries, is software intended to diagnose, monitor, or drive a treatment decision, and it is regulated as a product of its own. A company that cannot say which job the proposal covers will price a booking list like a records system.

Most clinics do not need all three. They need the front desk and the clinician to share one list, and they need the clinical system they already trust to stay the clinical system. Sunbeam's pages for clinics, dental practices, and medical practices describe that operational layer. This guide is about how to judge a company before you commission it. The useful first question is which of the three they are proposing, and which they are refusing.

Ask the company to repeat the day, not the brief. Who answers the phone, where a walk-in is written down, what the patient was told to bring, which list the clinician looks at. A proposal that could be sent to another specialty by changing the logo is a template. Ask what they will not build first. A serious answer sounds like: we will not store a diagnosis in the day list, we will not send clinical advice, and we will not replace the record system until someone has shown that the record system is the problem.

Ask where the system will live. The repository, the hosting account, the domain, and the data should be able to sit in the client's name. Ask who can open a patient list, how a leaver loses that access the same day, how long a number is kept, and how you would export the working set. Those answers should be boring, which means the system was designed to be handed over. The note on choosing a software agency is the general form of this test. Healthcare adds the data questions. It does not replace them.

This is an orientation for people commissioning software, not legal advice and not a complete list of every duty a clinic, hospital, insurer, or health company may have. Confirm it with counsel for the states and services involved, and against any notification issued after you read it. India's Digital Personal Data Protection Act, 2023 is the general law for digital personal data. A name, number, appointment, or report identifies a person, so it is personal data even in a booking tool. The Act does not create a separate health-data chapter the way some foreign laws do.

The DPDP Rules, 2025 were notified on 13 November 2025. As the guide to the DPDP Act explains, the main day-to-day duties of organisations commence about eighteen months later, in May 2027. That gap is not permission to collect whatever is convenient until then. Older duties under the Information Technology Act framework, including rules that treat medical records and health conditions as sensitive, have not been paused until counsel tells you otherwise. Do not assume every health database must be hosted in India. Some contracts and state systems require it. The Act allows the government to restrict certain transfers. That is not the same as a current universal hosting order. A draft health-data law that was never passed is not a current obligation.

The Clinical Establishments Act, 2010 is not in force in every state. Where a state has its own rules, registration and minimum records are the establishment's duty. Software can hold a register the desk uses. It does not register the clinic. Telemedicine Practice Guidelines, issued on 25 March 2020, bind registered medical practitioners: identification, consent, when a remote consult is appropriate, what may be prescribed, and the record kept. A product can make that record easy to create. It cannot decide that a consult was appropriate, and a generated note is not a diagnosis.

Ayushman Bharat Digital Mission is the national arrangement for health identifiers and consent-based exchange. A private clinic's appointment book does not automatically have to run on that network. Exchanging records through it is a separate integration, with the facility's own registration and the specifications current at the time. Some software is regulated as a medical device under the Medical Devices Rules, 2017, when it is intended for a medical purpose such as diagnosis, prevention, monitoring, or treatment. A scheduling list is usually outside that. Software that claims to diagnose, or that drives a clinical decision, may be inside it, and the class determines the licence. Classification is a regulatory judgment. Sunbeam does not register medical devices, and we will not write 'not a device' into a proposal as if that were a ruling.

In the United States, HIPAA applies to covered entities — health plans, clearinghouses, and providers who conduct certain electronic transactions — and to business associates who handle protected health information for them. A clinic can be a covered entity. A company that stores or transmits that information for the clinic is often a business associate. That is a contract and a safeguard question. There is no government certificate that makes a product 'HIPAA compliant'. An agreement with a cloud host covers the host's in-scope services. It does not make the application or the clinic's process compliant. Some consumer health apps sit outside HIPAA and still have other privacy duties. Counsel decides which regime applies. We implement the access control, the audit trail, and the breach path they specify.

In the EU and the UK, health data is special-category data. Counsel has to identify a condition for it, not only a basis for ordinary personal data. Explicit consent is one condition. Care under a professional duty of confidence is another. Transfers out of the UK or the EEA need a lawful mechanism. A product used in more than one country has to name which regime applies to which users. Ask which of these questions a vendor will hand back to your advisers.

The United Arab Emirates has a federal personal-data law, and health data is generally treated as sensitive under it. Dubai and Abu Dhabi also publish their own expectations for facilities and health information, and they are not interchangeable. The emirate and the facility licence decide which set you are in. A vendor who quotes one Gulf-wide standard is smoothing over the question you needed answered.

Saudi Arabia has a personal-data law under which health data is sensitive, plus health-sector and cybersecurity expectations that depend on the organisation and the system. Copying a US design and calling it ready is not a method. The practical step is the same as in India: write down what is stored, who can open it, where it runs, and which adviser has accepted the legal conclusion. Sunbeam works with clients in Saudi Arabia, the United Arab Emirates, the United Kingdom, and the United States from Lucknow. Where a client has counsel, we would rather receive a written requirement than invent one.

We start from the day the desk can describe: the booking path, the reminder, the shared list, and the instruction that is currently repeated on the phone. Clinical judgment stays with the clinician. If a record system already does the clinical job, we leave it there and connect only where a sensible interface exists. Custom software is for the record the products will not hold. A website answers the questions that block a booking. Automation is the reminder that depends on memory. Cloud infrastructure is where the system runs, including a region constraint the advisers have actually stated.

Before anything patient-related is stored, we want five decisions in writing, made with the client's advisers: the purpose of the record, who may open it, how long it is kept, where it may be hosted, and who is told if it is exposed. We design the software so those decisions are enforceable. We do not certify them, and we do not describe Sunbeam as HIPAA-certified, GDPR-certified, or device-registered. Several of those badges do not exist. The code and the cloud account stay in the client's name unless a written agreement says otherwise. Talk with Sunny with the workflow and any constraint counsel has already set.

The first version should remove one contradiction: the same afternoon living in the diary, the inbox, and a notebook. A single list, with arrived, waiting, and done, plus the note about reports or fasting on the booking, is a complete first release for many practices. Recall and reminders come next, on a channel the clinic can operate and can stop. Patient portal, billing, a full record, a remote-consult suite, and a national exchange are separate projects. Doing them in one breath produces a login nobody adopts and a data store whose purpose nobody decided.

Two proposals that do not say whether a diagnosis is in scope, where the data may run, and what happens to the existing clinical system cannot be compared on the fee. Ask for the exclusion list. The DPDP guide covers the Indian privacy timetable. It is not advice on your facts.