HIPAA-eligible AWS architecture, documented.
Healthcare security reviewers want to see the architecture diagram, the controls matrix, and the sub-processor list. They do not want marketing language about being "secure" or "enterprise-grade". This page is the public summary. Under NDA, we ship the full packet built for compliance officers, mapped clause-by-clause to 45 CFR 164.312, with the penetration test summary and DR drill log included.
One foundation. Four layers. Documented.
Every ASP-RCM product runs on the same architecture. The AI Suite tools, CredPro credentialing, the Reporting Studio, the Exception Hub, the AR Workflow tool, the HCC dashboard. One IAM layer, one audit trail, one set of BAAs, one DR drill cadence. New products do not bring new compliance debt; they inherit the controls.
The diagram is a public summary. The detailed version, with VPC subnetting, security group rules, KMS key policies, and IAM trust relationships, ships under NDA as part of the security packet. A senior partner attends the security review call.
Six controls. Documented and tested.
Every control here is in production today and ships across every ASP-RCM product. The controls are not aspirational, not roadmap, not "coming in Q3". They are running right now, audited, and verifiable in a security review.
Signed BAA with AWS.
Production uses only AWS HIPAA-eligible services. The AWS Business Associate Addendum is signed and on file. Service list, sub-processor inventory, and BAA status are all documented and shared under NDA during a security review.
Multi-AZ, auto-scaled.
Serverless container compute deployed across two availability zones. Target tracking auto-scaling absorbs load spikes without manual intervention. Health checks every 30 seconds with automatic task replacement. No public IPs on application tasks.
Sync standby, PITR 7-day.
Postgres in Multi-AZ configuration. Synchronous standby in a second AZ with sub-minute failover. Point-in-time recovery enabled with a 7-day window. Daily encrypted snapshots replicated cross-region. KMS customer-managed keys.
Edge protection, OWASP rules.
CloudFront fronts the API and absorbs edge traffic. AWS WAF enforces OWASP Top 10, geo-blocking, and per-IP rate limiting. TLS 1.2+ termination. Origin access locked to the CloudFront distribution. VPC flow logs ship to CloudWatch with 90-day retention.
No env vars hold secrets.
All database credentials, third-party API keys, and signing keys live in AWS Secrets Manager. Application code retrieves secrets at runtime via IAM-scoped roles. 90-day rotation cadence for database creds, 180-day for third-party API keys. Logging library enforces secret redaction.
Roles, not shared keys.
Every service principal carries a scoped IAM role. No long-lived access keys in code or containers. Cross-account access uses STS assume-role with session tagging. Audit trail via CloudTrail. Application-level PHI access logged to the phi_access_log table with reviewer identity and reason.
The AWS services we actually use.
Not the marketing list. The actual service inventory that production depends on, grouped by layer. Every service in this list is on the AWS HIPAA-eligible roster.
Compute + Network
Data + Storage
Identity + Audit
Four steps. Zero downtime.
Production deploys happen multiple times a week. Here is the pipeline from commit to traffic shifted to the new task set.
Build + scan.
CI builds the container image, runs unit and integration tests, scans for vulnerabilities (npm audit, trivy), and tags the image. Failing scans block the deploy. Signed image manifest pushed to ECR.
Deploy to staging.
ECS deploys the new task definition to staging. Smoke tests run against staging API. Database migrations apply in expand-contract pattern. Rollback automatic on smoke-test failure.
Shift production traffic.
Production task set shifts from old to new with rolling deploy. ALB drains in-flight connections. Health checks gate the shift. Zero downtime observed across the last 12 months of measured deploys.
Verify + watch.
CloudWatch alarms watch error rate, latency, and 5xx for 15 minutes post-deploy. PagerDuty wired to alarm breaches. If anything trips, rollback runs automatically and the on-call senior partner is paged.
Measured. Not aspirational.
Production telemetry, last 12 months. Numbers come from CloudWatch metrics and DR drill logs.
What compliance officers ask.
Is the platform HIPAA compliant?
What does 99.9% uptime SLA actually mean in practice?
Where does the data live and is it ever transferred internationally?
How are secrets and credentials managed?
What is the backup and disaster recovery posture?
How is the network secured?
How does this connect to CredPro and the rest of the AI Suite?
Can you provide the architecture diagram and the controls documentation to a prospect security team?
Send your security review checklist. We send back the controls matrix.
Drop your vendor security questionnaire, your HIPAA technical safeguards checklist, or your SOC 2-style control inventory. Under NDA we return a clause-by-clause response mapped to 45 CFR 164.312, with the architecture diagram, sub-processor list, pen test summary, and DR drill log. A senior partner on the call.