Bee Busy Inc. is a Houston non-profit that provides free HIV and STI testing, education and support to the communities that need it most. We first worked with them in 2024 on their public website, which gave the clinic online scheduling, digital intake forms and an appointment manager. That project did its job, and it also exposed the next problem: once someone had been tested, there was still no secure, private way to get their results back to them.
Lab reports arrived as PDFs. Staff tracked who was still waiting on a spreadsheet, called each person by hand, and fielded the same "are my results in yet?" phone calls all day. The intake form on the website collected sensitive information on a platform that was never designed for protected health information. Bee Busy asked us for a fix, and the answer was a purpose-built, HIPAA-compliant patient portal.
What we set out to build. The original statement of work was focused: a portal where clients sign in and see their results, a staff dashboard, a pipeline that reads incoming lab PDFs and files each result against the right client, a notification engine, audit logging, and the monthly and quarterly compliance reports the clinic owes the City of Houston. Six weeks, four phases.
What we actually delivered. As the clinic's team started using early builds, it became clear the portal could replace far more than a spreadsheet. Working directly with staff over a series of review sessions, we kept extending the scope until the portal ran the whole client journey:
Public booking and intake in English and Spanish. Clients pick a time, answer a few questions, give consent, and receive a confirmation with a calendar invite and a private link to reschedule. A 52-question health questionnaire can be finished on the spot or later through a secure emailed link, and it ends with an e-signature.
A clinical console for staff. Every client has one record: contact details, demographics, appointments, results, documents and correspondence. Counselors document a visit through a nine-step form that mirrors the Texas DSHS testing form, sign it on a tablet, and the portal renders the state's exact PDF. Treatment and follow-up visits got the same care, medication logs and dual signatures included.
Lab results that file themselves. Reports dropped into the clinic's shared folder are read, matched to the right client and added to their panel. Negative panels are released and the client is notified automatically. Anything positive or uncertain is held until a clinician has spoken to the client and attested to it in the portal.
A scheduling engine of its own. Working hours, closures, services and slot capacity are managed in the console. Reminders, no-show follow-ups and re-test notices send themselves.
Reports on demand. The monthly internal report and the quarterly City of Houston report export to Excel and PDF from a date range.
Compliance is built in, not bolted on. Every page that shows protected health information is rendered on the server, so nothing sensitive ever ships in a browser bundle. Documents live in private storage and open only through short-lived signed links. Staff sign in with the clinic's own Microsoft accounts, so the portal issues no passwords of its own. Every action is written to an append-only audit log that can be searched by person, session or date. Notifications never mention a test, a result or a clinic name. The whole system runs on Microsoft Azure under a Business Associate Agreement, with encryption at rest and in transit and keys held in Key Vault.
Tested like it matters. Behind the portal sit more than 1,000 unit tests and an automated browser suite of nearly 200 end-to-end scenarios that book appointments, ingest real-format lab PDFs, walk the visit form, sign documents and actively try to break the access rules. The screenshots on this page were captured by that suite against synthetic data. No real client information appears anywhere.
The result is a portal built to run the clinic's entire client journey in one covered system, and to retire the website forms that were never meant to hold health data. If your organisation handles sensitive information and needs software built to a standard, talk to us.
