Back to case studies
Case study · Transportation & Logistics

From spreadsheets and email threads to one operations platform.

11 modules
HIPAA-ready from day one

At a glance

Industry
Transportation & Logistics
Build type
App
Tech stack
Next.jsTypeScriptPrismaPostgreSQLNextAuthAWS Amplify
What it does
  • Trip dispatch with 9-step status workflow + assignment queue
  • Mobility-type matching for provider assignment (ambulatory / wheelchair / stretcher)
  • Provider directory with 13-type credential tracking (license, COI, drug screen, OIG/SAM)
  • Recurring "standing orders" with day-of-week scheduling for weekly trips
  • Reimbursement forms (Medicaid Trip, Provider Invoice, CMS-1500) with status workflow
  • Audit log, complaint tracking, role-based access, PHI encryption at rest
The work

An NEMT broker — a brokerage that coordinates Medicaid-funded medical transportation between health plans, members, and a network of transportation providers — was running their operations the way most brokerages do at small scale: spreadsheets for trip dispatch, email threads for provider assignments, paper or PDF forms for reimbursement claims, and credentialing tracked in a separate document somewhere. The compliance footprint was growing — HIPAA, 42 CFR 455 credentialing, state Medicaid documentation — and the brokerage was stretching the limits of what a small operations team could hold together by hand.

We built their entire operations platform from scratch. Trip dispatch with a 9-step status workflow and a queue that surfaces unassigned and rejected trips, with mobility-type matching so the right vehicle gets sent to the right member. A provider directory with 13 tracked credential types — license, COI, background screen, drug screen, OIG/SAM exclusion lists — each with their own status and verification workflow. Recurring "standing orders" so weekly dialysis runs auto-generate trips. Reimbursement forms (Medicaid Trip, Provider Invoice, CMS-1500) flowing through a draft → submitted → under review → approved/denied → paid pipeline. Complaint tracking, audit log, dashboard analytics, role-based access. Every PHI field encrypted at rest. Every PHI access logged.

The brokerage now runs entirely on one platform — 11 modules, one login, one source of truth. The operations team stopped reconciling spreadsheets and started running their business through software. And the system was HIPAA-ready from day one — encryption, audit trails, role-based access, BAA-signed infrastructure — not bolted on later when the brokerage tried to scale.

Engineering challenges
01

HIPAA-grade compliance from day one

AES-256-GCM encryption on PHI fields (patient name, phone) at rest, TLS in transit, every PHI view logged as a discrete audit event, 30-min idle session timeout with 8-hour absolute cap, account lockout after 5 failed attempts, role-based access enforced at the route layer. BAA signed with AWS before any production data touched the system.

02

Eliminating duplicate data entry across workflows

One PostgreSQL schema serves dispatch, credentialing, reimbursements, and audit. A completed trip auto-populates the corresponding Medicaid reimbursement form. A provider’s credential status flows into trip assignment so an expired license blocks dispatch automatically. Operations staff stop typing the same Medicaid ID into three different systems.

03

Bulk-importing trips from health plan spreadsheets

Excel/CSV import endpoint that validates each row against the trip schema, looks up existing providers by code, and queues parse errors for review instead of silently dropping rows. Imported trips drop straight into the assignment queue, ready for mobility-matched dispatch.

Ready to build?

15 minutes. No pitch deck. Just a conversation about what you’re trying to solve.

Book an intro
Or send a note

Or email ops@dualitylabs.ai