Orbital Health: scaling from 200 to 1.2M patients in 12 months

The challenge

Orbital Health had a problem every healthtech founder wants: too much demand, not enough engineering. They had a working prototype with 200 pilot patients and one health system partner. They needed to scale to 8 health systems and hundreds of thousands of patients in 12 months.

The constraints:

• HIPAA compliance (non-negotiable for healthcare data)
• EHR integration (each health system has different EHRs: Epic, Cerner, Athena)
• 99.9%+ uptime (clinical workflows can’t go down)
• Multi-tenant architecture (each health system sees only their patients)
• Audit logging (every PHI access tracked)
• Patient consent management (granular, revocable)

Their existing codebase was a monolithic Rails app with hardcoded Epic integration. Scaling it would mean rewriting everything. They needed a new architecture.

What we built

Multi-tenant architecture

Built a multi-tenant SaaS architecture on AWS:

• Shared database, row-level isolation (cheaper than per-tenant DBs at this scale)
• Tenant-aware queries (every query automatically filtered by tenant_id)
• Tenant-specific branding (each health system gets their own colors, logo, copy)
• Tenant onboarding flow (new health system live in under 1 week)

EHR integration via FHIR

Used FHIR R4 (modern healthcare API standard) for EHR integration:

• Epic (3 of 8 health systems): FHIR R4 + custom SMART-on-FHIR OAuth flow
• Cerner (2 of 8): FHIR R4 + custom mapping layer for legacy data
• Athena (3 of 8): FHIR R4 (well-supported)

Built adapters in a separate service so each EHR integration could be versioned independently. When Epic changes their API, only the Epic adapter changes.

Async patient messaging

Built an async messaging system for patient-provider communication:

• Patients send messages via web or mobile
• Providers respond on their schedule (no real-time requirement)
• All messages encrypted at rest, in transit, with full audit trail
• Push notifications via Twilio + Apple Push Notification Service
• Smart routing: messages to on-call provider for urgent keywords

Real-time notifications

For time-sensitive events (lab results, appointment reminders, care plan changes):

• Real-time push notifications to patient mobile apps
• SMS fallbacks for patients without mobile apps
• Email for non-urgent
• All notification events logged for compliance audit

HIPAA-compliant analytics

Analytics that respect HIPAA:

• No PHI in analytics events (only de-identified data)
• Audit logs for all access to patient data
• Patient consent tracked and respected
• Data retention policies automated
• Right-to-deletion (GDPR + state laws) supported

Results

After 6 months of build + 6 months of customer rollout:

• 1.2M active users in year 1 (from 200 pilot)
• 8 health systems live (from 1)
• 99.97% uptime over 12 months
• under 3s p95 page load at scale
• Zero HIPAA incidents in 18 months
• SOC 2 Type II certified 9 months post-launch

The business impact: Orbital Health closed their Series A at $25M valuation (up from $8M pre-launch), citing the platform’s scalability and compliance posture as key factors.

What we learned

1. Multi-tenant is hard, but worth it. Building it correctly from day 1 saved them from a painful rewrite at 100k users.
2. FHIR is the future of healthcare integration. All major US EHRs support it now. Use it.
3. HIPAA-eligible cloud + careful architecture = compliance wins. We didn’t have to fight AWS for compliance; we used their pre-certified infrastructure.
4. Async is fine for most healthcare workflows. Real-time is rare. Don’t over-engineer.
5. Observability matters more in healthcare. We instrumented every PHI access from day 1. Made audits painless.

What’s next

Orbital Health is now expanding to mental health and chronic care management. We’re helping them build new patient-facing apps and integrate with wearable data (Apple Health, Fitbit, Oura).

Want similar results?

If you’re building healthtech and need HIPAA-compliant architecture that scales, book a free intro call. We’ll discuss your clinical workflow and tell you honestly what we can build.