Vibe coding for CPOs in healthcare.
A healthcare CPO is building for clinicians who have no patience for bad software and a compliance officer who has no patience for fast software. The tension is that the realistic prototype a nurse will react to needs data that looks like patient data, and the moment it is real patient data your discovery build becomes a HIPAA system.
What is true about software in healthcare before you write a prompt.
Healthcare is where a fast build meets the slowest rules. Any tool that touches patient information, even a scheduling app or a feedback form, is handling data that laws like HIPAA in the United States and GDPR in Europe treat as special. The tools do not know that. The person building with them has to.
Patient data has a legal definition
Names with appointment times, email addresses with a condition, a photo of a form. If it can identify a patient and relates to their care, it is protected health information and it cannot sit in a default database on a personal hosting account.
Vendors need agreements
The hosting platform, the database, the email service and the AI provider all need to be covered by a business associate agreement or equivalent before patient data touches them. Most free tiers are not.
Access must be logged
Who looked at which record and when. Regulators ask, and a homemade tool with no audit trail cannot answer.
Deletion and retention are rules, not features
Records must be kept for a set period and then deleted. The tool has to know how to do both, and prove it did.
What a CPO in healthcare builds first.
01The clinician workflow with synthetic patients
A working version of the intake, triage or charting flow loaded with generated patients from a tool like Synthea, so a nurse can click through it in a real shift break without anything protected touching your laptop.
02The prior authorisation status tracker
The most requested feature in many health products and the one engineering keeps deferring because payer rules change. You build the tracker against a handful of payers and ship it as a beta to one practice.
03The patient feedback loop
Post-visit survey responses joined to appointment types and wait times from the scheduling system, with names stripped before the data lands, so you can see which clinic and which visit type is driving the complaints.
CPOs in every industry tend to build the same four things. The CPO page has that list.
Real patient records loaded to make the demo land
A clinician says the demo does not feel real, so you export fifty actual patient records from the EHR into the prototype's database on a personal hosting account. That is protected health information outside any business associate agreement, with no audit log, reachable by anyone with the link. The cost is a reportable breach, a notification to each of those patients, and a compliance review on every prototype you build afterwards.
The pattern underneath is the one every CPO hits: sales saw the demo. A customer signed. Now the exploratory build with no error handling and no tests has a contract attached, and 'we will rebuild it properly' has no date.
What a safe build in healthcare usually runs on.
Builds that hold patient data run on hosting and databases with signed agreements in place, with single sign-on from the practice's identity provider, encrypted storage and audit logging turned on from the first deploy. Anything that does not touch patient data can use the normal stack, which is why the first question is always what data the tool actually holds.
What changes for a CPO in healthcare.
A CTO in your corner draws the line between discovery and production, and helps you cross it on purpose. Prototypes stay cheap and disposable. The ones that are going to live get the ten things production needs before a customer touches them. When engineering takes over, it comes with a written account of what was decided and why. Discovery stays fast. The handover stops hurting.
What CPOs in healthcare ask.
A CTO who has read healthcare apps before yours.
Thirty minutes, free, no card. What you built, what is going on with it, whether we can help.
In your corner.