Autumn Behavioral Health Portal -
3k+ Sessions, HIPAA-Compliant
A US behavioral health provider needed to take therapy sessions online securely and in compliance with HIPAA. Built a Twilio Video telehealth portal with appointment scheduling, patient records and automated SMS reminders. 3,000+ sessions per month at 99% uptime.
The Brief
Autumn Behavioral Health, a US therapy and counselling provider, had been using Zoom for online sessions which isn't HIPAA-compliant and had no integration with their scheduling or patient records. Therapists had to switch between Zoom, a calendar app and their records system constantly.
They needed a custom HIPAA-compliant telehealth portal where patients could book sessions, join secure Twilio Video calls, and therapists could access patient notes all in a single platform. A 14-week build, delivered on time.
"We're using Zoom but it's not HIPAA compliant. Our therapists are juggling three different systems for every session. We need one platform that does everything and it has to meet HIPAA standards."
Project Phases
Selected HIPAA-eligible AWS infrastructure EC2, RDS with encryption at rest, S3 with SSE, CloudTrail for audit logging. Built JWT-based authentication with role separation (Patient / Therapist / Admin). All data encrypted in transit (TLS) and at rest. Business Associate Agreement (BAA) signed with AWS. Patient data isolated by therapist cross-access impossible by design.
Built the scheduling engine therapists set their availability calendars; patients book from available slots. Automatic conflict detection. Sessions can be individual or recurring. Automated SMS reminders via Twilio: 24 hours before and 1 hour before each session. Cancellation and rescheduling with configurable notice period rules. Admin overview of all upcoming sessions across all therapists.
Each session gets a unique, time-limited Twilio Video room. Tokens are generated server-side 15 minutes before the session and expire automatically after the scheduled duration. Virtual waiting room patient joins and sees a "Your therapist will join shortly" screen; the therapist gets a notification the moment the patient enters. Session recording with explicit patient consent, stored in HIPAA-compliant S3.
Built a secure session notes module therapists write and save notes during or after sessions, linked to the patient record. Notes are never accessible to patients. Document upload for intake forms. Full audit log of all access to patient records. Load tested and penetration tested before launch. Staff training sessions conducted. Platform launched with zero patient-visible issues.
Tech Stack
The Results
"Harwinder did an excellent job and had a proactive approach toward a challenging project. His English is great and he's very flexible. Thanks!"