StackPrism
Regulated data

Tech stack for a HIPAA telehealth app (2026)

Online therapy platform, designed by StackPrism from one sentence: 16 components, a reason for each, and the live checks that watch them.

The stack

  • Next.js
  • Amazon CloudFront
  • WebSockets
  • Node.js
  • AWS Lambda
  • Amazon EventBridge
  • Amazon S3
  • Amazon RDS
  • Amazon SES
  • Amazon Cognito
  • Stripe
  • AWS Secrets Manager
  • Amazon CloudWatch
HIPAAHealthcareAWSUpdated
The idea someone typed
“A telehealth app for therapy practices: patients book and join video sessions, fill in intake forms, message their therapist and pay per session. Therapists keep private session notes.”

Their answers on the constraints step

Where users are
Mostly US
Compliance
HIPAA
Already uses
AWS

Make it yours. Open this stack in the editor to check its health, harden it and hand it to your coding agent. No sign-up, nothing to generate.

Start from this stack
goes down

Select a component to see what it does and what it connects to, or pick one above to see what breaks if it goes down. Pinch or use the buttons to zoom.

Why this stack

Everything that touches patient data runs on AWS, which signs a Business Associate Agreement (BAA) covering its HIPAA-eligible services. Patients and therapists sign in through Amazon Cognito, join video sessions through the Amazon Chime SDK and message each other over an API Gateway WebSocket API. A Node.js API keeps appointments, intake forms and session notes in Amazon RDS for PostgreSQL, stores files in S3, encrypts sensitive fields with KMS and reads its secrets from Secrets Manager. EventBridge and Lambda run scheduled work such as reminders, the API sends email through Amazon SES, and CloudTrail records activity in the AWS account. Stripe sits outside AWS and takes payment for sessions, so keep health details out of anything sent to it. None of this makes the app compliant by itself: the BAA, access controls and your own practices still have to be in place.

Why each piece

All 16 components on the diagram: what each one does, what it talks to, and what stops if it goes down.

  1. Next.js Web App

    In Frontend Hosting

    Patient portal. Calls Amazon Cognito (auth), API Gateway WebSocket API (chat) and Amazon Chime SDK (join).

    Nothing else on the diagram depends on it.

  2. Amazon CloudFront

    In Frontend Hosting

    Edge delivery.

    Nothing else on the diagram depends on it.

  3. API Gateway WebSocket API

    In Core Services

    Realtime chat. Calls Node.js API (events). Called by Next.js Web App (chat).

    If it goes down, 2 of 15 components degrade.

  4. Node.js API

    In Core Services

    Business logic. Calls Amazon RDS PostgreSQL (reads), Amazon S3 (stores), Stripe (charges), Amazon SES (sends), Amazon EventBridge (schedules), AWS Lambda (triggers), Amazon Chime SDK (tokens), Amazon Cognito (verifies), AWS Secrets Manager (reads) and AWS KMS (encrypts). Called by API Gateway WebSocket API (events).

    Nothing else on the diagram depends on it.

  5. AWS Lambda

    In Core Services

    Background jobs. Calls Amazon EventBridge (consumes). Called by Node.js API (triggers).

    If it goes down, 1 of 15 components stops working.

  6. Amazon EventBridge

    In AWS

    Jobs and events. Called by Node.js API (schedules) and AWS Lambda (consumes).

    If it goes down, 2 of 15 components degrade.

  7. Amazon S3

    In AWS

    Patient files. Called by Node.js API (stores).

    If it goes down, 1 of 15 components degrades.

  8. Amazon RDS PostgreSQL

    In AWS

    Primary data. Called by Node.js API (reads).

    If it goes down, 1 of 15 components stops working.

  9. Amazon SES

    In Specialized Services

    Email delivery. Called by Node.js API (sends).

    If it goes down, 1 of 15 components degrades.

  10. Amazon Chime SDK

    In Specialized Services

    Video sessions. Called by Next.js Web App (join) and Node.js API (tokens).

    If it goes down, 2 of 15 components degrade.

  11. Amazon Cognito

    Auth and MFA. Called by Next.js Web App (auth) and Node.js API (verifies).

    If it goes down, 2 of 15 components stop working.

  12. Stripe

    Payments. Called by Node.js API (charges).

    If it goes down, 1 of 15 components degrades.

  13. AWS Secrets Manager

    Secrets vault. Called by Node.js API (reads).

    If it goes down, 1 of 15 components degrades.

  14. AWS KMS

    Encryption keys. Called by Node.js API (encrypts).

    If it goes down, 1 of 15 components degrades.

  15. AWS CloudTrail

    In AWS

    Audit trails.

    Nothing else on the diagram depends on it.

  16. Amazon CloudWatch

    In AWS

    Logs and alarms.

    Nothing else on the diagram depends on it.

When this stack fits

  • You handle US patients’ health information and need a BAA with every vendor that stores or sees it.
  • You want hosting, database, files, email and video under one cloud account and one BAA.
  • Your team already works with AWS.

When to pick something else

  • Before launch, confirm that every AWS service you use is on AWS’s list of HIPAA-eligible services.
  • Your team has never run AWS: compare managed platforms that offer a BAA, and get each one in writing.
  • You don’t handle health data after all: the managed stacks among these examples are much quicker to start.

What you need to build this

16 components across 10 areas of the stack.

Build it with your AI agent

Hand the stack to Claude Code, Codex, Cursor or any coding agent as a brief: how it connects, install steps and a build plan.

Frontend1

  • Next.js Web App

    Patient portal

    npm install next

    Docs

Backend & APIs4

  • Node.js API

    Business logic

    Docs

  • API Gateway WebSocket API

    Realtime chat

  • AWS Lambda

    Background jobs

    Docs

  • Amazon Chime SDK

    Video sessions

Data1

  • Amazon RDS PostgreSQL

    Primary data

    Docs

Cache & queues1

  • Amazon EventBridge

    Jobs and events

    Docs

Auth1

  • Amazon Cognito

    Auth and MFA

    Docs

Payments1

  • Stripe

    Payments

    npm install stripe

    Docs

Email & messaging1

  • Amazon SES

    Email delivery

    Docs

Storage & CDN2

  • Amazon CloudFront

    Edge delivery

    Docs

  • Amazon S3

    Patient files

    Docs

Hosting & infra2

  • AWS Secrets Manager

    Secrets vault

    Docs

  • AWS KMS

    Encryption keys

Observability2

  • Amazon CloudWatch

    Logs and alarms

    Docs

  • AWS CloudTrail

    Audit trails

Install

npm install next stripe

SDKs only. Pick your own database driver or ORM.

See all 30 example stacks