Home/Technology/Cloud Architecture
AWS HIPAA-eligible · 99.9% uptime SLA · Multi-AZ

HIPAA-eligible AWS architecture, documented.

Healthcare security reviewers want to see the architecture diagram, the controls matrix, and the sub-processor list. They do not want marketing language about being "secure" or "enterprise-grade". This page is the public summary. Under NDA, we ship the full packet built for compliance officers, mapped clause-by-clause to 45 CFR 164.312, with the penetration test summary and DR drill log included.

AWS HIPAA-eligible services only Signed AWS BAA Quarterly DR drills, logged
The four layers

One foundation. Four layers. Documented.

Every ASP-RCM product runs on the same architecture. The AI Suite tools, CredPro credentialing, the Reporting Studio, the Exception Hub, the AR Workflow tool, the HCC dashboard. One IAM layer, one audit trail, one set of BAAs, one DR drill cadence. New products do not bring new compliance debt; they inherit the controls.

The diagram is a public summary. The detailed version, with VPC subnetting, security group rules, KMS key policies, and IAM trust relationships, ships under NDA as part of the security packet. A senior partner attends the security review call.

Production architecture · us-east-1 + us-east-2
Layer 01 · Edge
CloudFront + AWS WAF
CDN absorbs edge traffic, WAF enforces OWASP Top 10, geo-blocking, and rate limiting. TLS 1.2+ termination at edge. Static assets served from S3 origin.
Layer 02 · Compute
ECS Fargate across two AZs
Serverless container compute. Auto-scaling target tracking. Private subnets only. No public IPs on tasks. Health checks every 30 seconds with automatic task replacement.
Layer 03 · Data
RDS Multi-AZ Postgres + S3
RDS Postgres with synchronous standby across AZs. Sub-minute failover. PITR 7-day window. S3 buckets with versioning, cross-region replication, KMS encryption.
Layer 04 · Identity
IAM least-privilege + Secrets Manager
All secrets in AWS Secrets Manager, retrieved at runtime via IAM-scoped roles. CloudTrail audit logging plus application phi_access_log table. RS256-signed access tokens.
The capabilities

Six controls. Documented and tested.

Every control here is in production today and ships across every ASP-RCM product. The controls are not aspirational, not roadmap, not "coming in Q3". They are running right now, audited, and verifiable in a security review.

01 · AWS HIPAA-eligible

Signed BAA with AWS.

Production uses only AWS HIPAA-eligible services. The AWS Business Associate Addendum is signed and on file. Service list, sub-processor inventory, and BAA status are all documented and shared under NDA during a security review.

02 · ECS Fargate compute

Multi-AZ, auto-scaled.

Serverless container compute deployed across two availability zones. Target tracking auto-scaling absorbs load spikes without manual intervention. Health checks every 30 seconds with automatic task replacement. No public IPs on application tasks.

03 · RDS Multi-AZ Postgres

Sync standby, PITR 7-day.

Postgres in Multi-AZ configuration. Synchronous standby in a second AZ with sub-minute failover. Point-in-time recovery enabled with a 7-day window. Daily encrypted snapshots replicated cross-region. KMS customer-managed keys.

04 · CloudFront + WAF

Edge protection, OWASP rules.

CloudFront fronts the API and absorbs edge traffic. AWS WAF enforces OWASP Top 10, geo-blocking, and per-IP rate limiting. TLS 1.2+ termination. Origin access locked to the CloudFront distribution. VPC flow logs ship to CloudWatch with 90-day retention.

05 · Secrets Manager

No env vars hold secrets.

All database credentials, third-party API keys, and signing keys live in AWS Secrets Manager. Application code retrieves secrets at runtime via IAM-scoped roles. 90-day rotation cadence for database creds, 180-day for third-party API keys. Logging library enforces secret redaction.

06 · IAM least-privilege

Roles, not shared keys.

Every service principal carries a scoped IAM role. No long-lived access keys in code or containers. Cross-account access uses STS assume-role with session tagging. Audit trail via CloudTrail. Application-level PHI access logged to the phi_access_log table with reviewer identity and reason.

The stack

The AWS services we actually use.

Not the marketing list. The actual service inventory that production depends on, grouped by layer. Every service in this list is on the AWS HIPAA-eligible roster.

Compute + Network

Edge through to runtime
CloudFrontCDN, TLS termination, edge caching
AWS WAFOWASP Top 10, geo-block, rate limit
Route 53DNS, health-checked failover
ECS FargateServerless container compute, Multi-AZ
ALBApplication load balancer, sticky sessions off
VPC + NAT GWPrivate subnets, flow logs to CloudWatch

Data + Storage

PHI at rest, encrypted
RDS PostgresMulti-AZ, sync standby, PITR 7-day
S3Versioning, KMS encryption, cross-region replication
ElastiCacheRedis, encryption in transit, session store
SQSWorker queue, dead-letter queue, encrypted
EventBridgeCross-service event bus, schedules
KMSCustomer-managed keys, automated rotation

Identity + Audit

Who did what, when
IAMLeast-privilege roles, no shared keys
Secrets ManagerRuntime secret retrieval, rotation
CloudTrailAPI call audit, 365-day retention
CloudWatchMetrics, logs, alarms, dashboards
GuardDutyThreat detection on VPC, S3, IAM
ConfigResource compliance drift detection
How a deploy runs

Four steps. Zero downtime.

Production deploys happen multiple times a week. Here is the pipeline from commit to traffic shifted to the new task set.

Step 01

Build + scan.

CI builds the container image, runs unit and integration tests, scans for vulnerabilities (npm audit, trivy), and tags the image. Failing scans block the deploy. Signed image manifest pushed to ECR.

Step 02

Deploy to staging.

ECS deploys the new task definition to staging. Smoke tests run against staging API. Database migrations apply in expand-contract pattern. Rollback automatic on smoke-test failure.

Step 03

Shift production traffic.

Production task set shifts from old to new with rolling deploy. ALB drains in-flight connections. Health checks gate the shift. Zero downtime observed across the last 12 months of measured deploys.

Step 04

Verify + watch.

CloudWatch alarms watch error rate, latency, and 5xx for 15 minutes post-deploy. PagerDuty wired to alarm breaches. If anything trips, rollback runs automatically and the on-call senior partner is paged.

What the architecture delivers

Measured. Not aspirational.

Production telemetry, last 12 months. Numbers come from CloudWatch metrics and DR drill logs.

99.97%
Measured uptime, last 12 months
Against the 99.9% SLA. Equivalent to 13 minutes of unplanned downtime per month on average. Multi-AZ Postgres failover, Fargate task replacement, and CloudFront edge buffering carry the production API through routine AZ disruption without customer-visible impact.
4hr
Recovery time objective
Tested quarterly: restore from cross-region snapshot into an isolated VPC, verify schema integrity, replay recent transactions, time the restore. Last four DR drills all completed under 3 hours 40 minutes. The drill log is part of the NDA security packet.
15min
Recovery point objective
Multi-AZ synchronous standby plus point-in-time recovery enabled with a 7-day window. Worst-case data loss in a full-region failure scenario is 15 minutes of transaction log. For the routine AZ failure scenarios, RPO is effectively zero due to synchronous replication.
Security review questions

What compliance officers ask.

Is the platform HIPAA compliant?
The platform runs on AWS HIPAA-eligible services under a signed AWS Business Associate Addendum. Technical safeguards covered by 45 CFR 164.312 are documented: AES-256-GCM encryption at rest, TLS 1.2+ in transit, RS256-signed access tokens, IAM least-privilege, immutable audit logging via CloudTrail and a phi_access_log table, and role-based access control. Administrative and physical safeguards (workforce training, sub-processor BAAs, breach response runbook) are part of the broader program. HIPAA compliance is an organizational state, not a checkbox; the technical controls we ship are the foundation that lets a HIPAA program work.
What does 99.9% uptime SLA actually mean in practice?
It means a maximum of 43 minutes of unplanned downtime per month, measured against the production API and the worker queues. The architecture that supports it: ECS Fargate services deployed across two availability zones with target tracking auto-scaling, RDS Postgres in Multi-AZ configuration with synchronous standby and sub-minute failover, S3 with cross-region replication for static assets and backups, and CloudFront in front of the API to absorb edge traffic. Health checks run every 30 seconds and route around degraded tasks automatically.
Where does the data live and is it ever transferred internationally?
All production data lives in AWS us-east-1 and us-east-2 with cross-AZ replication. No PHI leaves the United States. Backups are encrypted with KMS-managed customer keys and replicated within US regions only. Sub-processors (logging, monitoring, error reporting) are all US-based and operate under signed BAAs. The list of sub-processors is documented and updated on contract renewal.
How are secrets and credentials managed?
AWS Secrets Manager holds all database credentials, third-party API keys, and signing keys. Application code retrieves secrets at runtime via IAM-scoped roles, never via environment variables baked into container images. Secret rotation runs on a 90-day cadence for database credentials and 180-day for third-party API keys. Application logs never contain raw secret values; redaction is enforced at the logging library layer.
What is the backup and disaster recovery posture?
Daily encrypted snapshots of RDS, replicated to a second AWS region. Point-in-time recovery is enabled with a 7-day window. S3 buckets carry versioning and cross-region replication. We run a documented DR drill quarterly: restore from a snapshot into an isolated VPC, verify schema integrity and a sample of recent transactions, and time the restore. Recovery Time Objective is 4 hours; Recovery Point Objective is 15 minutes.
How is the network secured?
Production VPC is private; public subnets carry only the load balancer and NAT gateway. ECS tasks run in private subnets with no public IP. CloudFront sits in front of the API with AWS WAF rules covering OWASP Top 10, geo-blocking, and rate limiting. Database security groups allow ingress only from the application security group. VPC flow logs are enabled and shipped to CloudWatch for 90-day retention.
How does this connect to CredPro and the rest of the AI Suite?
All ASP-RCM products run on the same architecture. CredPro (credentialing platform) shares the IAM, audit logging, Secrets Manager, and RDS Multi-AZ foundation. The AI Suite tools (eligibility, prior auth, claim status, denial management, posting, coding) call into the same LLM gateway with rate limiting, prompt versioning, and per-tenant cost attribution. One audit trail, one identity layer, one HIPAA-eligible foundation. See the credentialing page for how PHI-at-rest encryption and the phi_access_log table work in practice.
Can you provide the architecture diagram and the controls documentation to a prospect security team?
Yes. Under a mutual NDA we share the architecture diagram, the controls matrix mapped to 45 CFR 164.312, the sub-processor list with BAAs, the penetration test summary, the incident response runbook, and the DR drill log. The packet is built for healthcare security reviewers and answers the questions a prospect compliance officer is going to ask before they answer them. An ASP-RCM senior partner attends the security review call.

Send your security review checklist. We send back the controls matrix.

Drop your vendor security questionnaire, your HIPAA technical safeguards checklist, or your SOC 2-style control inventory. Under NDA we return a clause-by-clause response mapped to 45 CFR 164.312, with the architecture diagram, sub-processor list, pen test summary, and DR drill log. A senior partner on the call.