Case study · Pre-launch

BrokerBrain

Benefits plan comparison for independent brokers, built around HIPAA's rules for health data from the first commit.

Status
Pre-launch. Private repository; code walkthrough on request.
Stack
TypeScript, Next.js, tRPC, Supabase Postgres, pgvector, Memgraph, Redis, AWS KMS, AWS Bedrock
Tests
3,414 passing across 20 packages and 2 apps
Links
Ask for a walkthrough

The problem

Independent benefits brokers run renewals for dozens of employer clients at once. The comparison work happens in carrier portals, PDF plan summaries, and spreadsheets, and it all lands in the same few weeks every year.

The design goal is to cut a four-hour plan comparison to about thirty minutes, without loosening a single rule about employee health data.

What I built

  1. Three API integrations, one pattern

    Employee Navigator (census, enrollment, provider sync), Noyo (group connections, enrollment sync, renewals, webhooks), and Ideon (plan search, provider networks). Each service takes its dependencies as inputs: client, checkpoints, encryption, audit log, and usage meter. Circuit breakers and retries live in one place per package.

  2. Insurer price files

    A streaming parser for the machine-readable price files insurers must publish under federal price-transparency rules, with a carrier registry and a reconciler. The reconciled rates load into a Memgraph graph.

  3. A vault for health data

    Envelope encryption with AES-256-GCM: each tenant gets its own data key, wrapped by AWS KMS. Health data is tokenized before any language-model call and restored on the way back.

  4. Every read is logged

    Each read of health data writes an audit record, following HIPAA's audit-control standard (45 CFR §164.312(b)). Audit records are kept six years.

  5. Agencies stay separate

    Postgres row-level security keeps each agency's clients apart, and an integration test tries to cross that line on purpose.

  6. Compliance alerts and commit gates

    ACA affordability checks at the 2026 threshold of 9.12%, plus employer-size and minimum-value checks. Pre-commit scripts block health data in logs or in prompts sent to a model.

How it fits together

Shaded steps enforce the HIPAA rules. Health data is encrypted and tokenized before it is stored or shown to any model.

Results so far

  • 3,414

    automated tests passing on the latest full run.

  • 38

    versioned database migrations.

  • Shipped

    plan comparison, client management, PDF export, compliance alerts, and renewal analysis, each tracked in a claims-versus-shipped file.

Not built yet

  • Not deployed yet.
  • Proposals, team seats, white-label exports, and API access are planned, not built. The claims file marks each one.