Case · Sabará Hospital Infantil
A reference hospital cannot carry the risk of a third-party theme.
Sabará Hospital Infantil is a national reference in high-complexity paediatrics, with more than sixty years of history and a pioneer of JCI accreditation in Brazil. Its digital operation, however, ran on a WordPress installation: a performance score of 21 out of 100 on Google’s public measurement, reliance on third-party plugins for critical functions, and no clear separation between content, application and data.
Healthcare · High-complexity paediatrics
The starting point
Three problems that were
not about design.
- 01
Performance below acceptable
The largest content appeared in 6.5 seconds and the speed index hit 15.8. In paediatrics, the person searching is a family with a sick child, often on a phone and in a hurry.
- 02
Inherited risk surface
Essential functions depended on extensions maintained by third parties. Each one is a door the institution does not control, in an environment that handles health data.
- 03
Content trapped in the tool
Publishing an insurer, a plan, a doctor or a notice meant working around the limits of the theme. What the hospital wanted to say depended on what the template allowed.
Performance
21 to 95.
Measured by Google, not by us.
People searching for a children’s hospital are usually in a hurry, on a phone, and worried. Every second of blank screen is a family waiting. This is the one number in this case that anyone can verify alone, in thirty seconds, using Google’s public tool.
Public PageSpeed Insights measurement
before after
-
Performance
21 95
-
Accessibility
86 90
-
Best practices
65 96
-
SEO
85 100
And what the user feels
logarithmic scale
- FCP First contentful paint how long the screen stays blank5×
- LCP Largest contentful paint when the page looks ready4×
- TBT Total blocking time how long a tap goes unanswered51×
- SI Speed index how quickly the page completes13×
0.945 0.128
Measurements from PageSpeed Insights, Google’s public tool, on the hospital’s address. The bars use a logarithmic scale because the values span three orders of magnitude, from ten milliseconds to fifteen seconds: on a linear scale the blocking time would vanish and the figure would lose the metric that improved most. Layout shift appears separately because its unit is not time.
The gain
What the hospital
gained.
-
01
Publishing became trivial
A content editor built to fit the hospital. Insurers, plans, doctors, banners and notices are published by the team itself, on the spot, with an ease of adjustment and updating the operation had never had before.
-
02
An assistant that knows the hospital
An AI agent answers over a knowledge base of their own: it knows Sabará’s specialties, units, insurers and services. It is not a generic chat bolted onto the site, it is an attendant that studied the institution.
-
03
Data that shows up
Tags, events and analytics activated page by page. The hospital can now see what families look for, where they arrive from and where they give up, none of which was measured before.
-
04
Security on another level
Replacing WordPress with a platform of their own removed, at a stroke, the reliance on third-party extensions for critical functions. The gain in posture was the most significant of the project, and it is what matters most in an environment handling health data.
The references studied before designing
- SickKidsToronto
- Boston Children's HospitalBoston
- Children's Hospital ColoradoColorado
- Children's NationalWashington
Before designing anything, the portals of the internationally recognised children’s hospitals were studied. The pattern that repeats across all four is the same: the first thing the page offers is an action, not a news item. Book, find a doctor, see a result, talk to someone. The new Sabará home was built on that reading.
Security
The biggest gain of all
was the one nobody sees.
The assessment result sits with the hospital, and what it concluded is what is expected of an environment handling health data: compliance on every control examined.
-
A step change
Moving from an installation with third-party extensions in critical functions to a platform of their own changed the nature of the risk. There is no longer a door maintained by someone the institution does not know.
-
Assessed once already live
The platform went through a technical security assessment already in production, not in a test environment prepared for the occasion.
-
Verified by behaviour
Every control had to demonstrate that it worked against a real attempt. Appearing in a document was not enough to be considered in order.
-
Designed in, not patched on
Network isolation, server-side authorisation, the audit trail and data-subject consent went into the architecture, not into the eve of an audit.
Defence layers schematic: mixed traffic arrives on one side, with people and automated attempts. Four independent layers filter it: edge, authentication, authorisation and content. Each illegitimate attempt stops at one of them, and only legitimate traffic reaches the other side.
-
1Edge
Application firewall with a managed rule set, plus protection against overload at the origin.
-
2Authentication
Successive attempts are blocked, with the limit applied per client rather than in aggregate.
-
3Authorisation
Applied on the server. In the absence of a valid credential, the default behaviour is to deny.
-
4Content
Parameterised queries and active sanitisation, with legitimate editorial content preserved intact.
The operation
Our operation.
Their team.
The hospital’s digital operation is run by our team: campaigns, content, integration and the infrastructure underneath. Sabará did not need to build a technology department to have a digital presence at international standard, and that is the nature of the work.
Back to all casesAsk for a free assessment of your environment :)
A technical assessment of the current environment, with a direct read: what AI can automate, what needs a foundation first, and what is not justified at this point.