Velox

From Samplifier to a full quality-measurement platform

Executive Summary

Velox began where our Indicina case study ends: a serverless sample-size calculator for clinical quality measures, delivered in under two months. Over the following two years, Francioni designed and built its evolution — a multi-tenant SaaS platform for healthcare quality-measure reporting and audit, covering submission validation, rate review, medical-record sampling, digital-readiness analytics, and generation of the final audit deliverable.

The platform is fully serverless on AWS, delivered continuously through an automated multi-account pipeline, and engineered around one non-negotiable constraint: protected health information must be safe by design.

The Challenge

A regulated domain with real complexity

Healthcare quality reporting (HEDIS®) involves strict methodologies, seasonal audit deadlines, and an ecosystem of health plans, licensed audit organisations, and consultants — seventeen distinct user roles across four organisation types, each seeing exactly what their role permits.

Protected health information

Parts of the workflow process patient-level detail files hundreds of megabytes in size. That data had to be encrypted with dedicated keys, retained only as long as strictly needed, and never persisted beyond aggregate results.

Ship continuously without a dedicated ops team — a small product organisation needed enterprise-grade release discipline without hiring platform engineers to run servers.

The Solution

Francioni built the platform TypeScript end-to-end on a fully serverless AWS architecture: a server-rendered web application on AWS Lambda, DynamoDB single-table designs with streams for event-driven fan-out, S3 for document and submission storage, SQS-decoupled notifications delivered through Amazon SES, and CloudFront fronted by AWS WAF with managed OWASP rule sets.

PHI is protected by design: a dedicated customer-managed KMS key encrypts patient-level data at rest, bucket policies force encryption on every object, and lifecycle rules automatically purge patient-level files within 72 hours — reconciliation results store tallied totals only.

Everything is infrastructure as code across a three-account AWS Organization. An AWS CodePipeline promotes every change from development through UAT to production with manual approval gates — the same pattern we bring to every engagement, here running a regulated healthcare product.

Results and Benefits

Two years of continuous delivery

Over 1,200 commits and 28 versioned releases shipped by a small embedded team, growing the platform from two modules to eighteen — spanning submission XML validation, NCQA-methodology sampling, rate checking, a permissioned audit document repository, and digital quality readiness analytics that model the industry's transition to FHIR-based measurement.

Costs that track usage

With no servers to run, patch, or scale, infrastructure cost follows platform usage — including through the sharp seasonal peaks of the audit calendar — and the team's time goes to product, not operations.

Security that stands up to scrutiny

Web application firewalling, per-IP rate limiting, passwordless authentication, dedicated PHI encryption keys, and automatic data expiry give a healthcare product the security posture its customers — and their auditors — expect.