We’re still thinking about some of the finer points of our recent panel about Building Secure Healthcare Systems. You may have seen our big picture thoughts in some recent blog posts, but we know it’s also nice to have some actionable tips you can fold into your workflow right now.

Here are five quick software development in healthcare tips from our panelists: David Pace, Executive Director at Merck Research Labs IT Enablement and User Experience, thoughtbot Development Team Lead Clarissa Borges and thoughtbot Principal Developer Joël Quenneville.

1. Plan now for third-party vendor outages later

Your healthcare software probably depends on at least one third-party vendor, but when that data source goes down, you don’t have to completely disappoint users. For a recent project, Joël and his teammates worked on deploying a dual track for users. An external third-party aggregator provided high-fidelity data on health insurance plans, but if it was down, the software was able to serve lower-fidelity information from a smaller local data set.

2. Think about “AI for developers” differently from “AI in the product”

Joël also recommends thinking about your AI usage as two different risk profiles. The first one needs less scrutiny: AI tools that developers run locally to help them write code, ideate or solve problems. But the second has a higher risk profile and deserves to be locked down much more: Any AI that’s embedded in the product and touches customer data. This classification shorthand can help you quickly decide where to spend your security time.

3. Automate infrastructure compliance between audits

Staying SOC 2 compliant is critical for some projects, but it’s easy to slip out of compliance with something like a cluster upgrade in Kubernetes. Unless you conduct a tedious audit, you’re likely to miss that compliance misstep. It’s why Clarissa uses a compliance monitoring service called Vanta that continuously audits data and infrastructure against compliance. It doesn’t cover every single compliance issue, but it provides a large safety net.

4. Create an AI agent to find security vulnerabilities

Joël built a simple penetration testing agent that scans code, creates hypotheses for potential vectors of attack then writes them up as actual attacks in a test file. Next the agent executes the test file and reports on what went wrong. You end up with a vulnerability report and test file where everything that’s a potential threat has a failing test. This makes it easy to hand over to a developer—or another AI agent—to address.

5. Carve out time for curiosity and experimentation

Inspired by thoughtbot’s investment time, David Pace at Merck asks everyone in his organization to set time aside for self-directed tech projects—work-related or not. His personal explorations have included an educational version of Wordle where every answer related to research IT terms. Giving your team room to experiment helps create a strong culture that nurtures curiosity, continuous learning and new ideas.

Wish you had this kind of thinking to add to your healthcare tech team every day? We’d love to help shape your next innovation project or deliver custom software development for healthcare faster. Let’s talk.

**