~healthcare
Medical softwarethat ships compliant
Records, telemedicine and e-prescribing built on the regulatory requirements — in the modeling, not bolted on at the end. Zero to first patient in 14 weeks.
- CFM/SBIS HANDBOOK
- LEI 14.510/2022
- LGPD
- ICP-BRASIL
- HIPAA
- GDPR
- HL7 / FHIR
The vocabulary your
counsel speaks
What each rule actually demands, in plain language rather than loose acronyms.
Brazil
- CFM/SBIS handbook
- The requirement set for electronic health record systems in Brazil. SBIS certification is not required by law, but it is the main instrument for demonstrating those requirements were met.
- NGS1 and NGS2
- Security assurance levels. NGS1 covers access control and authentication. NGS2 adds digital signature with an ICP-Brasil certificate — and that is what lets a record be fully digital, with no paper printout.
- Federal Law 14.510/2022
- The federal statute regulating telehealth in Brazil since December 2022. It sits above the medical council's resolution — and it is what requires a qualified electronic signature, on an ICP-Brasil certificate, for every prescription, certificate or report issued from a remote record.
- CFM Resolution 2.314/2022
- The Federal Council of Medicine's rule detailing how technology-mediated care must be conducted, under the statute above. It is the text that decides what your platform may and may not do day to day.
- LGPD
- Health data is sensitive data under Brazilian law. It changes the legal basis, the retention window and what must be kept in the access log.
International
- HIPAA
- The US privacy and security rule for health data. It sets access control, audit trails, encryption and the business associate agreement with vendors.
- GDPR
- Legal basis for sensitive data in the EU, with access, rectification, portability and erasure implemented in the product itself — not handled by support.
- HL7 / FHIR
- The clinical interoperability standard. It is what lets you exchange data with another health system without a spreadsheet export in the middle.
BRDCO does not issue certifications. We build to these requirements, and when a project calls for a formal seal we run that process with the competent body.
What we build
for arcmed
Four products owned by Arcmed Tecnologia em Saúde, engineered end to end by BRDCO. The product is theirs; the system inside is what we show — click a card.
What people ask
about healthcare
Direct answers, including when the answer is no.
Are you SBIS certified?
No. SBIS certification is granted to a specific product, not to an agency. What we do is build to the CFM/SBIS requirements from the data model up, so the product is in a position to pass certification when you decide to pursue it — and we run that process with the body if needed.
What does Lei 14.510/2022 change for my platform?
It is the federal statute regulating telehealth in Brazil since December 2022 — above the medical council's resolution. In practice: every prescription, certificate or report issued from a remote record needs a qualified electronic signature on an ICP-Brasil certificate. If your platform issues clinical documents, that is not optional.
Can a record be 100% digital, with no paper?
Yes — that is exactly NGS2 in the CFM/SBIS handbook: NGS1's access control plus digital signature with ICP-Brasil. Without it, clinics print because the signature has no legal value; with it, paper stops being a requirement.
And LGPD — is there a certification?
There is no official LGPD certification: the ANPD accredits nobody to issue seals, and private badges carry no official validity. What exists is correct implementation — health data is sensitive data, which changes the legal basis, retention windows and what stays in the access log. That is how we build.
Let us look at your
case
30 minutes, no commitment. We work out the problem and tell you whether we can solve it — including when the answer is no.