A hospital system will not hand your team a REST endpoint and an OpenAPI spec. It hands you a VPN tunnel, an HL7 v2 feed that breaks the day someone edits a form in Epic, and an integration desk that replies in five business days. Screening engineers for that world is a different exercise than screening for a SaaS product, and most interview loops are still built for the SaaS version.
TL;DR
- Healthtech integration work is not API work. HL7 v2 over MLLP, flat files on SFTP, and interface engines like Mirth Connect or Rhapsody still carry most clinical data in the US.
- Screen for failure handling, not framework knowledge. Message parsing, idempotency, reconciliation, and working without a vendor sandbox separate the profile in about 45 minutes.
- HIPAA changes hiring mechanics. PHI access needs a signed BAA in the chain, named accounts, and audit logs, which rules out the anonymous marketplace contractor.
- Adjacent domains are the shortcut. Payments reconciliation, fintech ledgers, X12 EDI, and claims processing produce engineers who already think in idempotency keys and break reports.
- Time zone overlap matters more here. A nightly ADT interface that fails at 2:40am is a same-morning conversation with a Bogota or Medellin engineer, not a next-day handoff.
What “no APIs” actually looks like day to day
The daily reality is pipe-delimited messages. An ADT^A08 arrives with a PID segment where the middle name has an unescaped pipe and your parser throws. An ORU^R01 carries a result in OBX-5 with units the sending system started populating differently last Tuesday. Much of the meaningful data lives in Z-segments, custom by definition, so the spec you were given is a hypothesis rather than a contract.
Then there is transport: MLLP over a site-to-site VPN, or a nightly SFTP drop of fixed-width files that lands at 1:15am and sometimes lands twice. No acknowledgment you can trust, no retry semantics, no status page. When a feed goes quiet, nobody pages you. You find out three days later when a clinic calls about missing results.
FHIR helps and is genuinely growing. The ONC Cures Act Final Rule pushed certified EHRs toward a standardized FHIR R4 API under the (g)(10) criterion with US Core profiles. Adoption is still partial: read access covers a slice of the record, write paths are limited, bulk export is uneven, and the v2 feeds keep running underneath.
The technical signals to test for
Drop the algorithm round. It tells you nothing about whether someone can survive an interface that fails silently. Use a 45 to 60 minute exercise built on a real message and a real failure.
- Message parsing under malformed input. Hand the candidate a raw HL7 v2 message with a broken escape sequence, a missing required segment, and an unexpected Z-segment. Watch whether they reject the message, quarantine it, or partially process it. The right answer depends on the segment, and good candidates say so.
- Idempotency. Ask what happens when the same ORU arrives three times with the same message control ID and once with a different one. Look for a natural key strategy, not a
SELECTbeforeINSERTinside a race. - Reconciliation. Ask how they would prove that 14,212 messages sent yesterday produced 14,212 rows. Strong candidates reach for daily counts, checksum files from the sender, and a break report someone reads.
- Error handling on unreliable feeds. What fires when a feed sends zero messages for six hours? Absence of data is the hardest alert to build and the one most people forget.
- Working without a sandbox. Ask how they would build against a spec, six de-identified sample messages, and one 30 minute call with the sending vendor. That is often all you get.
One behavioral signal matters more than the rest: does the candidate ask who owns the sending system? Engineers with real interface experience want to know who at the hospital they can call, because code is rarely the bottleneck.
The compliance layer, and how it constrains hiring
PHI access is a contractual question before it is a technical one. If your engineers touch production data, someone in the chain signs a Business Associate Agreement and subcontractors need equivalent terms flowed down. A freelancer paid through a marketplace, with no BAA and no entity to hold liable, is not a workable arrangement no matter how good the code is.
The controls are non-negotiable: named individual accounts, minimum necessary scope, MFA, audit logs recording who read which record and when, and same-day revocation at offboarding. Onboarding a nearshore engineer for PHI access means HIPAA training, a confidentiality agreement, a managed laptop or VDI session, and a documented access request. Budget 5 to 10 business days and start before the contract closes. Most integration development can run against de-identified data anyway, with production debugging gated behind a smaller audited group, and that single decision widens who you can hire.
Why the US profile is scarce and expensive
Healthtech integration knowledge is gated by employment. Epic certification is generally available only through sponsorship by an organization that runs Epic, so nobody self-teaches it on a weekend, and a softer version of the same gating applies to Cerner and Oracle Health, athenahealth partner integrations, and eClinicalWorks. The pool stays small and hospitals, payers, and health IT vendors recirculate it among themselves.
Price follows scarcity. In US metros, senior integration engineers with named EHR experience routinely command base offers in the $165,000 to $210,000 range, and independent Epic interface consultants bill well above that. Four to six months to close is common. Waiting for Epic plus Mirth plus FHIR plus HIPAA plus your exact stack is how a role stays open for two quarters.
Build the profile from adjacent domains
The transferable core is not healthcare. It is asynchronous, unreliable, high-consequence data movement between systems you do not control.
- Payments and settlement reconciliation. Engineers who match processor settlement files against internal ledgers already live in idempotency keys, break reports, and cutoff times.
- Fintech ledger work. Double-entry discipline, immutability, and replay safety map directly onto clinical event streams.
- X12 EDI. Anyone who has parsed an 837 claim or an 835 remittance is one vocabulary shift from HL7 v2. Both are segment-and-delimiter formats with implementation guides partners ignore selectively.
- Insurance claims processing. Eligibility checks, denials, and resubmission logic have the shape of clinical data reconciliation.
Plan for the ramp: roughly 4 to 6 weeks to productivity on HL7 v2 and an interface engine, paired with someone who already knows your feeds. That is cheaper than four more months of an open role.
Generalist screening vs. healthtech screening
| What generalist screening tests | What healthtech screening should test |
|---|---|
| Algorithm puzzles under time pressure | Parsing a malformed HL7 v2 message and deciding what to quarantine |
| Design a REST API for a greenfield service | Design ingestion when the partner only sends a nightly SFTP file |
| Happy path CRUD and framework fluency | Duplicate delivery, out-of-order messages, replayed batches |
| P99 latency optimization | Detecting a feed that has sent nothing for six hours |
| “How do you handle ambiguity?” | “Build against this spec with no sandbox and six sample messages” |
How nearshore LATAM hiring changes the math
Overlap is the operational argument. Interfaces fail on hospital schedules: overnight batch windows and early morning clinic starts. An engineer in Colombia, Mexico, Peru, or Argentina sits within one to three hours of US Eastern time, so a 2:40am failure gets triaged before the 8am clinic opens instead of at the start of someone else’s workday twelve hours later.
Decide the engagement structure early. Contractor arrangements start faster and work fine for engineers building only against de-identified data. EOR employment is cleaner when the engineer needs production PHI access: an employment relationship, enforceable confidentiality terms, device management, and an audit trail tied to a named individual. If you use a staffing partner, confirm they will sign a BAA and flow the terms down before you start interviews, not after you pick a finalist.
A LATAM search for an integration-capable engineer sourced from adjacent domains typically produces a shortlist in 2 to 3 weeks and a signed start in 4 to 6, plus the compliance onboarding window. One caution: this is not arbitrage. The engineers worth hiring here are senior, they know what interface work is worth, and you should pay at the top of the local band for the ones who show the instincts above.
Frequently Asked Questions
Do I need someone with Epic experience specifically?
Usually not. Epic-specific knowledge is mostly the vendor's processes and interface conventions, learnable in weeks by an engineer who already understands HL7 v2 and reconciliation. Insisting on it shrinks your pool by an order of magnitude and adds months to the search.
Can a nearshore engineer legally access PHI?
Yes, with the right contractual structure. HIPAA restricts access by safeguards and agreements, not by geography: a signed BAA in the chain, minimum necessary access, named accounts, MFA, and audit logging. Many teams cut exposure further by keeping most development on de-identified data.
How do I test HL7 skills if the candidate has never touched HL7?
Test the underlying reasoning. Give an X12 837 fragment or a settlement file with a duplicate record and ask how they would ingest it safely and reconcile counts. Candidates who handle that will handle HL7 v2 after a short ramp.
What is a realistic ramp for an engineer coming from fintech or EDI?
Plan for 4 to 6 weeks to independent work on an interface engine and a first production feed, assuming they are paired with someone who knows your channels. Add time if PHI access onboarding has not started in parallel.
Should I hire a contractor or use an EOR for this role?
Contractor works for de-identified development and short scoping engagements. Use an EOR when the engineer needs production PHI access or a managed device, or is expected to stay past six months, because you get enforceable confidentiality terms and an audit trail tied to a named employee.
Is FHIR going to make this problem go away?
Not soon. FHIR R4 adoption under the ONC certification requirements is real and expanding, but coverage is partial, write access is limited, and hospital operations still run on HL7 v2 feeds nobody is in a hurry to decommission. Hire for both and assume the v2 feeds outlive your current roadmap.
