Tesserium Partners is a fractional CTO practice for digital health in the UK and US. We lead product and engineering where the clinical workflow, the billing rules and the patient data all have to be right.
Tesserium Partners Ltd
Registered in England and Wales
Company number 16868098
3 engagements and due diligence
Fee agreed before work starts
| Fractional CTO | 90-day sprint | Advisory | |
|---|---|---|---|
| Who it is for | For a health company with engineers or a delivery partner but no senior technical lead. | For one problem with a date on it, such as an audit finding to close, a module to ship or a certification to prepare for, with a team ready to take it on afterwards. | For founders, boards and investors who need a senior technical view every month without a hire. |
| What you get | A senior technical lead for around 8 days a month, working alongside your team and accountable for what ships.
| One defined piece of work with an agreed outcome, sized to fit 90 days.
| A senior technical view each month, independent of your team and your vendors.
|
| Term | 6 to 12 months | 90 days | 3 months minimum |
| How it runs | Email questions answered within 2 working days | ||
| How the fractional CTO role works | How a 90-day sprint works | How advisory works |
One-off
A one-off review of a health company's technology before you invest in it or buy it. A fixed fee, agreed before work starts, with no ongoing commitment.
Technical due diligence for investorsClient work, 2026
Clients named by sector only
What we were asked to fix, what we changed and where it stands.
Year:
Status checked
A US value-based care organisation wanted its care managers to run comprehensive medication reviews with patients who take several long-term medicines, and a clinical pharmacist to sign off every review.
The review spans 2 roles with different needs. Care managers need a structured form they can complete while on the phone with the patient. The pharmacist needs the whole patient chart, a queue of reviews waiting for sign-off, and a record of who approved each one.
We designed a medication review workflow for care managers and an approvals queue for a new clinical pharmacist role with full chart access, then led the build with the client's development partner. Each review records who completed it and who signed it off. Before release we reviewed the requirements, tests and user guide from clinical, product and engineering angles.
Live since September 2026.
11 standards
HITRUST and HITRUST CSF are registered trademarks of HITRUST. Tesserium is not affiliated with or endorsed by HITRUST.
The standards we build client work to, and what each one changes in the work. We hold no certification. Ask us to show the working behind any row.
| Standard | What we do | Source |
|---|---|---|
| US health | ||
| HIPAA Security Rule | Role-based access to patient records, idle sessions that close on their own, an audit log that answers “who saw this patient”, and encryption between systems. Health system security reviews test these first, so we write each one into the specification and its test plan. | 45 CFR 164.312(a), (b) and (e) |
| CMS care management billing | CMS rules for chronic, principal and advanced primary care management (CCM, PCM, APCM) and remote patient monitoring (RPM), written as requirements engineers can build and test, each tied to its CMS source. A rule built wrongly shows up later as denied claims, or money paid back after an audit. | Medicare Physician Fee Schedule |
| Preparing for HITRUST® certification | Which HITRUST certification fits, the gaps across code, cloud and suppliers, and a phased plan towards certification by an authorised assessor. Many large health systems ask a supplier for HITRUST before they sign. | HITRUST CSF, i1 assessment |
| Security: OWASP | ||
| OWASP ASVS | Security requirements written into each specification at the level agreed for the system, and checked before release. It gives a buyer's security team a recognised checklist to test against, in place of our word. | ASVS 5.0, at the level agreed for each system |
| OWASP Top 10 | Design and code review against OWASP's 10 most critical web application risks, from broken access control to software supply chain failures. | OWASP Top 10:2025 |
| OWASP API Security Top 10 | API design and review, so a signed-in user cannot reach another patient's record by changing an ID in a request. That flaw is first on OWASP's API list. | API Security Top 10:2023, API1 to API10 |
| OWASP MASVS | Mobile apps checked for how they store data on the phone, connect to the server and handle sign-in. Patient apps keep health data on phones the provider does not control. | MASVS v2.1 and the MASTG |
| OWASP Top 10 for LLM and agentic AI | AI features tested for prompt injection, leaks of patient data and an AI acting beyond its instructions. AI agents that take actions are also checked against the agentic list. | Top 10 for LLM Applications 2025; Top 10 for Agentic Applications for 2026 |
| OWASP SAMM | A baseline of how securely a team builds software, scored across governance, design, implementation, verification and operations. We take it in the first month and in due diligence, so a board or a buyer can see progress against it. | SAMM v2, 5 business functions |
| Accessibility | ||
| WCAG 2.2 AA | Interfaces we design are built to meet WCAG 2.2 AA, the level NHS services must meet. It also covers WCAG 2.1 AA, which US providers that take HHS funding and have 15 or more employees, community health centers among them, must meet from 11 May 2027. | WCAG 2.2 Level AA; 45 CFR 84.84; NHS service manual |
| UK | ||
| UK GDPR | Data protection designed in from the start: we map the data each feature needs, set how long it is kept, and write privacy notices from what the system does. Health data is special category data, so UK buyers test this closely. | UK GDPR Articles 5, 9 and 25 |
Daryn Shaxted leads every engagement. Tell us where the platform is and where it needs to be, or the decision you need a view on. No pitch deck needed.