Enabling Healthcare Data Security and Compliance with Impetus and AWS - Impetus

Enabling Healthcare Data Security and Compliance with Impetus and AWS

Chetan Kalanki, Global Head and Vice President of Engineering at Impetus, discusses the imperative for healthcare organizations to securely manage data, maintain application robustness, and comply with regulatory requirements to facilitate healthcare modernization.

How can healthcare organizations modernize with cloud solutions while considering healthcare regulations and standards?

Modernization is essential in healthcare to address challenges, improve patient outcomes, and enhance efficiency. Embracing modern technologies like electronic health records (EHRs) and telemedicine enables seamless access to patient information and remote consultations. Modernization strengthens data security measures and unlocks insights through advanced analytics and artificial intelligence (AI) applications. Interoperability and data exchange foster collaboration among healthcare providers. 

While considering healthcare regulations, cloud-based modernization can be managed at three levels: infrastructure, application, and data management. Infrastructure modernization offers speed, scalability, and agility. Application modernization involves breaking down monolithic systems into manageable services while integrating security measures. Data management focuses on unlocking data value, migration, and establishing data governance for insights and business growth. To modernize effectively with cloud solutions while considering healthcare regulations and standards, organizations should: 

  • Define goals for cloud modernization, considering efficiency, scalability, security, governance, and compliance.
  • Identify and mitigate risks associated with cloud modernization.
  • Prioritize security and compliance in cloud architecture design and implement robust controls like encryption, access management, and audit trails.
  • Utilize built-in security services from the chosen cloud service provider (CSP) with healthcare experience and regulatory compliance.
  • Evaluate healthcare-specific services offered by the CSP, ensure the Health Insurance Portability and Accountability Act (HIPAA compliance, and establish the necessary contracts to protect health information while onboarding an experienced tech partner for seamless implementation.
  • Begin with non-mission-critical systems or data for cloud migration to test security and compliance measures before transitioning critical components and migrating more critical data.
  • Continuously monitor and evaluate the cloud infrastructure to promptly address security and compliance issues and consider CIS benchmarking for a secure platform.
  • Engage healthcare regulation experts to guide the process, ensure compliance, and overcome challenges you may encounter more effectively.

How can you ensure the security, governance, and compliance aspects of deployment when working with modern data storage and data warehouse platforms?

Ensuring compliance with healthcare regulations like HIPAA and the General Data Protection Regulation (GDPR) is crucial for safeguarding data security and privacy. A governance framework and a customized security architecture should be established using HIPAA-compliant solutions. Robust measures must be implemented for handling personally identifiable information (PII) and protected health information (PHI). 

Managing structured, semi-structured, or unstructured data requires careful monitoring during transit and at rest. 

Impetus prioritizes data security by building modern data platforms and warehouse solutions in the Amazon Web Services (AWS) cloud, protecting sensitive data throughout its lifecycle. Some common patterns to build a healthcare-compliant secure platform on AWS start from leveraging cloud-native encryption services like Key Management  Service (KMS), data distributions across buckets, and AWS Identity and Access Management (IAM) policies for authorized access.

Integration of AWS Lake Formation with active directory enforces data governance rules, while Amazon Simple Storage Service (S3) provides a reliable foundation for data lakes with encryption and access control features. AWS Glue facilitates seamless data processing and movement, and Amazon Relational Database Service (RDS) offers managed services for structured data. Amazon Redshift is a petabyte-scale, fully managed data warehouse with built-in data protection and encryption. ML-based services like Amazon Macie aid in sensitive data discovery and protection. 

Restricting sensitive data access and minimizing exposure reduces the compliance footprint for auditing purposes. 

Impetus has successfully accelerated healthcare data availability and achieved significant performance improvements through best practices implementation in creating a scalable central data platform. While delivering success with data, we also ensure risk-free, automated transformation of legacy data warehouse, extract, transform, and load (ETL), analytics, and Hadoop to AWS and other native cloud platforms using our automated cloud migration accelerator, LeapLogic. With up to 95% automation, LeapLogic ensures end-to-end transformation and operationalization of all legacy workloads in the cloud with zero business disruption.

What solutions allow for that?

Healthcare applications require high availability, tolerance, and robustness due to their essential role in critical care, safety, and other related use cases. Interruptions or failures can have severe consequences. These applications must ensure continuous access to patient data, facilitate collaboration among healthcare professionals, and support emergencies. They must also maintain data integrity, security, and compliance with regulations. By being highly available and robust, healthcare applications enhance workflow efficiency, streamline processes, and optimize resource utilization. These qualities enable effective healthcare delivery, safeguarding patient well-being and improving healthcare outcomes. To support non-functional needs like availability, scalability, security, and governance, a well-designed architecture and strategy are essential. Regular reports on infrastructure utilization, application usage, and disaster recovery are necessary. Utilizing infrastructure as code with tools like Terraform and AWS services like AWS CodeDeploy and AWS CodePipeline streamlines provisioning, monitoring, and accessing operational metrics. Implementing these changes improves care continuity. Impetus has successfully automated infrastructure using AWS CloudFormation, achieved continuous integration and continuous delivery (CI/CD) setup for numerous use cases, and reduced recovery time from 5 days to up to 5 hours for leading U.S. organizations.


Chetan Kalanki
Global Head and Vice President of Engineering, Impetus

Choose a lab aligned to your Data & AI journey

Address your desired use case across critical analytic dimensions

  • Explore architecture options with experts

  • Ensure strategic alignment of business and technology

  • Architect an ideal solution for a pressing problem

  • Validate new or refactor existing architecture

  • Develop a prototype with expert guidance

  • Establish a roadmap to production

Learn more about how our work can support your enterprise