Choosing a telehealth software development company is a vetting problem, and most buyers vet the wrong things. They compare portfolios and hourly rates, sign with the cheapest team that has a clinic screenshot, and discover in month four that the vendor has never routed an e-prescription or gated a visit to a patient’s state. The five things worth scoring a shortlist on are specific: a video stack that signs a business associate agreement (BAA), e-prescribing through Surescripts, bidirectional EHR integration, state-licensure logic, and honest scoping of the HIPAA work wrapping all of it. Rate comes last. It’s the tiebreaker, not the filter.
We’re gmware, a custom software development firm in Austin, TX with engineering centers in Bangalore and Mohali, India, and healthcare builds are part of our delivery history. This isn’t a “how to build a telehealth app” walkthrough; we keep a separate telemedicine software development guide for the build mechanics. This is the interview: the questions to put to any telehealth dev shop before you sign, and what a good answer sounds like.
One opinion up front, and we’ll defend it. The best signal in a vendor call isn’t the demo. It’s whether they bring up the BAA and the state-licensure rule before you do. A team that waits for you to ask has never shipped a clinical product, and you don’t want to be their first.
Score the vendor on six things
What separates a telehealth developer from a general dev shop
A general software team can build a booking form. The gap opens the moment protected health information starts moving. Watch the first meeting for one tell: does the vendor raise the BAA and audit logging before you do, or do they say “WebRTC is encrypted, so you’re compliant”?
That second sentence is the fail. WebRTC enforces mandatory encryption on every media channel, with IETF RFC 8827 mandating DTLS-SRTP as the only permitted mechanism, and browsers reject any attempt to bypass it. The call is encrypted. Good. That covers maybe a tenth of what a compliance auditor asks about. The rest is signed BAAs with every vendor that touches patient data, audit logs of every chart access, role-based permissions, and encryption of the records at rest. None of it ships with the video API. All of it is application work, and a vendor who conflates the two will bill you to learn the difference.
Here’s a scene we’ve watched play out. A clinic hires a generalist on price, the demo works, patients book, providers video-visit. Then the first pharmacy call comes: a provider wants to prescribe, and nobody scoped e-prescribing. Then a patient logs in from a state the physician isn’t licensed in, and nobody built the licensure gate. Each gap is a change order. The cheap team stopped being cheap somewhere around the third one.
How to vet a telehealth software development company
Don’t ask for a portfolio. Ask for a walkthrough. Put the five build decisions to each shortlisted vendor and make them talk through how they’d handle yours. The scorecard below is the one we’d hand a buyer running that process.
| What to ask | Weak answer (walk away) | Strong answer (real partner) |
|---|---|---|
| How do you handle the video layer? | ”We’ll build WebRTC ourselves” (without asking about volume) | “Managed API that signs a BAA unless video is your differentiator, then we revisit” |
| Who signs the BAA? | ”The video is encrypted, you’re fine" | "Every vendor touching PHI signs one; we track them as a deliverable” |
| How does e-prescribing work? | ”We’ll add a prescription screen" | "It routes through Surescripts; controlled substances need Ryan Haight logic” |
| How do you integrate the EHR? | ”We’ll export a CSV" | "Bidirectional over the FHIR API certified systems expose; write-back is the hard part” |
| How do you handle multi-state care? | ”The provider just logs in" | "We gate the visit to the state the patient is in, because that’s where care is rendered” |
| Where does the HIPAA work live? | ”At the end, before launch" | "Sprint one; retrofitting audit logging costs more than designing it in” |
The six questions, in order
What video-stack answer should a telehealth vendor give
The video is the piece most buyers overweight and most vendors get evaluated on, so it’s worth knowing the right answer before the call. There are two real paths: a managed video API that signs a BAA, or self-hosted WebRTC where you own the compliance. A vendor should recommend managed by default and only push self-hosting when video volume and in-house WebRTC expertise justify it.
Here’s the current BAA landscape across the common video vendors, so you can tell whether a shop actually knows the field:
| Video option | HIPAA / BAA posture | When a vendor should pick it |
|---|---|---|
| Daily | $500/month Healthcare add-on, HIPAA + BAA | Predictable fixed cost, fast start, no infra |
| Zoom (healthcare licensing) | BAA signed on qualifying paid plans; small practices can accept online | Patients already know the Zoom experience |
| Twilio Video | HIPAA-eligible via BAA; the product stays standalone after the reversed end-of-life | Already in the Twilio ecosystem |
| Self-hosted (LiveKit, OpenVidu) | You own every byte of compliance and infra | High volume, real WebRTC staff, data-control needs |
Who signs a BAA, and how
There’s a lesson in the Twilio line worth pressing a vendor on. Twilio announced an end-of-life for Programmable Video, then reversed it in October 2024, and the product remains standalone with existing customers needing no action. It worked out. But for the months in between, teams that had wired their app tightly to one video vendor were pricing a migration they didn’t choose. Ask a shortlisted vendor how they’d insulate you from that. The right answer is that they wrap the video vendor behind their own interface, so swapping it is a contained job. If they’ve never thought about it, note that.
Does the vendor understand e-prescribing and EHR integration
This is where generalists get exposed, because these two integrations are invisible in a demo and enormous in a build.
E-prescribing isn’t a screen. It’s a connection to Surescripts, the nation’s largest e-prescribing network, which carried 2.64 billion e-prescriptions in 2025 and reaches virtually every US pharmacy. A prescription leaves the provider, routes through that network, and lands at the patient’s pharmacy. A vendor who says “we’ll add a prescription field” hasn’t done it. Controlled substances add a whole layer on top: a DEA and HHS extension lets registered practitioners prescribe controlled substances via telemedicine without a prior in-person visit through December 31, 2026, but the underlying Ryan Haight Act generally requires at least one in-person evaluation first. The permanent rule isn’t settled. A good vendor builds the in-person-visit requirement as a configurable toggle, because hardcoding today’s flexibility means surgery the day the rule changes.
EHR integration is the other quiet giant. The good news is the plumbing is standardized: certified health IT has to expose a FHIR API built on the US Core profiles, so patient data can be read over a consistent RESTful interface. Reading from the chart is the easy direction. Writing back, dropping a visit note or an updated med list into the record, is where the work concentrates, and it’s the thing a generalist underestimates. When a vendor says “we’ll integrate the EHR,” the follow-up question is: read-only, or bidirectional? The gap between those two answers is most of the integration budget. We break the numbers down in our EHR integration cost guide, and the broader clinical-build math is in our medical app development walkthrough.
What about state licensure and where care happens
Here’s the rule that trips up teams who’ve only built consumer software: in telehealth, a visit is generally considered to happen where the patient is physically located, so the provider needs to be licensed in that state. A physician licensed in Texas can’t just video-visit a patient who’s sitting in Ohio. The software has to know where the patient is and whether the provider can legally see them there.
That’s product logic, not a legal footnote. A real telehealth platform captures the patient’s state at booking, checks it against the provider’s licenses, and blocks or reroutes the visit when they don’t match. The Interstate Medical Licensure Compact exists to make multi-state licensure faster, but it speeds up getting the licenses; it doesn’t remove the requirement, and physicians still hold each state license individually. So the matching logic stays in your build either way. Ask a vendor how they’d handle a provider who’s licensed in six states and a patient who just moved. If the answer is “the provider logs in and starts the call,” they’ve never shipped multi-state care.
Should you hire a generalist or a healthcare specialist
Now the honest fork, because sometimes the specialist is overkill.
Hire a general software company when the surface is thin and no PHI lives on your systems: a public appointment-request widget, a clinic marketing site, an internal scheduling tool that never touches a chart. Paying a specialist premium for a booking form is spending money to feel safe. A competent generalist ships that faster and cheaper, and you lose nothing.
Hire a healthcare specialist the moment the build stores protected health information or does any of the five things above. Video visits, e-prescribing, EHR write-back, and state-licensure logic are most of the engineering in a clinical product, and a generalist learning them on your timeline is the most expensive way to buy that knowledge. The tell isn’t a fancier pitch deck. It’s that a specialist raises the BAA, the licensure rule, and the read-versus-write EHR question before you do, because they’ve been burned into raising them.
Generalist or specialist
US, offshore, or blended for a telehealth build
Geography doesn’t change the compliance bar, so don’t let a vendor tell you offshore is riskier by default. HIPAA governs how the software handles protected data, not where the engineer sits. Encryption is encryption whether it’s written in Austin or Bangalore, and audit logging doesn’t know its time zone.
What a blended model buys you is oversight where you can see it: US-based leads owning discovery, the data-flow map, the video-stack decision, and the BAA paperwork on US hours, with engineering running at offshore economics. The honest caveat is that the arrangement only works if the controls are genuinely in the build and the contracts genuinely sit under US law. A cheap team treating HIPAA as documentation theater costs more than it saves the first time an auditor asks for access logs. That’s the structure we’d tell you to demand from anyone you shortlist, us included. Our dedicated-team and staff-augmentation model is built exactly this way, with senior US oversight on the decisions that carry compliance weight.
How gmware approaches telehealth builds
We run telehealth work as fixed-scope engagements out of our healthcare software development practice. Austin-based leads own the discovery, the data-flow map, the video-vendor call, the licensure logic, and the BAA paperwork on US hours; our Bangalore and Mohali teams build. Compliance gets designed into the first sprint, e-prescribing and EHR write-back get scoped as the real work they are, and we wrap the video vendor behind our own interface so a roadmap surprise stays a contained swap.
We run production data systems ourselves. Shield Suite, our retail-intelligence platform, ingests data across more than 60,000 beverage-alcohol storefronts, so the parts of this post about access control, audit logging, and storage aren’t theory we read in a guide. They’re the work we do.
And we’ll tell you when not to hire us. If a certified white-label telehealth platform does what a single clinic needs, license it; a custom build is a means, not a trophy. If you’re only building a booking widget with no PHI on it, a generalist will ship it cheaper and we’ll say so. And if you’re still testing whether patients will book at all, prove that with the cheapest thing that works before anyone spends six figures on a platform.
Tell us what you’re building, which EHRs you need to talk to, and where your providers are licensed. Reach out and we’ll come back within 48 hours with a straight read on the video-stack call, the integration work, the licensure logic, and the compliance scope, day rate included.