I understand both has their own fair share of audience but outsourcing is more common.
For those who've been through this decision, what factors mattered most? Was it budget, timeline, project complexity, long-term maintenance, or something else?
which worked better for your product
I've been involved in a few healthcare software projects over the years, and one thing I've noticed is that HIPAA compliance is often treated as something to address near the end of development rather than during planning.
The most common issue I've seen is teams focusing heavily on features and UX, only to realize later that they need audit logs, access controls, encryption requirements, data retention policies, or business associate agreements with vendors.
In one case, a team had already built most of the product before discovering that a third-party service they relied on wasn't willing to sign a BAA. Fixing that wasn't exactly a small task.
Another mistake I've seen is assuming that using a major cloud provider automatically makes an application HIPAA compliant.
For those who have worked on healthcare apps:
Interested to hear some real-world experiences and lessons learned.