The Problem
A pre-seed HealthTech startup had built a working prototype, raised their first round, and needed to become HIPAA-compliant before their first enterprise customer could sign. The founders were technical but had never worked in regulated environments. They were caught between two fears: slow down and miss the market, or move fast and fail compliance.
The technical debt from the prototype phase was significant. There was no architecture documentation, no decision log, no security review process. The engineering team of 4 was shipping daily but had no governance framework.
The Approach
We engaged on a fractional CTO basis (2 days per week for 12 weeks) with a specific mandate: build governance without throttling delivery.
Phase 1: Risk Assessment & Quick Wins (Week 1-2)
- Assessed current architecture against HIPAA requirements
- Identified 3 critical gaps that needed immediate attention
- Created a risk register with clear ownership
- Implemented quick security wins (secrets management, access controls, audit logging)
Phase 2: Lightweight Governance Design (Week 3-6)
- Designed a minimal architecture decision framework (3 ADR templates tailored for startup velocity)
- Established a simple architecture review process (asynchronous, 24-hour turnaround)
- Created a compliance checklist embedded in the PR review process
- Defined decision rights for the small team (founders decide, team advises) — sized for four engineers, not the enterprise-scale matrix a 250-person company would need
Phase 3: Embed & Transfer (Week 7-12)
- Coached the engineering team on architecture thinking
- Set up an architecture decision log
- Created runbooks for security review, architecture review, and compliance checks
- Gradually reduced involvement from 2 days to 0.5 days per week, handing decision rights to the team in the same order they had been centralised — routine architecture calls first, security-sensitive ones last
The Outcome
| Metric | Before | After |
|---|---|---|
| Compliance readiness | Zero documentation | HIPAA-ready with auditable decision trail |
| Delivery velocity | Shipping daily (no process) | Shipping daily (with lightweight governance) |
| Architecture knowledge | Tribal (only in founders' heads) | Documented in ADR log |
| Security posture | No controls | Secrets management, access controls, audit logs |
| Team capability | Dependent on founders | Autonomous on routine architecture decisions |
The startup passed their enterprise customer's security audit on the first attempt. The fractional model meant they got senior architecture leadership at a fraction of a full-time hire's cost, with a deliberate off-ramp built into the engagement — the point was never to stay, it was to make staying unnecessary.
What Changed
The founders learned that governance and speed are not opposites — the right governance enables speed by removing uncertainty. Before the engagement, every technical decision felt risky because nothing was documented. After, the team had clear decision boundaries, documented rationale, and confidence that they were building on a compliant foundation.
Why This Generalizes Beyond HIPAA
The three gaps this startup had — no architecture documentation, no decision log, no security review process — are close to what The Minimum Architecture Every Company Needs describes as the baseline most companies skip at this stage, regulated industry or not. What made the engagement work was not a healthcare-specific playbook; it was sizing that minimum correctly for a 4-person team with founders-decide-team-advises decision rights, the same distribution question Decision Rights for Technology covers at enterprise scale. The scale changes. Who is allowed to decide this, and where the person answering for it sits, does not.
This was also a leadership engagement more than a governance one, which is why it sits under Leadership rather than Architecture on this site. Technology Leadership vs Technology Governance is the distinction that mattered here: the founders needed someone making calls and accountable for them, not someone writing a policy nobody would read. A fractional CTO who only does the second one is expensive theatre.
The pattern also outlives HIPAA. This engagement predates the startup's AI roadmap, but the same lightweight review — asynchronous, 24-hour turnaround, embedded in the PR rather than bolted on afterward — is close to what a healthtech team now needs before shipping a clinical AI feature, where the audit trail has to answer not just who accessed the data but why the model made a given recommendation and who signed off on deploying it. Your AI Agents Are Making Architecture Decisions Nobody Assigned Them That Role is the version of this problem waiting for teams that treat AI governance as a separate initiative instead of an extension of the review process they already built.