Healthcare start-up · case study

When growth raised the bar, with enterprise security reviews and a stack against its end-of-life clock, the fix was hardening, not a rewrite: the same live platform taken from zero automated tests to 95%+ coverage on its core logic and brought to a security-review-ready posture, modernized while it kept running.

A healthcare start-up’s platform had reached product-market fit on an aging codebase. Then enterprise clients’ security reviews and an end-of-life stack raised the bar. We modernized the live system incrementally, without interrupting operations: MFA and a full audit trail, off that stack onto supported versions, and a regression test suite where there had been none.

regression safety net
0 tests 95%+
coverage on core business logic
A system carrying real clinical load had effectively no automated tests. We brought core business logic and the views that carry it to 95%+ coverage each: the regression safety net a platform handling medical data needs before anyone changes it under pressure.
Overall repository coverage is 82%; the files carrying business logic and views are each at 95%+, up from a baseline of zero. Figures as measured by us; not yet confirmed under the standardized definitions of our current proof loop.
the bar that triggered the work
failed cleared
vendor security review
Now clears the enterprise security reviews it couldn’t before: MFA, 30-day credential rotation, and a full audit trail.
Hardened to clear enterprise vendor security due diligence; passing reflects the controls implemented, not an independent audit.
delivered without stopping the business
100s GB / month
of medical data, served without interruption
The modernization ran incrementally on the live platform, never a clean-slate rewrite, while it kept serving thousands of inquiries and hundreds of gigabytes of medical data a month. Operations never stopped.
Monthly scale figures are reported by the client, not measured by us; the no-interruption delivery is our practice claim.

A healthcare start-up’s platform had reached product-market fit, and growth had moved the goalposts. Enterprise clients now ran vendor security reviews the platform couldn’t yet pass, and its stack was approaching end-of-life. We modernized it without ever stopping the business: from zero automated tests to 95%+ coverage on the code that runs it, onto a supported stack, with MFA and a full audit trail. We name the metrics, not the client.

The Situation

Our client is a healthcare start-up whose web application runs the operation: it processes sensitive medical data, with operational automation, system-to-system integrations, and two-factor authentication on access. We had built the original platform, and it worked: it carried the product all the way to product-market fit, handling thousands of inquiries and hundreds of gigabytes of medical data a month.

Then growth changed what it had to be. Winning and keeping enterprise clients meant clearing their vendor security due diligence, and the earlier posture wasn’t built for that scrutiny. The stack itself was nearing its end-of-life cutoff, a hard support deadline rather than a preference, with security and maintenance debt compounding behind it. Access controls sat below what a platform handling medical data needs to clear such a review. And underneath all of it, a system carrying real clinical load had effectively no automated tests, on a codebase shaped to reach a market, not to be built on. We were brought back to modernize the live platform against that deadline, without stopping operations.

What We Did

The constraint set the method: modernize incrementally while the platform kept running, never a clean-slate rewrite.

The hard part of a job like this is the ramp-up: re-learning a codebase a couple of years old, built for speed rather than for the next team, before a single change can be made safely. AI-augmented delivery is what made that painless. It accelerated reading and mapping the existing system, drafting the test suite that had never been written, and working through the dependency upgrades, keeping the catch-up economical against a fixed deadline instead of letting it become the bottleneck.

We hardened the platform for the security reviews: multi-factor authentication, password rotation enforced every 30 days, and a full audit trail across the system, the access-control and traceability evidence a vendor security review asks for on medical data. We took the platform off its end-of-life stack, upgrading everything to supported long-term-support versions and dropping unused components, which cleared the deadline and shrank the maintenance and security surface at once. We built the regression safety net that wasn’t there, bringing core business logic and its views to 95%+ coverage each, from none. We Dockerized the environment and set up automated CI/CD, turning releases into a repeatable path. And we exposed a clean reporting API for the enterprise systems to consume results, leaving the platform more open than we found it.

What Moved

Underneath, the test numbers: 82% coverage across the repository and 95%+ on the business logic and views, from a starting point of none. The security posture is what the enterprise vendor reviews were asking for: MFA, 30-day credential rotation, and a full audit trail. The end-of-life deadline is cleared, the platform now on supported versions with dead components removed, and releases run through Docker and automated CI/CD. The scale figures, thousands of inquiries and hundreds of gigabytes a month, are reported by the client, not measured by us; that the modernization landed without interrupting any of it is the part we deliver.

Where It Went

None of it was a rewrite. The platform that won product-market fit is the same one now cleared for enterprise scrutiny: hardened in place, against the deadline, while it kept running.

your system next

If This Sounds Like Your Codebase, start with a call.

A short discovery call scopes the next step, for a system like this one, usually the fixed-price audit: a diagnosis of the code you actually have, from $5K, report in hand before you commit to anything further.

newsletter

Notes on Building High-Quality Software

A short founder’s note and a digest of what we’ve published, sent only when there’s something worth the inbox.

No sequence · Unsubscribe in one click