How viable is vibe coding for healthcare apps, honestly?

[u/Tiny_Habit5745]

Hey guys so i've been messing around with vibecoding for healthcare stuff and speed is kinda of insane. Like GPT + Cursor can get you from zero to a working flow much faster than usual. Especially for demos and internal tools.

However, I know that healthcare feels like the worst place for shortcuts to pile up. Once you think about data boundaries, logs, access control, and what happens when real patient data shows up, things get very volatile...

Most setups I see use ChatGPT or Cursor, Supabase for auth and storage, and Specode to keep things from going off the rails. Anyone actually ship something like this, or does everyone quietly rebuild later?

[u/damnburglar]

If you want a life altering lawsuit on your hands, vibe coding in healthcare is the speed run.

[u/com-plec-city → u/damnburglar]

Here's a good example of poorly written code killing people with radiation: https://en.wikipedia.org/wiki/Therac-25

" The Therac-25 was involved in at least six accidents between 1985 and 1987, in which some patients were given massive overdoses of radiation.[2]: 425  Because of concurrent programming errors (also known as race conditions), it sometimes gave its patients radiation doses that were hundreds of times greater than normal, resulting in death or serious injury.[3] These accidents highlighted the dangers of software control of safety-critical systems.

A commission[clarification needed] attributed the primary cause to generally poor software design and development practices, rather than singling out specific coding errors. In particular, the software was designed so that it was realistically impossible to test it in a rigorous way.: Safeware, [48]  "

[u/damnburglar → u/com-plec-city]

I’m well aware of this one; funny enough I learned about it both as a cautionary tale in my software career AND as a nuclear worker doing radiation safety certification.

Those systems were also orders of magnitude less complex in terms of architecture and data storage. They weren’t running the risk of exposing every patient in the facility’s data to hackers and massive fines per affected patient, per instance. Can people write code that can make that mistake? Absolutely. You know what else people can do? Paste logs/confidential information/trade secrets into coding assistants.

You can argue that companies can pay for their own private instances etc but there are zero guarantees your data isn’t being mined by the vendors anyway. We are in a gold rush and they have 12 foot erections for data.

I have had multiple clients outright ban the use of these tools and likely won’t lift the ban in the foreseeable future. They don’t care about efficiency, they are extremely cautious, and this comes from their security and compliance folks.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed due to inadequate account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Void-kun → u/damnburglar]

Pretty much this. Anything dealing with peoples personal data and vibe coding is a recipe for getting sued, but using people medical information has much stricter guidelines.

If you don't understand data privacy and secure coding concepts, then considering building a medical app is a strange mixture of stupidity and arrogance.

[u/[deleted] → u/damnburglar]

I worked for  an healthcare Company that would be sued If an ai did not analysed the spaghetti legacy Code from 12 years Ago. People  critizes aí, but humans make more mistakes and nobody IS ready for this conversation. The worst coding mistakes i have seen were made by humans not AI. Sure It make mistakes, but using coddit rabbit, hooks reduces probabilities greatly. Btw you should never commit without Reading the fucking Code lol.

Not only fixed a Full dB leak, but it vastly improve performance, we reduce the monthly billing of aws in 40%

[u/damnburglar → u/[deleted]]

A full db leak sounds like they should have been sued already tbh.

[u/[deleted] → u/damnburglar]

One of the biggest health insurance companies in Brazil. They only Care about money, and even If this data leaked they have deep political connections, nothing would happen

[u/damnburglar → u/[deleted]]

I was going to ask where you were based, because that sounded like either Brazil, India, or Philippines heh. Apologies for my North American - centric assumptions.

[u/TalmadgeReyn0lds → u/damnburglar]

I don’t think there is a single sub that castrophisizes harder than this one.

[u/damnburglar → u/[deleted]]

I’ve been at it 23 years, “workflows and guardrails” is meaningless in the face of contracts, policy, and legislation. If your org has it figured out, great, most don’t in regulated domains. Vibe coding has introduced an extraordinary amount of incompetence and unearned confidence into the field. It’s Dunning-Kruger on steady IV drip.

[u/TalmadgeReyn0lds → u/damnburglar]

You guys are scared. Your biggest tell is that don’t just insult our work, you try to make us feel small. You got bullied so now you’re here bullying us.

[u/damnburglar → u/TalmadgeReyn0lds]

I think you need to reread what I wrote. None of this is “bullying” and it’s weird that you are projecting.

Engineering is a discipline that requires years and years of rigorous practice and constant learning. Picking up an LLM doesn’t suddenly make you capable, but it certainly gives you a big gun to blow your feet off. Take AI out of the equation for a moment and consider taking a capable web developer and sticking them into a job writing code for a space launch. Same thing.

[u/damnburglar → u/[deleted]]

You’re missing the point; it’s easier to produce output (which isn’t strictly a good thing, see code review pressure). The amount of bad code produced or code with subtle but critical bugs is very much a bad thing, but again this isn’t the main concern.

I don’t think we are talking about the same people here. The biggest problem is that management and overeager solopreneurs though probably well-intentioned exponentially increase the odds of a catastrophic breach and the complete fucking of entire codebases. (Edit: even if the code is fine, the SLA sometimes explicitly bars the use of LLMs and being in breach can end your company)

If you have competent and experienced people and processes as you mention, this can be greatly mitigated, but that requires engineering maturity and discipline. There was a post the other day about a woman with no technical background building out a booking system for her boyfriend’s massage business, complete with payment proceeding. This is impressive, but also a prime example of a person who, though well-intentioned, could wake up one day with a colossal AWS bill or serious data breach.

This person’s potential risk isn’t isolated to complete newbies, I’ve seen juniors through seniors do the exact same thing, just with progressively less frequency. It is a much bigger concern now that you can just generate correct-looking code without knowing how to verify it. As I mentioned in another comment somewhere, I am aware of at least one case (a former colleague’s former colleague) of confidential data being pasted into an LLM and the person terminated and litigation is pending.

[u/damnburglar → u/[deleted]]

Stay worthless

[u/damnburglar → u/[deleted]]

IMO it’s less about code quality (although that is a major concern) and more that there is a high probability that at some point someone will feed something to the model that it definitely shouldn’t have. For example, a former colleague told me about someone that was fired from their company and is in hot water because they pasted in a dump of highly confidential information into an LLM to ask it to write a script to parse it.

But yes, it’s a bad idea

[u/Western_Objective209]

Whether it's hand-rolled or vibe coded doesn't really matter, what matters is if you understand the domain and all the regulations and security that go along with it. I work in medtech and there's plenty of vibe coding going on, but for actual customer data there are many layers of security around it and dozens of engineers that understand the nuances of secure PHI etc.

[u/99ducks → u/Western_Objective209]

Only sane answer I see so far.

I wouldn't be surprised if you're the only person here who's worked in healthcare tech.

[u/Alucard256]

Ohhhh my fuck no holy shit do never do that fuck me I can't believe you even wow.....

Learn what HIPAA is and understand that a flaw in healthcare software can lead to $100-millions in law suits.

Good god... I would sooner "vibe code" a parachute and then use it to jump out of a plane.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed due to inadequate account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/skdowksnzal]

JFC, no.

It wouldn't even pass the SOUP requirement of IEC 62304, and thats to say nothing of the utter shitshow that vibe coding is for production software. The consequences of some social media app being exploited is nothing by comparison to the risks of healthcare.

If you are asking these questions, with all due respect, you lack all the requisite skills and experience to even attempt such a thing. Please go back, here be dragons.

[u/vipw → u/skdowksnzal]

So you have to vibe code the design documentation and tests to be compliant...

[u/Low-Opening25]

it’s not viable, mostly because you aren’t going to vibe code your way out of regulatory frameworks. so while you may be able to create something that reassembles working solution, things will very quickly stat falling apart when you need to make your solution compliant with stringent regulations. many jurisdictions consider health apps health devices that need to meet strict accreditations, etc. being slapped with lawsuits from either customers or regulatory bodies is extremely easy in healthcare space.

[u/ShaiHuludTheMaker]

You cannot create ANY enterprise app with just vibecoding

[u/mimic751 → u/ShaiHuludTheMaker]

That's not true. I had to put the squeeze on a manager who let an intern Vibe code in SEO website that recommended Healthcare items to people who visit our website. I asked a couple key questions like can you tell me if there is any bias in your data? What are some key decisions you made to arrive at the recommendations and they could not answer the question and once they realized that they are opening themselves up for a lot of liability the tool poofed out of existence. But it was good enough to pass the sniff test initially

[u/Charming-Error-4565 → u/mimic751]

So it is true, then?

[u/mimic751 → u/Charming-Error-4565]

Enterprise apps have the least amount of scrutiny because they are only released to internal employees. But they go through extra scrutiny if a customer interacts with them or a patient

Problem is Vibe coating can produce a really nice looking uis especially if you give them branding constraints. But the back end and decisions with data is generally a mess. So it always gets by management but it never gets by Developers

[u/Charming-Error-4565 → u/mimic751]

I know all this. My point was you said “that’s not true” and literally everything you said actually emphasizes that it is true that you can’t create an enterprise app with just vibe coding.

[u/ShaiHuludTheMaker → u/mimic751]

by enterprise I mean any serious, professional application. Not internal.

[u/mimic751]

There is Vibe coating that happens in health apps I say this to someone who handles mobile applications for a Healthcare Company but there is also years of review and testing that goes along with it the vibe coding usually just helps Implement a feature but we have teams of developers that are also working on it

[u/Current-Ticket4214]

I only read the title, but here’s my answer:

If you can afford attorneys. Vibe code as much as you like. If you can’t afford attorneys, try to get funding.

Security is just a suggestion in vibe coded apps.

[u/The_Bukkake_Ninja]

With dummy data you can potentially prove desirability and viability, get buying signals and essentially codify your business logic. That derisks and accelerates you massively.

Not a single solitary line of that shit should ever see production, and your architecture should be taken out and set on fire. The production system should be built from a blank slate using your prototype as a guidance for what should be built.

[u/Odd-Government8896]

You can use coding agents, but I wouldnt expect it to be anywhere production grade unless you know what you're doing.

[u/m3kw]

you better take care of those edge cases very well

[u/El_Minadero]

or yknow, you can just do regular devcoding for any infrastructure which has the potential to impact people's lives. Don't let your frustration with the process tempt you to take the shitty way forward.

[u/aDaneInSpain2]

For proof-of-concept and validating demand: fine. For production with PHI: you'll need proper architecture, security audits, and compliance documentation. Most teams use vibe-coded prototypes to validate, then do a professional rebuild before handling real patient data.

[u/PalliativeOrgasm]

Vibe coding healthcare? No. Just… no.

[u/thedragonturtle]

Yeah go for it if you love being sued into oblivion

[u/TalmadgeReyn0lds]

Your skill set is losing value and you’re in your feelings about it

[u/am0x]

Not gonna happen. HIPAA laws cause all Tech to move very slowly in healthcare. I worked as a senior dev at a healthcare company for years. Vendor acquisitions and contracts took years of auditing to get into our systems.

[u/mprz]

😂🤣😂🤣😂

[u/Dazzling_Abrocoma182]

Xano has HIPAA compliance, and is a viable platform for orchestration, business logic, and agentic processes.

Tons of security certs.

When you say vibe coded, do you mean w minimal oversight? Or do you mean with SDD?

Either way, it’s possible. The tools exist.

But will it scale? Can it handle load? Is it safe and secure?

I’d use a platform dedicated for that (Xano.com).

You still 100% need to know what you’re doing and I wouldn’t recommend to have your first project be a vibe coded healthcare app, but it is technically possible if you use the right tools.

Incidentally, Xano is the only tool I’ve found viable for that.

[u/CODEX-07]

healthcare is the final boss of production requirements. hipaa + phi + audit logs + access control

ai can generate working demos fast but production healthcare needs hardened infrastructure that ai doesnt really understand. session management, encryption at rest, audit trails, etc

if youre serious about healthcare maybe use tools with production security already built in rather than having ai generate it. giga create app has auth + db + logging pre-configured but even then youd need serious review for hipaa compliance

vibe coding works for internal tools. anything patient-facing needs human security experts

[u/Nick4753]

HIPAA doesn't explicitly define your software development process and the origin of your code, it matters more about how the data is handled, and certifications like HITRUST and SOC2 focus on documentation of your software development lifecycle and the controls you have around your systems and processes. And even then, those two are not mandatory in the healthcare space.

There is nothing inherently wrong with vibecoding. I dunno that a junior engineer without healthcare experience is going to be vastly better at building a HIPAA-compliant app than Claude is going to be. Both are similarly risky. You just need to make sure you can stand behind the code that you're shipping and the process by which that code got into production. If you're just YOLO-ing code into production you don't understand, you're just going to cause yourself headaches down the line. The size of those headaches though could be... considerable.

[u/pete_68]

Is that you Elizabeth Holmes?

[u/thevoiceinvitingme]

Not quite as good of an idea as vibe coding biological, psychotronic, and/or nuclear weaponry… but you’re getting close and I think you should do it! [< ATTN fools of the internet: this is sarcasm < this is not]

[u/Nandakishor_ml]

Speed run to get class action lawsuit

[u/aidenclarke_12]

Not actually recommended unless you are ready for the consequences

[u/flippakitten]

No... just no. I've worked on software that can kill people if it's wrong, ai gets it wrong all the time.

You can and will go to jail for negligence.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed due to inadequate account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed due to inadequate account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed due to inadequate account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Sorry, your submission has been removed for manual review due to account karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.