Case study · Founder & lead engineer
ScrybeX
AI clinical documentation for licensed speech, physical, and occupational therapists — from a spoken visit narrative to a defensible, Medicare-compliant note.
I founded it and built the whole thing: the Laravel API, Flutter clients for iOS and Android, an internal admin console, the marketing site, and the entire AWS footprint as code. First commit to live on both app stores in about five months.
- Backend Laravel 12 · PHP 8.3
- Mobile Flutter — iOS & Android
- AI AWS Bedrock · Transcribe Medical · Whisper
- Infra 20-file Terraform stack
- Live scrybeapp.com
ScrybeX — the clinical pipeline
Deterministic validators lead. AI judgment follows. Every finding is explainable.
Input
-
Clinician dictation
Spoken or typed — the raw visit narrative.
-
Transcription
AWS Transcribe Medical / Whisper.
-
Gate — runs first
Compliance engine
Deterministic checks run before any model call.
Deterministic validators — explainable, rule-based; the findings you can point at
- Completeness
- Skilled-need
- Goal alignment
- Clinician voice
- Terminology
- Clinical decision engine
- Voice rater — 4 axes, 1–5
- Thresholds tuned on real notes
- Progress / treatment-response analysis
- Risk-narrative + state machine
AI generation — second, informed by the findings above
-
Claude on AWS Bedrock
Generates structured SOAP documentation, guided by the deterministic findings — never leading with an opaque score.
-
Clinician reviews
Every section editable, every change tracked.
-
Copy to EMR
Clinician owns the final record — not the tool.
HIPAA by construction: UUID keys · field-level PHI encryption · append-only audit log · PHI-sanitizing logs · no PHI in URLs · PHI never sent to an AI provider without a BAA
A deterministic failure is defensible — you can show the therapist the exact missing sentence. An unexplained model score is not.
Deterministic validators lead, AI follows, and every finding can be pointed at.
Why the validators run first
The obvious way to build this product is to hand the dictation to a model and ask for a compliant note. That version demos beautifully and fails the moment it matters.
A therapist's note is the document that justifies payment. When a claim is denied, the note is the evidence. So the question a documentation tool has to answer is not “does this read well?” but “can you show me exactly what is missing, and why it matters?”
That is why the compliance engine runs before any model call, and why a bank of deterministic, rule-based validators runs before generation rather than after it. When a check fails, the system can name the specific absence — no rationale language explaining why the intervention was skilled, no measurable functional outcome, no link back to the plan of care. That is a finding a clinician can act on and defend.
An AI score cannot do that. It might be right more often, but you cannot point at a sentence and say “this is the part the auditor will reject.” So the model never leads. It receives the deterministic findings as context and writes prose informed by them.
A compliance product that leads with an unexplainable number invites exactly the wrong conversation when a therapist gets denied on a note it scored well.
One validator earns its keep more than the rest: the skilled-need check, which scans for rationale language and requires genuine clinical reasoning rather than a restatement of what happened. Its thresholds are not guesses — the voice rater's four axes were recalibrated against a scored distribution of real notes rather than tuned by feel.
HIPAA by construction
Compliance that lives in a checklist gets audited once and drifts forever after. In ScrybeX the rules are architectural invariants the codebase enforces on every contributor:
- UUID primary keys everywhere — never auto-increment, so no identifier is enumerable.
- Field-level PHI encryption at the model layer, not just at rest.
- Append-only audit log — never updated, never deleted.
- Soft deletes on patients and notes; clinical records are never destroyed.
- A PHI-sanitizing log channel — protected health information cannot reach log output.
- No PHI in URLs — routes carry opaque identifiers only.
- No PHI to any AI provider without a BAA in place.
The production footprint is a Terraform stack covering the VPC and its endpoints, a dedicated KMS key, RDS, Redis, S3, SES, SQS/SNS, Athena, and CloudWatch alarms — because “what exactly is our infrastructure?” should have a version-controlled answer when someone asks during a security review.
Shipping it, including the unglamorous parts
A clinical product is not finished when the AI works. ScrybeX ships Apple In-App Purchase, Stripe billing, complimentary-account provisioning and conversion to paid, team seat growth, super-admin messaging, and in-app account deletion.
Getting there meant going through App Store review properly — including a rejection under guideline 3.1.1, the in-app purchase rule, which is the one every subscription app eventually meets. Resolving it took reworking the purchase flow and writing the review correspondence to explain it. That work does not appear in any architecture diagram, and the product does not exist without it.