Web, Digital & Domains

Healthcare Software Development for Chicago and Illinois Teams

For Chicago hospitals, clinics, behavioral health providers and digital health companies that need custom software built for HIPAA and for the Illinois laws that go further. We have no Chicago office: the engineering team sits in Coimbatore and Chennai, India, and runs your project through early-morning video calls and written updates that are ready when your day starts.

Discuss Your Illinois Project See How We Work Across Time Zones

Software development graphic highlighting secure-by-design, built-to-scale and user-focused applications for healthcare teams

Standards and technologies

HIPAA
Illinois BIPA
Illinois PIPA
740 ILCS 110
HL7 FHIR R4
SMART on FHIR

Challenges

Why Illinois Changes the Specification

HIPAA sets the federal baseline. Illinois layers on statutes with their own consent rules, notice duties and private lawsuits, and they attach to ordinary features: a face-scan check-in, a therapy notes screen, a symptom form on a website.

Healthcare integration graphic linking HIPAA compliance, HL7 data formats, patient data accuracy and secure data exchange

What Illinois Adds to a Healthcare Build

We check every feature list against:

HIPAA, wherever the software creates, receives, stores or sends PHI
The Biometric Information Privacy Act, for face geometry, fingerprints, voiceprints and hand or retina scans
The Personal Information Protection Act, which counts medical and health insurance information as personal information
The Mental Health and Developmental Disabilities Confidentiality Act, for anything about a recipient of those services
The Wellness and Oversight for Psychological Resources Act, if AI comes anywhere near therapy

What Goes Wrong When They Are Missed

A biometric login shipped without a written release, inviting statutory damages per person
Therapy information shared under HIPAA's treatment rules when Illinois wanted a specific written consent
One blanket consent checkbox, which the confidentiality act says is not valid
A chatbot that drifts from scheduling into therapeutic conversation

We write these rules into requirements, data models and test plans from the first sprint of a custom software development project. The engineers doing the work sit in Coimbatore and Chennai, India. We have no Chicago office and do not send staff on site.

Not sure which Illinois laws your features trigger?

Send us the feature list. A solution architect will mark each item against HIPAA and the Illinois statutes and answer within one business day.

Overview

The Illinois Rules, and What Each Means for the Code

Not legal advice: counsel decides how each law applies. We build software that carries out those decisions.

BIPA: Release Before the First Scan

Before collecting a biometric identifier, a private entity must tell the person in writing what is collected, why and for how long, and get a written release. It must publish a retention schedule and destroy the data when the purpose ends or within three years of the last interaction. Damages: $1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages if higher.

BIPA Since August 2024

Public Act 103-0769, effective 2 August 2024, made repeated collection of the same identifier from the same person by the same method a single violation with one recovery, and accepted electronic signatures as a written release. In April 2026 the Seventh Circuit held the change applies to cases pending when it was enacted; that federal ruling does not bind Illinois state courts.

The Health Care Exclusion Is Narrow

BIPA excludes information captured from a patient in a health care setting, and information collected for treatment, payment or operations under HIPAA. In Mosby v. Ingalls Memorial Hospital (2023), the Illinois Supreme Court applied that to nurses' finger scans for medication cabinets, but said it is not a blanket exclusion for health care workers.

PIPA: Health Data and Breach Notice

Medical information, including information given to a website or mobile app, and health insurance information count as personal information. Residents must be told in the most expedient time possible; more than 500 affected triggers Attorney General notice. HIPAA-compliant entities must notify the Attorney General within five business days of notifying HHS. Vendor contracts must require reasonable security.

Mental Health Records Under 740 ILCS 110

Records and communications about mental health or developmental disability services are confidential. A valid consent names the recipient, purpose, information, rights to inspect and revoke, consequences of refusing and a calendar expiry date. Blanket consent is invalid, redisclosure needs specific consent, and anyone aggrieved may sue.

AI and Therapy Since August 2025

The Wellness and Oversight for Psychological Resources Act bars offering therapy in Illinois, including through AI, unless a licensed professional conducts it, and bars licensed professionals from letting AI communicate therapeutically with clients or detect emotions or mental states. AI note-taking on recorded sessions needs written notice and consent. Penalties reach $10,000 per violation.

HIPAA itself may change: HHS proposed a major Security Rule revision in January 2025, and as of 1 November 2026 it is still a proposal, listed on the federal regulatory agenda as a long-term action.

BEHAVIORAL HEALTH RECORDSHIPAA Privacy Rule vs Illinois MHDDCA (740 ILCS 110)
Aspect	HIPAA Privacy Rule	Illinois MHDDCA (740 ILCS 110)
Sharing for treatment	Permitted without the patient's authorization	Written consent needed unless the Act itself allows the disclosure
Consent or authorization form	Core elements include a description of the information, the recipient and an expiry date or event	Must name recipient, purpose and information, state inspection and revocation rights and refusal consequences, and give a calendar expiry date
Blanket consent	Authorization must describe the information specifically	Expressly invalid
Redisclosure	Form must warn that redisclosed information may lose HIPAA protection	Barred unless the person specifically consents to it
Therapist notes	Psychotherapy notes generally need their own authorization	Personal notes kept in the therapist's sole possession are not part of the record
Enforcement	Civil money penalties imposed by HHS	Private lawsuits for damages or injunctions; knowing and willful violations are a Class A misdemeanor

HIPAA does not override state privacy law that is more stringent than the Privacy Rule (45 CFR 160.203(b)). For a behavioral health product used in Illinois, the consent screen, release log and sharing rules follow the confidentiality act, with HIPAA met alongside.

Services

What We Build for Illinois Healthcare Organizations

Patient and Clinician Applications

Web and mobile applications for intake, scheduling, care coordination and clinical workflows, with role-based access and audit logging specified before the first screen is drawn.

EHR Connectivity

HL7 v2 interfaces in Mirth Connect and FHIR R4 APIs with SMART on FHIR launch, delivered by our HL7 and FHIR integration team. If the target is Epic, see our notes on Epic FHIR integration.

Consent Stored as Data

Each consent kept as a structured record holding recipient, purpose, scope and calendar expiry, so the application refuses a release the consent does not cover and logs every one it allows.

Biometric Features Designed for BIPA

Notice text, electronic release capture, a published retention schedule and an automated destruction job built with the feature. Where the risk outweighs the benefit, we propose a login that collects no biometric data at all.

Legacy Modernization

Older clinical and billing applications assessed and rebuilt in stages, keeping the business rules staff rely on while fixing access control, logging and integration gaps.

Hosting and Support

Deployment to HIPAA cloud hosting with a signed BAA, then maintenance, security updates and feature work once the application is live.

Process

How We Run a Chicago Project From India

Chicago returned to Central Standard Time (UTC−6) on 1 November 2026 and stays there until 14 March 2027. India keeps UTC+5:30 all year, so it is 11 hours 30 minutes ahead in winter and 10 hours 30 minutes ahead in summer. A standing 8:30 a.m. Chicago call lands at 8:00 p.m. in Chennai in winter and 7:00 p.m. in summer.

Plan your project

1
Discovery Workshops
Morning video sessions with your clinical, compliance and technical leads, producing written requirements and a data-flow map of where PHI, biometric data and mental health records live.
2
Architecture Sign-Off
A solution architect fixes the data model, consent model, retention and destruction rules, encryption and logging before build starts, and checks any AI feature against the Illinois therapy rules.
3
Build While Chicago Sleeps
Development runs through the Indian working day, which ends around 7:00 a.m. Chicago time in winter. You start each day with a written update and a fresh test build.
4
Integration Testing
End-to-end runs against EHR or partner test environments, with clinical reviewers checking data and consent behavior.
5
Security Review
Code review and testing against OWASP guidance before release, using the methods behind our secure code review service.
6
Release and Support
Controlled go-live, then maintenance and feature work under a support plan agreed up front.

Timelines: We commit to a schedule only after discovery, because the speed of integration partners and the legal review of consent wording tend to decide the schedule, not the coding. Our Chennai healthcare software page describes the same team from the delivery side.

Use cases

Illinois Projects Where This Matters

Behavioral Health Platforms

Telehealth, outcome tracking and care coordination apps where consent, redisclosure and AI limits all apply.

Clinic Check-In and Kiosks

Face matching or palm scans at the front desk raise BIPA questions; whether the patient exclusion applies is a call for counsel.

Hospital Workforce Tools

Timekeeping and access systems using staff biometrics, where Mosby covers some uses and not others.

Patient Portals and Apps

Symptom forms and app sign-ups that collect medical information PIPA counts as personal information.

Payer and Benefits Tools

Member portals holding health insurance information that falls under PIPA's breach rules.

Genetic and HIV-Related Data

Illinois's Genetic Information Privacy Act and AIDS Confidentiality Act carry their own per-violation damages.

Why Xcodefix

Why Illinois Healthcare Teams Can Rely on a Remote Partner

Healthcare Is Our Origin

Clinical systems, PHI and compliance have been central to our work since Xcodefix Global started in 2008.

Architect-Led Delivery

More than 16 partners and solution architects lead design decisions, so legal requirements reach the architecture rather than a backlog.

Depth in Interoperability

HL7 v2, FHIR R4, SMART on FHIR and Mirth Connect are core skills for software that must talk to hospital systems.

BAAs for PHI Work

We operate under a Business Associate Agreement whenever our work involves PHI.

A Full In-House Team

Over 60 in-house engineers and developers cover design, build, testing and support.

Predictable Replies

Expect an answer to a new enquiry within one business day, and to a live security incident on the same day.

Healthcare software for Illinois

Tell Us What You Are Building

Share your feature list, the systems it must connect to and who will use it. A solution architect answers within one business day, listing the Illinois rules we see in it, the integration questions to settle first and a proposed discovery plan.

Prefer email? info@xcodefixglobal.com

Frequently asked questions

Healthcare Software Development for Chicago: Common Questions

Talk to the specialist who would scope the work — not a call-centre script.

Ask us directly

Does BIPA apply to healthcare apps?

It can. BIPA covers biometric identifiers such as face geometry, fingerprints and voiceprints collected by private entities. It excludes information captured from a patient in a health care setting and information collected for treatment, payment or operations under HIPAA, but the Illinois Supreme Court has said the exclusion is not a blanket one. Features like face login for a consumer app need a careful look.

Is HIPAA compliance enough for mental health software in Illinois?

Usually not. The Mental Health and Developmental Disabilities Confidentiality Act requires specific written consent for most disclosures, sets out what the consent must contain, rejects blanket consent and bars redisclosure without specific consent. HIPAA leaves more stringent state privacy law in place, so a product used in Illinois has to meet both.

Can an AI chatbot provide therapy in Illinois?

No. Since 1 August 2025, the Wellness and Oversight for Psychological Resources Act bars offering therapy or psychotherapy in Illinois, including through AI, unless a licensed professional conducts it. Licensed professionals may use AI for administrative or supplementary support, but not for therapeutic communication with clients, and recorded sessions need written notice and consent.

What does Illinois require after a health data breach?

Under the Personal Information Protection Act, affected residents must be notified in the most expedient time possible and without unreasonable delay. Where a breach reaches more than 500 Illinois residents, notice also goes to the Attorney General. A HIPAA covered entity or business associate in compliance with HIPAA must tell the Attorney General within five business days of notifying HHS.

How much does healthcare software development cost?

It depends on scope, integrations and compliance work; we do not publish prices. An app that only stores data costs far less than one that reads and writes EHR records, captures consent and handles biometrics. We estimate after a short discovery, showing integration effort separately from build effort.

Can a team in India build HIPAA-compliant software for a Chicago company?

Yes, provided the contract and the engineering are right. We sign a Business Associate Agreement when our work involves PHI, work in your controlled environments, and design to the Security Rule's safeguards, as in all our healthcare work. Compliance depends on how software is built and operated, not where the engineers sit. We have no Chicago office.

How do you handle the time difference with Chicago?

India is 11 hours 30 minutes ahead of Chicago in winter and 10 hours 30 minutes ahead in summer. Live calls happen early in the Chicago morning, which is evening in India, and the Indian working day goes to building. Each Chicago morning opens with a written summary of what changed, what is blocked and what we need.

Does the 2024 BIPA amendment apply to older claims?

In Clay v. Union Pacific, decided 1 April 2026, the Seventh Circuit held that the amendment limiting repeated scans to a single recovery applies to cases pending when it was enacted. That is a federal court's reading of Illinois law and does not bind Illinois state courts, so new products should still be built to avoid violations entirely.

Keep exploring

Related services

Web, Digital & Domains Software Development Web apps, APIs & modernization Web, Digital & Domains Website Design & Development Corporate sites, portals & apps Web, Digital & Domains SEO & Digital Marketing Technical SEO to paid growth Web, Digital & Domains AI & Machine Learning LLMs, RAG & ML pipelines Web, Digital & Domains Websites & eCommerce Storefronts, payments & B2B Web, Digital & Domains Domain Registration & DNS Domains, DNS & nameservers