HIPAA care records and Medi-Cal billing for community doulas
Doula Care Portal: UX Case Study
Community doulas can now bill Medi-Cal, but the billing was built for clinics, not for a doula between births. I designed and built a HIPAA-compliant portal where a doula logs a visit in plain language and the system turns it into a compliant claim.
- Role
- Product designer and developer (sole), contract
- Timeline
- October 2025 to present, live
- Tools
- React, TypeScript, Supabase (Postgres, row-level security), Lovable
- accounts across 5 community birth organizations, as of Sept 3, 2026
- 56
- roles, each with its own access enforced in the database
- 5
- claim per client, batched from visits, CMS-1500 generated
- 1
At a glance
- Problem
- Medi-Cal pays community doulas now, but its billing was built for clinics with billing staff.
- Solution
- One portal from intake to claim: doulas log visits in plain language and the system writes the compliant claim.
- Outcome
- 56 accounts across five community birth organizations as of September 2026.
Recreated with sample data. No real clients, doulas or organizations.
Context
Care Medi-Cal now pays for, on a system built for clinics
California's Medi-Cal now covers doula care: prenatal visits, support during labor and postpartum visits. For community doulas that should mean steady income for work they already do. In practice, billing Medi-Cal means codes, visit limits per pregnancy, eligibility checks and claim forms designed for clinics with billing staff.
A Bay Area birth-justice nonprofit that matches families with community doulas asked me to build the platform that would let its doulas get paid. I was the only designer and developer, working weekly with the nonprofit's leadership from October 2025.
The brief centered Black doulas and doulas serving underserved communities, and its goal was billing support that kept them independent: their own clients, their own records, their own relationships with families. That became a product requirement. A doula sees her own clients, visits and claims, and chooses whether to bill through the portal at all; billing tools unlock only after she picks the billing plan and signs a billing agreement. Admins get enough oversight to support the work, and when they look at a doula's screen it's read-only.
The Problem
Make Medi-Cal billing invisible, without hiding the rules
Client sign-ups lived in Google Forms and email, and the information involved is protected health information. The rules couldn't be simplified away: every visit has a code, every pregnancy has caps, and every claim has to survive an audit. The design problem was making a doula's day feel like care work while the system did the compliance work underneath.
- prenatal and postpartum visits
- 8
- One shared pool per pregnancy
- initial visit, labor and delivery
- 1 + 1
- Per pregnancy
- extended postpartum visits
- 2
- Billed in 15-minute units
- claim form per submission
- CMS-1500
- With HCPCS and ICD-10 codes
The Medi-Cal doula benefit rules the portal tracks per client.
The Service
Billing starts before the first visit
I treated intake, visit documentation and claim preparation as one workflow, not three features. Each step has to hand the next person what they need: the client supplies insurance and signs consent, the doula documents care, and the biller turns both into a claim without chasing anyone for a member ID.
Client, on a phone
Insurance2 of 4EligibilityPending reviewPlanMedi-Cal planMember ID•••• 4821Card frontCard backWorking with another doula who bills insurance?
YesNoIntake collects the billing inputs once. Insurance, card photos and Medi-Cal ID are saved step by step. The other-doula question is there because Medi-Cal's visit limits are shared across every doula billing for the same pregnancy.
Doula
Sample client
Intake formEmailed, not back yetConsent signedYesSecondary insuranceNoAnother doula: 2 visits used. The cap may be partly used. Coordinate before billing.Email againCopy linkIntake answers come back as warnings. What the client reported shows up on the doula's record before she bills: another doula's visits may have used part of the cap, and secondary insurance changes the billing order. If the intake email goes unanswered, she copies the link and texts it.
Doula
Log a visit
TypePostpartumDuration60 minVisitVideoBilled as Z1038 · modifier 95Log visitCare details become billing codes. The doula picks a visit type, date, length and whether it was in person, by video or by phone. The portal assigns the code, and remote visits get the matching telehealth modifier.
Biller
Claim
SubmittedPlanMedi-Cal plan ⧉Member ID•••• 4821 ⧉CodeZ1038 · 95 ⧉ApproveDenyCMS-1500Filed with the payer? Attach receiptThe claim is assembled from the steps before it. Plan and member ID come from intake, the code and modifier from the visit. Every field is click-to-copy into the payer's portal. After filing there, the biller attaches the submitted form so the doula keeps her own copy for audits.
Recreated as wireframes with sample data. Fields and statuses match the shipped portal; no real clients or doulas.
Your doula care journey
The family's side is built for a phone, and for care
Clients sign in on their phones to finish intake and consent, see their upcoming visits and follow where they are in the pregnancy. Their roadmap counts down the same pool of eight visits their doula bills against, without a single billing code on screen.
Real use shaped it. When a user reported that visit names were squeezed off narrow screens, I stacked those rows on phones and cut an indent that had left about 230px of usable width on a 375px screen.
Client roadmap recreated with sample data.
Decisions
Five calls I made, and what I turned down
Show the visit cap before the visit, and warn instead of blocking
Medi-Cal pays for a fixed number of visits per pregnancy, and prenatal and postpartum visits share one pool of eight. I put the pool on every client as a row of boxes that turns amber at half, orange at 80% and red when it's used up, so a doula sees the limit while planning, not when a claim is denied. Over the cap, the visit still logs and is flagged for an extra authorization.
Rejected: Blocking the visit at the cap. A doula supporting someone in labor can't stop for paperwork, and an authorization can follow the visit.
Separate what an auditor sees from what the doula keeps
With a single notes field, a doula has to guess what an auditor will read. I split notes into three: a short claim note that is visible on audits, structured notes from templates the state requires, and private notes that are never attached to a claim. Each field says who will read it.
Rejected: A single rich-text notes field. Simpler to build, and it made every doula guess what counted as part of the medical record.
Doulas log visits; the system writes the claim
Doulas are care workers, not billers. They log a visit in plain language (type, date, duration, in person or remote) and the portal fills in the HCPCS and ICD-10 codes. Completed visits batch into one claim per client, and the CMS-1500 is generated for them to preview.
Rejected: Asking doulas to fill in a CMS-1500 directly. It mirrors the payer's form and assumes billing training most doulas don't have.
Make the existing billing process workable first
For the first phase I scoped the portal to what the organization could run right away: collect the documents, record visits, prepare the CMS-1500 and track each claim to paid. Submitting to payers and handling payment stayed outside it, so the biller's screen is built for the handoff. Every field is click-to-copy for retyping into the payer's portal, each claim shows its age with flags at 20 and 30 days so nothing drifts past a filing deadline, and after filing the biller attaches the submitted form for the doula's records. A denial needs a reason the doula can act on.
Rejected: A clearinghouse integration and payments in phase one. Better long term, and it would have held billing back while billers kept retyping claims by hand with no help.
Make security part of the flow, not a gate in front of it
Two-factor sign-in for admins, billers and doulas, with an authenticator app or an emailed code for anyone who doesn't use one. Sessions lock after 15 minutes idle with a two-minute warning, files open through short-lived links, and admins can view a doula's screen read-only for support, under a banner that stays on top of every dialog.
Rejected: Shared logins and letting admins edit as a doula. Faster support, and no way to say who changed a patient's record.
Interactive Prototype
Log a visit, then bill it
A recreation with sample data. Try it in this order:
- As the doula, look at the caps: with one of eight prenatal and postpartum visits left, the warning is already showing.
- Log a postpartum visit to use the last one, then log another: it still logs, flagged for an authorization.
- Create a claim from the visits, then switch to Biller: copy fields, approve, or deny (a reason is required). Every step lands in the audit trail.
Recreated with sample data to show the design decisions. No real clients, doulas or organizations. Not the production UI.
Dependencies
The intake flow depended on decisions outside the interface
By November 2025 the intake and signature flows worked, but three documents clients would sign didn't exist yet: the Billing Expectations Notice, the Emergency Referral Consent and the doula contract. No screen could fix that.
I took one question into the next stakeholder meeting: who writes these, and who arranges their legal review? The organization's Program Manager took ownership, and all three are now live in the client portal. Each is signed on its own, with the date it was signed, and shows the client as pending until then.
- Billing Expectations Notice
- Medi-Cal's visit limits, including that visits with another doula count toward the same total, and keeping coverage active.
- Owner: Program Manager · Live, signed separately
- Emergency Referral Consent
- The doula may call 911 or the client's provider in an emergency; the client keeps every medical decision.
- Owner: Program Manager · Live, signed separately
- Doula contract
- What the client and the doula each commit to, cancellation notice and how either side ends the agreement.
- Owner: Program Manager · Live, signed separately
| Document | What the client agrees to | Owner | Status |
|---|---|---|---|
| Billing Expectations Notice | Medi-Cal's visit limits, including that visits with another doula count toward the same total, and keeping coverage active. | Program Manager | Live in the client portal, signed separately |
| Emergency Referral Consent | The doula may call 911 or the client's provider in an emergency; the client keeps every medical decision. | Program Manager | Live in the client portal, signed separately |
| Doula contract | What the client and the doula each commit to, cancellation notice and how either side ends the agreement. | Program Manager | Live in the client portal, signed separately |
Access
Five roles, each enforced in the database
Hiding a button isn't access control. Each role's limits are enforced by row-level security in the database, so a doula's session can't read another doula's clients even through the API, and no one can raise their own role.
- Doula
- Their own clients, visits and notes. Billing tools unlock with the billing plan and a signed billing agreement.
- Biller
- The claims queue and the client details a claim needs. No admin settings.
- Admin
- Everything, including verifying doulas, transfers between doulas and reports for the state. Changing someone's role goes through a checked server function.
- Client
- Their own visit roadmap, consent forms and upcoming visits.
- Apprentice doula
- Only the clients and visits a mentor has shared with them.
- Across staff roles
- Two-factor sign-in, a lock after 15 minutes idle with a two-minute warning, and documents that open through links that expire within minutes.
Outcome
56 accounts across five community birth organizations
56 accounts across the founding nonprofit and four other community birth organizations as of September 3, 2026, and still growing. Doulas log visits and generate claims without touching a billing form, and every claim action is logged. There is no baseline for billing time before launch.
What I Learned
In healthcare, design decides who sees what
In healthcare the hardest design work is deciding what each role must never see. Row-level security made those decisions real instead of hiding buttons.
A rule the user can see early beats a rule that blocks them late. Visit caps warn from 80% so authorization can be sorted before the visit, not after the denial.
Billers don't need a prettier form; they need fewer keystrokes into the payer's portal. Click-to-copy and claim age did more than any redesign.
Hindsight
What I'd do differently
Log when an admin starts viewing as a doula. Today that view is read-only and clearly bannered, but starting it isn't written to the audit trail.
Measure claim turnaround from day one. The queue flags claims at 20 and 30 days, but there's no before-launch baseline to compare against.
Next project
EBT FinderHiring for a senior UX role?