Problem
A medical-billing company runs three jobs at once: win the next provider, keep the current providers' credentials current, and get paid for the work. Each was living in its own tool, and the riskiest part, anything touching patient health information, kept threatening to leak into ops systems that had no business holding it. They needed one portal for finance, sales, and credentialing that was deliberately built to never become a PHI store, because the cheapest compliance posture is the data you never hold.
Approach
The first architectural decision was a boundary: PHI does not live in the portal, by design, isolated from the surfaces the team works in every day. Inside that boundary, four surfaces are live. The finance module runs the money side of the business, compiling each month's invoice from the finalized payroll run and reconciling the forecast against actuals. The sales pipeline tracks providers from first contact to signed. Provider credentialing carries all ten workflow stages, from intake through the billing handoff, with per-client ownership so a credentialing user only ever sees the clients they own. The staff directory replaced a flat, unfilterable user list with one derived rule for who is currently on staff. Zoom is integrated for meetings and for logging inbound calls and events, so the conversation that moved a deal or flagged a credential is on the record next to the work. Shipping surface by surface meant the company got working tools early instead of waiting for a big-bang launch.
Outcome
Live on the company's own branded domain since June 2026 and compounding since. The portal holds 250 clients, 2,042 credentialing panels, 13,702 logged events and 589 application references. Credentialing now answers questions the old spreadsheet could not: 125 panels waiting on the desk against 1,560 waiting on payers, 147 behavioral carve-out gaps with 21 of them live and denying claims today, payer-directory coverage of active panels up from 34% to 66%, and a follow-up queue that went from nothing to roughly 60 panels due a day across 1,066. Exclusion screening runs daily against the real OIG LEIE, all 83,665 rows. The PHI-out-of-the-portal posture is holding, which keeps the compliance surface small and the audit story simple. This is the healthcare finance and credentialing recipe, retuned for a billing company's shape rather than a clinic's.
Notes
What's running today
Four surfaces are live on the company's own domain and carrying real work: finance, the sales pipeline, provider credentialing, and staff records. Between them they hold 250 clients, 2,042 credentialing panels, 13,702 logged events and 589 application references.
The finance module runs the money side of a billing company, the part the whole business depends on: each month's invoice compiled from the finalized payroll run, then reconciled against actuals, and a superseded invoice kept and marked rather than deleted, so a re-compile can never erase a document the client is holding. The sales pipeline tracks providers from first contact through to signed, so next month's revenue is visible before it lands. Staff records replaced a flat, unfilterable user list with one derived rule for who is currently on staff, and it separates off-boarding a leaver from disabling a login, because conflating those two is how personnel records go wrong.
Credentialing is the surface that changed the most. All ten workflow stages now exist, from intake through the billing handoff, and the module answers questions the old spreadsheet could not:
- 125 panels are waiting on the desk. 1,560 are waiting on payers. On the sheet those two looked identical, which meant nobody could tell chasing from waiting.
- 147 behavioral carve-out gaps, 21 of them live. A provider effective on a payer's medical network with no behavioral panel behind it. Those claims are denying right now, and the denials present as billing errors, so nobody was looking at credentialing for the cause.
- Payer-directory coverage of active panels went from 34% to 66%. That is the difference between a panel and a phone number somebody can actually call.
- The follow-up queue went from nothing to roughly 60 panels due a day, across 1,066 panels. Worst first, one escalation rung per panel per day, so the queue is a day's work rather than an alert storm.
- Exclusion screening runs daily against the real OIG LEIE, all 83,665 rows. Not a sampled extract, and not a quarterly manual check.
Zoom is wired in for meetings and for logging inbound calls and events. The conversation that moved a deal forward or surfaced a credential question is recorded next to the work it affected, not lost in a separate app.
What broke, and what I did about it
The original data migration ran clean and was still wrong. It had silently dropped about a third of the source workbook: provider blocks whose tabs never came in, payer rows that were never read. I only found it by counting the source again instead of trusting the import log. The recovery brought the portal to the numbers above, and it also explained a quieter failure: the credential-expiry cron had been firing on nothing since go-live, because the rows it watched had never arrived. A migration that finishes without errors is not the same as a migration that is correct.
Marking a panel effective set the status and threw away the date billing works from. Effective is a terminal state, so the panel left the day view, the work queue and every follow-up list in the same write that lost the one field the whole exercise exists to produce. Three separate surfaces could do it. One rule now sits on all five write paths, and production no longer holds an effective panel without a date. The date is the deliverable; the status is just how the panel got there.
An adversarial review pass over the module, including code that had shipped hours earlier, caught two more holes in that same guard before anyone hit them, and caught an escalation cron that would have paged an admin about every panel already past its SLA on its first run. The review is now part of how this module ships.
Decisions I'd defend
No PHI in the portal, by design. This is the load-bearing decision. The portal is built so patient health information never enters it, isolated from the surfaces the team uses daily. The cheapest data to keep compliant is the data you never hold. It keeps the audit story short and the risk surface small.
Ship surface by surface, not in a big bang. Finance, sales and credentialing each went live the week they were ready, so the company had working tools months before the last surface landed. Every module since has gone onto the same backbone rather than beside it, which is why the portal got wider without getting more complicated.
Scope is one authorization key, checked in one place. Per-client ownership decides what a credentialing user can see, and every query routes through the same helper set rather than repeating the predicate inline. Verified empirically, not assumed: a scoped user reaches their own clients and cannot reach the rest.
What's next
The remaining work is data and people, not code. Intake, the post-approval gates and the billing handoff are built and correct and hold no rows yet, because they fill the moment the desk starts working through them. The backlog that matters is the one the portal now makes visible: approved panels with no effective date, clients not yet routed to an owner, panels the old sheet flagged red that only the team can interpret. Every one of those is a question the software can ask and only the desk can answer, which is the right split of the work and the opposite of where this started.
The credentialing and finance shape here is the same recipe the rest of my work runs on, fitted to a billing company rather than a clinic. If you run a billing or credentialing operation that has outgrown its stitched-together tools, reach out.