DICOMetrics: From Replit Prototype to HIPAA-Ready Production
How Bitsol took a founder-built spinal imaging app live on AWS: production-ready in 8 weeks, with every clinical formula preserved.
DICOMetrics™ helps physicians, imaging centers and attorneys turn stress-view spinal X-rays into professional CRMA (Computed Radiographic Mensuration Analysis) reports. Users upload DICOM images, plot landmarks, and the platform calculates motion between vertebrae to identify AOMSI (Alteration of Motion Segment Integrity), a sign of spinal ligament instability.
It covers cervical, thoracic, lumbar and upper cervical studies, and produces a finished, AMA Guides-aligned report in minutes.
A prototype that worked, but couldn't go live.
The founder had spent a year building DICOMetrics on Replit. The prototype measured real studies, generated PDF reports and took payments. Most importantly, its measurement engine had already been validated.
But every X-ray and every report contains protected health information. To sell to clinics, DICOMetrics needed to meet HIPAA's technical safeguards, run on infrastructure covered by a Business Associate Agreement, and stand up to a buyer's security review. A rapid-prototyping platform wasn't built for that, and a solo founder couldn't rebuild the product while also running it.
- Data security: encryption of patient data and imaging files with properly managed keys
- Access control: enterprise-grade login, MFA, lockout and session limits
- Practice isolation: a guarantee that one practice can never see another's patients
- Compliance evidence: the documentation and test reports buyers and auditors ask for
- Capacity: an engineering team to do all of it without breaking the clinical results
Our approach
Bitsol rebuilt DICOMetrics on a HIPAA-eligible AWS foundation, module by module. We kept everything the founder had already proven and replaced everything that couldn't pass a compliance review.
We ported the measurement and reporting algorithms exactly as they were. No formula or threshold changed, so production reports match the results the founder had already validated. Clinicians got the same answers, on a platform they can trust with patient data.
- Amazon Cognito for sign-in, with MFA enforced for staff
- Amazon S3 with AWS KMS encryption for DICOM images, practice assets and reports
- Field-level encryption of patient data in the database
- AWS WAF with managed rule sets and rate limiting, behind TLS 1.3
- AWS Secrets Manager and Amazon SES, with separate dev and production environments and automated CI/CD
- Practice isolation enforced by the database: PostgreSQL row-level security, 23 policies across 14 tables, re-checked on every release
- Tamper-resistant audit trail of access to patient data
- Session controls: rotation at sign-in and a 12-hour absolute limit
- Access termination: admins can immediately remove a departing user's access to patient data
- Dependency vulnerability gate on every deploy
Authentication and onboarding, patient and referring-physician records, the DICOM study viewer, measurements, report generation, Stripe subscription billing, team management, an admin portal and in-app support. Every screen was ported from the original and refined for a smoother path from upload to finished report.
A full production-readiness audit across seven areas (database performance, application performance, security, access control, encryption, HIPAA compliance and tenant isolation) raised 134 findings. Every one was resolved: 101 fixed in code, the rest accepted with documented reasoning or scheduled as follow-on work.
Timeline
| When | Milestone |
|---|---|
| Week 1 (30 June) | Kickoff |
| Week 3 | Gap analysis and HIPAA compliance design complete |
| Week 4 | First rebuilt module live in development: secure sign-in with MFA |
| Week 6 | Development environment running on AWS |
| Week 7 | Production environment live on AWS |
| Week 8 | Rebuild complete, production-ready |
| Before launch | Production-readiness audit: 134 findings resolved |
| 11 September | Public launch at app.dicometrics.com |
| 11 Sep to 11 Oct | 30-day warranty and post-launch support |
Results
DICOMetrics went from prototype to production-ready in 8 weeks and launched on 11 September 2026, the date the client chose. A 30-day post-launch warranty closed on 11 October 2026.
| Outcome | Result |
|---|---|
| Kickoff to production-ready | 8 weeks |
| Live production environment on AWS | Week 7 |
| Public launch | 11 September 2026, on the client's schedule |
| Post-launch warranty | 30 days, completed 11 October 2026 |
| Pre-launch audit findings | 134 raised, 134 resolved |
| Clinical formulas changed | 0 |
| Automated tests protecting the platform | About 4,700 |
| Compliance, security and quality reports delivered | 15 |
What the client received
Beyond the product, DICOMetrics received 15 reports it can hand to buyers, partners and auditors.
| Area | Reports |
|---|---|
| Compliance | HIPAA technical safeguards controls map, SOC 2 technical safeguards controls map, ADA CASA technical safeguards, Business Associate Agreement register |
| Security | Load test, SSL/TLS grade, OWASP ZAP web application scan, vulnerability report, automated DAST baseline scan, SAST quality gate |
| Engineering | Test coverage report, entity relationship diagram, AWS architecture diagram |
| Accessibility | WCAG 2.2 conformance, Section 508 conformance |
Technology
Python and Flask, PostgreSQL with row-level security, Cornerstone.js DICOM viewer, Stripe billing, and AWS: Cognito, S3, KMS, SES, WAF, Secrets Manager and Application Load Balancer, deployed through automated CI/CD.
Related Work
Have a healthcare pilot that needs to go live?
Bitsol is the healthcare AI production partner that takes pilots to production in 8 weeks, with compliance and security built in from day one.