“We need HIPAA-aware architecture and don't know where to start”

The auth, audit and encryption layer is most of the real work in a compliance-sensitive build, and it is shared by every part of the product. Built once and correctly, each additional module is cheap. Built fast to hit a deadline, the exposure is in the foundation.

What that means concretely: permissions enforced at the data-access layer so no view can forget them, with a written authorisation matrix as the spec. An append-only audit log recording actor, action, object, timestamp and IP, never deletable from the application. TLS in transit and AES-256 at rest. E-signatures captured with a hash of the exact document version signed, so you can prove later what was signed and not merely that something was.

Infrastructure goes in your cloud account, under your control, with the BAA signed by you. I build against synthetic data and migrate real records only at cutover.