Healthcare Prototyping with Vibe Coding: What's Safe to Build Without PHI

Imagine you are a clinician or a healthtech founder with a brilliant idea for a patient intake form. You don't have time to wait six months for an engineering team. So, you open Cursor, an AI-powered code editor that uses large language models to generate software from natural language prompts, type out your vision in plain English, and watch the app appear on screen. This is vibe coding: using AI to translate intent into working software at lightning speed.

It sounds like magic. And for rapid prototyping, it is. But here is the catch: if you accidentally feed real patient data into that prototype, you have just created a massive security and compliance nightmare. In healthcare, speed means nothing without safety. The question isn't whether vibe coding works-it does. The question is what you can safely build before you bring in the heavy artillery of security engineers and compliance officers.

The Rise of Vibe Coding in Healthtech

The term "vibe coding" gained traction around 2025, popularized by AI researcher Andrej Karpathy. It describes a shift where developers-and increasingly, non-programmers-use natural language to guide AI models in building code. Instead of wrestling with syntax, you describe the "vibe" or the goal, and tools like OpenAI Windsurf, Meta’s Code Llama, or Google’s AlphaCode handle the rest.

In healthcare, this has been a game-changer for early-stage development. Companies like Medplum and Mindbowser report that development cycles that used to take months are now compressed into weeks. Clinicians who previously had no coding skills are building functional prototypes of EHR workflows and clinical tools. However, this democratization of development comes with a warning label. As security engineer Mackenzie Jackson noted, unsupervised AI-generated apps can be "vulnerability-as-a-service." An audit of apps built on similar no-code AI platforms found that over 10% had serious security flaws, including misconfigured authentication and exposed data endpoints.

This creates a paradox: vibe coding accelerates innovation but introduces significant risk if not handled correctly. The solution lies in strict boundaries. You can use AI to build the shell, the logic, and the interface, but you must keep Protected Health Information (PHI) far away during this phase.

Why PHI and Vibe Coding Are a Dangerous Mix

Protected Health Information (PHI) includes any demographic, clinical, laboratory, billing, or other information about a patient that could identify them. Under HIPAA, this data requires rigorous protection. Vibe coding, by its nature, is experimental. It involves iterative prompting, testing, and often, sharing context with AI models that may not be secured for production-grade data handling.

When you mix these two, several risks emerge:

• Data Security Gaps: AI-generated code often lacks the nuanced security checks that human engineers implement. Authentication might be too simple, or data endpoints might be left open by default.
• Maintainability Issues: Vibe-coded apps can become "one-off" creations that are hard to refactor or version-control. If a clinician builds a tool outside IT’s visibility (shadow IT), it becomes a governance black hole.
• Compliance Failures: Tools that influence clinical decisions must meet medical device software standards. Early prototypes rarely have the documented risk analysis or change control required for regulatory approval.

As Topflight Apps warns, "a pretty prototype isn’t a launch candidate." When PHI is involved, you need clear data boundaries, access controls, and audit logs. You cannot negotiate with risk teams using vibes. Therefore, the golden rule is simple: never use real PHI while building conversationally with an AI assistant.

What Is Safe to Build Without PHI?

You don't need to stop innovating. In fact, vibe coding is perfect for specific parts of the development process, provided you stick to synthetic or dummy data. Here is what you can safely build:

1. UX Flows and Front-End Prototypes

Use AI to generate interactive user interfaces based on design mocks. For example, you can create a triage flow for a clinic’s website. Use fake names, ages, and symptoms. The goal is to test if the workflow makes sense to users, not to store their actual data. Medplum’s team uses Cursor to create full-stack web app prototypes directly from designs, testing them in the browser with sample flows before connecting to any real backend.

2. Workflow Logic and Decision Trees

Clinical processes often involve complex decision trees. You can vibe-code the logic for an order set or a referral pathway using synthetic patient objects. For instance, create a mock patient object with fields like `age: 45`, `diagnosis: "Hypertension"`, and `lab_value: 140`. Test how the app routes this data. Since no real identifiers are used, you are safe to iterate rapidly on the business logic.

3. Integration Stubs and Mock Services

Before connecting to a live Electronic Health Record (EHR) system, you need to know how your app will talk to it. Use AI to generate mock FHIR APIs or sandbox services that simulate calls to billing systems or telehealth platforms. These stubs return fake records, allowing you to validate the integration behavior without touching production databases.

4. Non-Clinical Internal Tools

Administrative dashboards, operational checklists, or aggregated metric viewers that explicitly exclude PHI can be built with AI assistance. If the tool focuses on process efficiency rather than patient care, and uses only de-identified or simulated data, it poses minimal risk.

5. Educational Sandboxes

Training portals and teaching simulators are ideal candidates. Build a mock EHR interface populated with fully anonymized cases. Let clinicians explore new UI designs or workflows in a controlled environment. This provides value without exposing real patients to potential breaches.

What You Should Never Vibe-Code

While AI is great for scaffolding, some layers of your application must be built with traditional engineering rigor. Do not improvise on these critical components:

• Authentication and Authorization: Never let AI generate your login system for a production app. Misconfigured auth is a leading cause of breaches. Use pre-hardened, HIPAA-compliant identity providers.
• PHI Storage and Data Models: How you store data matters. AI might suggest a simple database schema, but it won’t automatically implement encryption at rest, secret rotation, or field-level encryption. These require deliberate design.
• Production EHR Integrations: Connecting to live FHIR servers or medication order systems requires robust error handling, retry logic, and security reviews. A vibe-coded connector might fail silently or expose credentials.
• Clinical Decision Support: If your app influences treatment decisions, it must undergo clinical validation. AI hallucinations can lead to dangerous recommendations. Human-in-the-loop gates and retrieval-augmented generation are necessary safeguards.

Best Practices for Safe Implementation

To leverage vibe coding without compromising safety, follow this practical pattern:

1. Keep Prototypes PHI-Free: Ban real patient data from your development environment. Use synthetic datasets that mimic the structure of real data but contain no identifiable information.
2. Use Pre-Hardened Components: Platforms like Specode offer HIPAA-aware building blocks for authentication, roles, and messaging. Assemble these with AI, rather than generating them from scratch.
3. Plan for a Rebuild: Accept that your vibe-coded prototype is not production-ready. Budget time for engineers to refactor the code, add security layers, and implement CI/CD pipelines.
4. Treat Data Pipelines as Radioactive: Minimize what you store. Separate identifiers from clinical data. Restrict access to raw exports. Assume that any data entering the system could be compromised if not properly secured.
5. Governance First: Ensure IT and compliance teams are aware of any tools being built. Avoid shadow IT by integrating vibe coding into your official development lifecycle.

Conclusion

Vibe coding is not a replacement for secure engineering; it is an accelerator for ideation. By clearly defining what is safe to build-UX, logic, and mocks-and what is not-auth, storage, and live integrations-you can harness the power of AI without risking patient privacy. Remember, the goal is not just to build fast, but to build right. Keep PHI out of the prototype phase, and you’ll be able to innovate responsibly.