Axoniq Conference 2025 Day 1: Building Compliant Healthcare Software with Event Sourcing

🎯 Speakers:

• Job de Noo - Former CTO, Dear Health

• Van der Meulen Tech Lead/Staff Engineer, Dear Health

🏥 About Dear Health:

Platform for risk-based care pathways serving chronically ill patients (IBD, heart failure, cancer) with provider portal and patient app for telemonitoring.

🔥 Key Challenges Solved:

Regulatory:

• ✅ MDR Class 2A certification (annual external audits)

• ✅ GDPR compliance with event deletion

• ✅ ISO 27001 requirements

• ✅ NEN 7513 audit logging

• ✅ Post-market surveillance

Technical:

• ✅ Serverless event sourcing in Python/AWS

• ✅ Custom CQRS framework (DynamoDB, SQS, Lambda)

• ✅ PII masking with data events

• ✅ Per-disease configurable UI fields

• ✅ Event-driven medical recommender

• ✅ Multi-microservice coordination

📋 Key Takeaways:

• 1️⃣ Isolate High-Risk Components: Register only critical parts (recommender) as Class 2A, keep rest as lower class

• 2️⃣ Privacy by Design: PII flags in metadata, encryption at rest/transit, GDPR-ready deletion

• 3️⃣ Event Sourcing = Dual Benefits: Enables both technical flexibility AND audit compliance

• 4️⃣ Compliance Requires Compromises: Version numbers, production definitions, static requirements vs agile development

• 5️⃣ Data Events Pattern: Decouple microservices with flattened key-value events for scalability

🛠️ Tech Stack:

• Python (serverless)

• AWS: Lambda, DynamoDB, SQS, SNS, EventBridge, KMS, Kinesis, S3, Athena, TimeStream

• Custom CQRS framework

• ElasticSearch

• GraphQL (AppSync)