DEV Community

Vigilmon
Vigilmon

Posted on

Healthcare Application Monitoring: Uptime, HIPAA Considerations, and Alert Strategies (2026)

#healthcare #monitoring #hipaa #devops

Healthcare applications face unique uptime requirements. When a patient portal goes down, patients can't access their test results. When an appointment booking system fails, clinic staff book appointments on paper (or miss them). When an electronic health record (EHR) API becomes unavailable, care decisions get delayed.

This guide covers how to monitor healthcare applications for uptime and availability, including HIPAA considerations for monitoring tools.

Healthcare Application Uptime Requirements

Healthcare apps often have informal or regulatory SLA requirements:

System Type Typical Uptime Target Why
Patient portal 99.9% Patients expect 24/7 access
Appointment scheduling 99.95% Revenue directly dependent
EHR API integrations 99.9% Clinical workflow dependency
Lab result delivery 99.9% Time-sensitive clinical data
Telehealth platform 99.99% (during hours) Active care delivery
Billing/insurance APIs 99.5% Business-critical but lower urgency

Critical Endpoints to Monitor in Healthcare

Patient-Facing Systems 

https://portal.yourhealth.com          # Patient portal login
https://portal.yourhealth.com/appointments  # Appointment scheduling
https://portal.yourhealth.com/results  # Lab results page
https://portal.yourhealth.com/messages # Secure messaging
Enter fullscreen mode Exit fullscreen mode

Clinical Staff Systems 

https://ehr.yourclinic.com/login       # EHR login
https://ehr.yourclinic.com/schedule    # Provider schedule
https://api.yourclinic.com/health      # EHR API health
Enter fullscreen mode Exit fullscreen mode

Integration Endpoints 

https://api.yourclinic.com/hl7         # HL7 FHIR endpoints
https://api.yourclinic.com/webhooks    # Lab results webhooks
https://api.yourclinic.com/insurance   # Insurance eligibility API
Enter fullscreen mode Exit fullscreen mode

Building Health Check Endpoints for Healthcare

FHIR/HL7 API Health Check 

// Node.js / Express health check for healthcare API
app.get('/health', async (req, res) => {
  const checks = {};
  let status = 'healthy';

  // Database connectivity
  try {
    await db.query('SELECT COUNT(*) FROM patients LIMIT 1');
    checks.database = 'ok';
  } catch (e) {
    checks.database = 'error';
    status = 'unhealthy';
  }

  // FHIR validation service
  try {
    const fhirCheck = await fetch(process.env.FHIR_VALIDATOR_URL + '/health', {
      timeout: 3000
    });
    checks.fhirValidator = fhirCheck.ok ? 'ok' : 'degraded';
  } catch (e) {
    checks.fhirValidator = 'error';
    status = 'degraded';
  }

  // Lab result integration
  try {
    const labCheck = await fetch(process.env.LAB_API_URL + '/ping', {
      timeout: 3000
    });
    checks.labIntegration = labCheck.ok ? 'ok' : 'error';
  } catch (e) {
    checks.labIntegration = 'error';
    if (status === 'healthy') status = 'degraded';
  }

  // Secure messaging service
  try {
    await messagingService.ping();
    checks.messaging = 'ok';
  } catch (e) {
    checks.messaging = 'degraded';
  }

  res.status(status === 'unhealthy' ? 503 : 200).json({
    status,
    timestamp: new Date().toISOString(),
    version: process.env.APP_VERSION,
    checks,
    // Don't include PHI or PII in health responses
  });
});
Enter fullscreen mode Exit fullscreen mode

Appointment System Health 

# Python / FastAPI health check for appointment system
from fastapi import FastAPI
from datetime import datetime

app = FastAPI()

@app.get("/health")
async def health_check():
    checks = {}
    overall_status = "healthy"

    # Database check
    try:
        result = await db.execute("SELECT 1")
        checks["database"] = "ok"
    except Exception as e:
        checks["database"] = "error"
        overall_status = "unhealthy"

    # Calendar service check
    try:
        await calendar_service.ping()
        checks["calendar"] = "ok"
    except:
        checks["calendar"] = "degraded"
        if overall_status == "healthy":
            overall_status = "degraded"

    # Insurance eligibility API
    try:
        await insurance_api.health_check()
        checks["insurance_api"] = "ok"
    except:
        checks["insurance_api"] = "error"
        if overall_status == "healthy":
            overall_status = "degraded"

    return {
        "status": overall_status,
        "timestamp": datetime.utcnow().isoformat(),
        "checks": checks,
        # Never include patient data in health responses
    }
Enter fullscreen mode Exit fullscreen mode

HIPAA Considerations for External Monitoring

This is the important part. External monitoring tools like Vigilmon send HTTP requests to your health check endpoints. Here are the HIPAA considerations:

What's Safe to Monitor

✅ Safe to expose in health check responses:

  • Status codes (200, 500, etc.)
  • System status strings ("healthy", "degraded", "error")
  • Uptime seconds
  • Version numbers
  • Subsystem connectivity status ("database: ok")
  • Non-specific counts ("appointments: 247") — without patient identifiers

❌ Never include in health check responses:

  • Patient names, IDs, or demographics
  • Medical record numbers (MRN)
  • Appointment details with patient info
  • Diagnoses or treatment information
  • Any Protected Health Information (PHI)

Monitoring Architecture That's HIPAA-Compatible 

External Monitor (Vigilmon)
    │
    ▼
Public Health Endpoint (/health)
    │  Returns: {"status": "healthy", "db": "ok"}
    │  No PHI. Just system status.
    │
    ▼
Internal Systems (Database, EHR, etc.)
    │  PHI stays here. Never exposed externally.
Enter fullscreen mode Exit fullscreen mode

Key principle: Monitoring endpoints should expose system health signals, never patient data.

Verifying Your Health Endpoint is Safe

Before adding a health endpoint to external monitoring:

# Review what your health endpoint returns
curl https://api.yourclinic.com/health | jq .

# Ensure output contains ONLY:
# - status fields
# - system/subsystem names  
# - boolean or categorical values
# - timestamps
# - No patient data, no IDs, no PHI
Enter fullscreen mode Exit fullscreen mode

BAA Requirements for Monitoring Tools

If your monitoring tool touches PHI (e.g., it fetches actual patient portal pages with patient data), you typically need a Business Associate Agreement (BAA) with that vendor.

With Vigilmon's HTTP monitoring: Vigilmon checks whether your URL returns a given status code and optionally whether the response contains a specific keyword. If your health endpoint contains no PHI, you're monitoring infrastructure, not patient data—which is generally outside BAA scope.

Best practice: Use /health endpoints that expose only system status. No PHI = no BAA needed for monitoring.

Always consult your compliance team and legal counsel for your specific situation. This guide provides general information, not legal or compliance advice.

Setting Up Vigilmon for Healthcare Apps

  1. Create health endpoints that expose no PHI
  2. Sign up at vigilmon.online — free
  3. Create monitors for each critical component

Critical Monitor Configuration for Healthcare:

Monitor: Patient Portal Health
URL: https://portal.yourclinic.com/health
Expected status: 200
Keyword: "healthy"
Interval: 1 minute
Alert after: 1 failure
Alert: Email + Slack + PagerDuty
Enter fullscreen mode Exit fullscreen mode 
Monitor: Appointment System
URL: https://booking.yourclinic.com/
Expected status: 200
Keyword: "Book Appointment"
Interval: 1 minute
Enter fullscreen mode Exit fullscreen mode 
Monitor: EHR API
URL: https://api.yourclinic.com/health
Expected status: 200
Keyword: "status"
Interval: 1 minute
Enter fullscreen mode Exit fullscreen mode

Alerting for Healthcare Applications

Healthcare needs clear escalation paths:

Level 1 (immediate): Email to on-call IT
Level 2 (5 min): Slack to #incidents
Level 3 (10 min): Page IT director
Level 4 (20 min): Escalate to CTO + clinical operations
Enter fullscreen mode Exit fullscreen mode

For patient-facing outages, prepare a communication template:

  • Website notification banner
  • Automated phone message
  • Staff notification to handle manual processes

Monitor During After-Hours Too

Healthcare emergencies don't respect business hours. Patient portals need to be monitored 24/7:

  • Configure Vigilmon to check every minute, all day, every day
  • Set up after-hours escalation path (on-call engineer)
  • Log all incidents for compliance reporting

Status Pages for Healthcare

Consider a status page for:

  • Staff: Internal status page showing EHR, scheduling, billing system status
  • Patients: External status page showing portal availability

Vigilmon provides free status pages. Customize the message to be patient-friendly when there are outages.

Get Started Free

Vigilmon provides free uptime monitoring for healthcare applications:

  • 5 monitors on free tier
  • 1-minute check intervals
  • Multi-region checks (US, EU, Asia)
  • HIPAA-compatible architecture (no PHI in monitoring)
  • Email, Slack, PagerDuty alerts
  • Incident history for compliance documentation

Start monitoring your healthcare application at vigilmon.online.

Top comments (0)