3 Years Building HIPAA-Compliant Healthcare PWAs: What I Learned

From July 2022 to September 2025, I worked at MYCURE as a Junior Web Developer. MYCURE is a healthcare SaaS platform serving over 100 clinics and healthcare facilities in the Philippines, handling everything from appointment booking to clinical records to billing. During my time there, we processed over 50,000 appointments monthly and the system ran in clinic environments where network reliability wasn't guaranteed.

These are the real lessons from building healthcare software at that scale.

Offline-First Was Non-Negotiable

Philippine clinic environments often have unreliable internet. A staff member in the middle of logging a patient's vitals shouldn't lose their work because the connection dropped for 30 seconds. MYCURE solves this with Syncbase — a proprietary technology that combines on-premise local servers with cloud synchronization.

Unlike a typical web app that becomes unusable when connectivity drops, Syncbase keeps the system running locally on an on-premise server. Data is recorded locally and synced to the cloud once connectivity returns. Multi-branch clinics can operate each branch independently offline, with data consolidation handled automatically when the connection is restored.

Working on this system taught me that offline-first architecture isn't just a technical decision — it's a product decision. You have to define which operations are safe to defer, what happens when records are updated in two places simultaneously, and how to surface sync status clearly to clinical staff. These questions have real clinical implications that engineering alone can't answer. We worked closely with the product team to define the right boundaries.

Data Sensitivity in Frontend Code

Healthcare data is sensitive. In a HIPAA-relevant context and under the Philippines Data Privacy Act, you have to think about data handling in places that web developers don't usually consider.

We never stored patient identifiers in URL parameters, which are visible in browser history and logged by proxies. We were careful about what landed in browser console logs — patient names or record IDs should never appear in production debug output. We set strict Content Security Policies to prevent any patient data from accidentally being exfiltrated to third-party scripts.

One specific pattern we adopted: never putting sensitive data in localStorage or sessionStorage. Anything that persists across sessions needs to go through the API and be authenticated on every request. This sounds obvious in hindsight, but I've seen plenty of web apps that cache user data in localStorage for convenience. In healthcare, that convenience isn't worth the risk.

Performance at Scale

With 50K+ monthly appointments and multiple concurrent users per clinic, performance was a real concern. Clinic front desk computers are often older hardware. If the application is slow, it directly affects patient throughput.

We adopted virtual scrolling for long lists — patient queues, appointment lists, clinical records — using vue-virtual-scroller. Rendering 500 patient records in a standard v-for loop is a quick way to freeze an older machine. Virtual scrolling renders only the visible rows and a small buffer, dramatically reducing DOM node count.

Lazy loading components and route-level code splitting were important too. Nuxt.js makes code splitting per route straightforward out of the box. Clinic staff don't visit every section of the application equally — lazy loading less-used modules means a faster initial load for the sections they use constantly.

Why Vuetify Worked Well

Vuetify is a Material Design component framework for Vue.js with a large, well-documented component set. For a healthcare application where clinical staff need to learn the interface quickly and use it reliably, having a consistent, predictable UI was important — and Vuetify gave us that out of the box.

What Vuetify gave us: a comprehensive component set with accessibility built in, a consistent Material Design base we could customize, and deep integration with Vue's reactivity system. Components like v-data-table, v-dialog, and v-form handled the heavy lifting for our most complex UI patterns.

The Vuetify community and documentation are strong. Healthcare applications have complex state requirements — persistent layouts across navigation, route-level authentication guards, Vuex integration — and having well-documented patterns for these reduced the decisions our team had to make from scratch.

The Most Valuable Lesson

The most valuable lesson from three years in healthcare software isn't technical — it's this: understand the clinical context of every feature you build. A missed appointment isn't just a cancelled booking. It has implications for patient health outcomes, clinic revenue, and staff scheduling. When you understand what a feature means in the real world, you make better decisions about edge cases, error messages, and data handling.

Frontend developers in healthcare aren't just building UIs. They're building tools that affect how care is delivered. That responsibility sharpened my attention to detail in ways that I carry into every project I work on now.