HIPAA-Compliant AI Stack Under $300 Per Month: A Practical Build Guide

The $1,500 Per Month Problem in Small Healthcare Practices

A two-provider physical therapy clinic. A solo psychiatrist with six staff. A small OB/GYN group. These practices are all running the same bloated stack: Athenahealth for EHR and billing, Doxy.me for telehealth, a separate scheduling tool, and a patient communication layer bolted on top. The combined tab lands between $1,500 and $2,200 per month before anyone touches a patient.

That is $18,000 to $26,000 a year for tools that mostly do not talk to each other.

The pitch here is not to rip out your certified EHR. Billing compliance depends on it, and replacing it is a regulatory minefield. The pitch is to strip back every workflow that sits around the EHR and rebuild it cheaper, smarter, and under one compliant roof. For practices that have already audited their SaaS spend and identified waste, this build is a direct next step. For practices still mapping their tool landscape, start by cataloging every recurring subscription and tagging each one as EHR-core, EHR-adjacent, or fully replaceable. The adjacent and replaceable categories are where this HIPAA-compliant AI stack saves money.

The core insight is straightforward: most of the cost in a small practice SaaS stack is not the EHR. It is the six to eight peripheral tools that handle patient-facing and operational workflows the EHR was never designed to do well. Those tools are individually cheap but collectively expensive, and most of them can be replaced with a single well-architected HIPAA-compliant AI stack custom build.

What the Custom HIPAA-Compliant AI Stack Actually Covers

The workflows bleeding the most money are not the ones inside Athenahealth. They are the ones around it: patient intake, appointment reminders, telehealth video, post-visit follow-up, and internal staff Q&A on protocols. That is where Doxy.me (billed per provider), separate texting tools, and ad-hoc documentation pile up.

A HIPAA-compliant AI stack targeting those workflows looks like this.

Supabase (HIPAA-eligible, Team plan): Encrypted database for intake forms, patient metadata, appointment records, and audit logs. You need the Team plan at $25 per month and a signed BAA. Supabase publishes its BAA terms and HIPAA configuration documentation, covering encryption at rest, access controls, and audit log retention requirements. This is your compliant data layer. Supabase’s HIPAA documentation is available in the platform guide under compliance and describes the specific configuration steps required to activate HIPAA-eligible features on the Team plan.

Claude via AWS Bedrock: PHI-aware AI for intake summarization, protocol Q&A, and automated follow-up drafting. AWS signs a BAA and lists Bedrock as a HIPAA-eligible service in its official compliance reference. You are not sending PHI to Anthropic’s direct API, which does not currently offer a BAA. Route everything through Bedrock and you are covered. API costs at modest practice volume run $30 to $60 per month, depending on prompt length and call frequency.

n8n (self-hosted or cloud): Orchestration layer connecting form submissions, appointment triggers, EHR webhooks, and Claude. Self-hosted on a $20 per month VPS keeps costs low. The cloud plan runs $50 per month for managed infrastructure. n8n handles the logic that would otherwise require Zapier at $150 per month or a custom middleware service.

Daily.co for telehealth: Daily.co offers a HIPAA-compliant video plan with a BAA, documented in their published HIPAA compliance guide. Their HIPAA plan starts at $99 per month and covers unlimited telehealth sessions. This directly replaces Doxy.me’s per-provider fee, which compounds quickly in a multi-provider practice.

Add it up and you are at roughly $200 to $280 per month total, depending on hosting choices and API call volume.

How the Architecture Fits Together

Understanding the data flow is important for both compliance and build planning. Here is how the components interact in a typical patient intake and follow-up workflow within a HIPAA-compliant AI stack.

A patient submits an intake form through a Supabase-backed web form. n8n picks up the form submission via webhook, validates the data, and writes it to the appropriate Supabase table with a timestamp and user context for audit logging. If the intake includes clinical notes or symptom descriptions, n8n passes the relevant fields to Claude via AWS Bedrock with a structured prompt. Claude returns a summarized intake note, which n8n writes back to Supabase and, if configured, pushes to the EHR via webhook or API.

For appointment reminders, n8n polls the Supabase appointments table on a schedule, identifies upcoming appointments, and triggers an outbound SMS or email via Twilio or SendGrid. The reminder content can be personalized using patient metadata from Supabase, with Claude drafting the message if variation is needed.

For telehealth, n8n generates a Daily.co room URL at appointment time and sends it to the patient. The room is scoped to that appointment and expires afterward. No PHI passes through Daily.co’s infrastructure beyond what is necessary for the video session.

For staff protocol Q&A, clinical documents and policy manuals are chunked and embedded into a Supabase vector table using pgvector. When a staff member queries the internal knowledge base, n8n retrieves the relevant chunks and passes them to Claude via Bedrock with the question. Claude returns a grounded answer citing the relevant protocol. No PHI is involved in this workflow, but it still benefits from the same compliant infrastructure.

Each of these workflows is discrete and testable. You do not need to build all of them at once. A phased approach, starting with intake and reminders, then adding telehealth and Q&A, reduces build risk and lets you validate cost savings before committing to the full stack.

Side-by-Side: Current Stack vs. Custom Build

Component	Typical SaaS Stack	Custom Build	Monthly Savings
Telehealth (3 providers)	Doxy.me: $105/month	Daily.co HIPAA: $99/month	$6/month
Patient intake and forms	Embedded in EHR or Typeform: $80/month	Supabase forms and n8n: $45/month	$35/month
Appointment reminders and comms	Klara or similar: $250/month	n8n, Twilio, and Claude: $60/month	$190/month
Staff protocol Q&A and knowledge base	Guru or Notion: $120/month	Supabase and Claude via Bedrock: $50/month	$70/month
Orchestration and automation	Zapier: $150/month	n8n self-hosted: $20/month	$130/month
Total	~$705/month	~$274/month	~$431/month

That is $431 per month saved, or just over $5,100 per year, on the peripheral stack alone. The EHR stays. What changes is everything orbiting it.

The Compliance Parts Most Builders Skip in a HIPAA-Compliant AI Stack

Most HIPAA discussions stop at signing a BAA. That is table stakes. The pieces that actually get practices flagged during audits are subtler.

Audit logging is mandatory. Every read, write, or access to PHI needs a timestamped log with user identity. Supabase’s row-level security plus a custom audit trigger table handles this, but you have to build it explicitly. It will not happen by default. A minimal audit log table includes the user ID, action type (read, write, delete), table name, row ID, and timestamp. Every PHI-touching operation in your n8n workflows should write a record to this table.

Access control must be role-scoped. A front desk coordinator should not query the same PHI tables as a treating provider. Supabase’s RLS policies make this manageable, but it requires intentional schema design upfront. Define your roles before writing a single table. Common roles for a small practice include admin, provider, coordinator, and billing. Map each role to the specific tables and columns it needs to read or write, and enforce those mappings in RLS policies before you go live.

Data in transit and at rest. Supabase handles encryption at rest. You need to enforce TLS on all n8n webhooks and API calls. No plain HTTP endpoints anywhere in the workflow chain. This is easy to miss when self-hosting n8n on a basic VPS. Use a reverse proxy with a valid certificate and test every webhook endpoint before connecting it to live patient data.

Stateless PHI handling in Claude. Your Claude prompts must not cache PHI across sessions. Each patient interaction should be stateless from the model’s perspective, with context pulled fresh from Supabase and discarded after the response. This is a workflow design decision, not something Bedrock enforces on its own. Structure your n8n workflows so that PHI is fetched, passed to the model, and immediately discarded from the workflow’s working memory after the response is written back to Supabase.

Breach notification procedures. A compliant build also requires a documented incident response plan. If PHI is exposed, HIPAA requires notification to affected individuals within 60 days. Your stack should include monitoring alerts on Supabase access anomalies and n8n error logs so you know immediately if something goes wrong.

What You Cannot Replace (And Should Not Try)

Certified EHR functionality for billing, e-prescribing, and clinical documentation is regulated. Replacing Athenahealth’s core clinical record with a custom build is not just risky. It could cost you the ability to bill Medicare and Medicaid. That trade is not worth making.

The play is additive, not wholesale. You are building a smarter, cheaper HIPAA-compliant AI stack layer that handles the patient-facing and operational workflows the EHR does poorly, while keeping the EHR for what regulators require it for.

Some practices have tried to go fully custom and found themselves rebuilding features that took EHR vendors a decade to certify. Do not do that. Use the custom stack for the 40 percent of workflows where SaaS is genuinely overpriced and underperforming. Use your EHR for the 60 percent where certification and billing integration are non-negotiable.

The clearest signal that a workflow belongs in the HIPAA-compliant AI stack is that it touches patient experience or internal operations without requiring clinical certification. Intake forms, reminders, telehealth video hosting, and staff knowledge bases all fit this profile. Prescription routing, clinical documentation, and billing claims do not.

Build Cost and Payback Math

A developer familiar with Supabase and n8n can ship the core of this stack (intake forms, automated reminders, telehealth swap, staff Q&A) in 6 to 8 weeks. At $100 per hour, that is roughly $6,000 to $8,000 in build cost, depending on the number of workflows and the complexity of EHR webhook integration.

With $431 per month in savings, you break even in roughly 14 to 19 months at full build cost. That is longer than a typical SMB SaaS swap, because compliance architecture adds legitimate hours that a non-healthcare build would skip. The audit logging, RLS policies, BAA procurement, and TLS enforcement all take time to implement correctly.

If you have an internal ops person who can handle n8n configuration and manage ongoing workflow updates, you can reduce the external build cost to the Supabase schema design and compliance review, cutting the engagement to 2 to 3 weeks and reducing total build spend to $2,000 to $3,000. At that cost, payback drops to 5 to 7 months, consistent with the efficiency gains this kind of HIPAA-compliant AI stack typically delivers for operationally lean practices.

The ongoing cost difference is real regardless of build path. After the initial investment, the stack pays for itself every year, and the operational improvements compound as staff spend less time on manual reminders and intake processing.

Choosing the Right Build Path for Your HIPAA-Compliant AI Stack

Not every practice should commission a full custom build from scratch. There are three realistic paths depending on your team’s technical capacity and budget.

Full Custom Build With a Developer

Best for practices with complex intake workflows, multiple providers, and existing EHR webhooks. Timeline is 6 to 10 weeks. This path gives you the most flexibility and the most control over compliance architecture. A developer scopes the Supabase schema, configures RLS policies, wires AWS Bedrock credentials, and builds n8n workflows from end to end. You own the entire HIPAA-compliant AI stack with no ongoing vendor dependency beyond the infrastructure services themselves.

Hybrid Build With Internal Ops Support

Best for practices with a tech-comfortable ops manager who can own n8n. A developer handles Supabase schema, RLS policies, and Bedrock integration. The ops manager configures and maintains n8n workflows. This cuts external hours and reduces ongoing maintenance dependency. The developer engagement is typically 2 to 4 weeks rather than 6 to 10, and the ops manager takes over from there. This path works well when the practice already has someone who manages other SaaS tooling and is comfortable with low-code automation platforms.

Phased Build Starting With One Workflow

Best for practices that want to validate savings before committing the full budget. Start with appointment reminders, which delivers the fastest ROI (replacing a $150 to $250 per month comms tool with a $30 per month n8n and Twilio workflow). Add intake forms in month two and telehealth in month three. Each phase of the HIPAA-compliant AI stack is independently valuable and can be paused without losing prior work. This approach also lets you build internal familiarity with the tooling before committing to more complex workflows like PHI-aware Claude summarization or pgvector-based staff Q&A.

The Bottom Line

Small healthcare practices do not need to choose between compliance and cost efficiency. A HIPAA-compliant AI stack built on Supabase and Claude, constructed deliberately with proper audit logging, role-scoped access controls, stateless PHI handling, and signed BAAs, can replace the peripheral SaaS layer for around $250 to $280 per month. Keep your EHR. Replace the tools orbiting it. Put $5,000 per year back into the practice, and build a stack that you control.

The compliance work is real and should not be skipped. But it is also finite. A well-scoped HIPAA-compliant AI stack built once correctly requires only minor ongoing maintenance, unlike the recurring per-seat and per-provider fees that make the current SaaS model so expensive at scale. Practices that have completed this build consistently report that the upfront compliance investment pays back within the first year, with compounding operational gains in subsequent years as staff rely less on manual workflows and more on automated, auditable systems.