SihaTech: GDPR-Compliant AWS Infrastructure for Digital Health at Scale

Customer: SihaTech
ACE Opp ID: 551452214208
Industry: Digital Health / Patient Data Management
Solution Area: Secure, Compliant, and Scalable Cloud Infrastructure on AWS

1. Executive Summary

SihaTech is a digital health platform that manages sensitive medical records, patient data, and healthcare workflows. With growing adoption and increasing regulatory requirements (GDPR, CNDP), SihaTech needed a secure, compliant, and scalable cloud infrastructure capable of protecting sensitive medical data while maintaining high availability and operational efficiency.

To meet these requirements, SihaTech partnered with Atomic Computing, leveraging AWS best practices for governance, security, and automation. The solution utilizes services including AWS Amplify, Amazon EKS, ALB, RDS (PostgreSQL Multi-AZ), S3 with KMS encryption, and ECR, providing a secure, compliant, and cost-efficient environment for development and production workloads.

As a result, SihaTech now operates on a secure, highly available, and governed AWS infrastructure that supports sensitive healthcare operations while ensuring compliance with international privacy standards.

2. Customer Background

SihaTech provides a platform for healthcare professionals to manage patient information, medical records, and workflows securely. The platform stores structured data such as:

• User profiles
• Patient metadata
• Document references
• Access permissions
• Audit logs 

As the platform scaled, the organization required a cloud architecture that could:

• Securely manage sensitive medical data
• Comply with GDPR/CNDP regulations
• Support scalable workloads in development and production
• Provide centralized operational visibility
• Reduce operational overhead through automation

Atomic Computing was engaged to build a secure, multi-account AWS environment aligned with governance and compliance standards.

3. Customer Challenges

Before the engagement, SihaTech faced multiple infrastructure and governance challenges:

3.1 Security and Compliance
Handling sensitive medical data required robust security and encryption practices. The platform needed full compliance with GDPR and CNDP, including data residency and encryption standards.

3.2 Lack of Centralized Governance
There was a need for a structured multi-account environment to separate development, production, and management workloads while enforcing policies consistently.

3.3 Limited Operational Visibility
Monitoring of infrastructure activity, configuration changes, and potential security threats was insufficient, increasing compliance risk.

3.4 Scalable and Resilient Infrastructure
The platform required high availability, disaster recovery readiness, and support for auto-scaling workloads.

3.5 Operational Efficiency
Manual deployment and management processes increased operational overhead and the risk of misconfiguration. Automation and Infrastructure-as-Code practices were required.

4. Solution Overview

Atomic Computing designed a secure AWS cloud environment for SihaTech focused on governance, compliance, and automation, while ensuring cost efficiency in development environments.

Key components include:

• Multi-account architecture using AWS Control Tower (Management, Audit, Log Archive, Development, Production)
• Secure backend infrastructure: ALB, EKS microservices, RDS PostgreSQL Multi-AZ, S3 KMS-encrypted medical files
• Continuous monitoring and observability using CloudWatch and CloudTrail
• Centralized access management with least-privilege IAM roles and IAM Identity Center. 

This solution provides a secure, resilient, and scalable environment capable of supporting sensitive healthcare workloads.

5. Solution Architecture

Multi-Account AWS Environment

• AWS Control Tower deployed for account governance
• Accounts for Management, Audit/Log Archive, Development, and Production
• Organizational Units enforce the separation of duties and centralized policies (Security and Sandbox for application).
• Control Tower guardrails ensure consistent security compliance
  
  

Identity and Access Management

• Centralized IAM roles and policies with least-privilege principles
• MFA for privileged access
• Secure role-based access to EKS, RDS, and S3 resources
  
  

Application Architecture

• Frontend: Hosted via AWS Amplify (web app)
• Backend: Microservices running on Amazon EKS
• ALB: Public-facing load balancer with path-based routing
  
  

Data Storage:

• Amazon S3 for medical files (KMS-encrypted, versioned, public access blocked)
• Amazon RDS PostgreSQL Multi-AZ cluster for structured data (user profiles, metadata, audit logs)
  
  

Operational Monitoring & Compliance

• CloudWatch dashboards for EKS and RDS metrics
• CloudTrail logging for auditability
• Alerts and notifications configured via SNS
• Automated backups and performance insights enabled

Infrastructure Automation

• Terraform/IaC templates for repeatable deployments
• Enables quick redeployment and disaster recovery
• Consistent configuration across environments
  

6. Security & Compliance Controls

Preventive Controls

• KMS encryption for all storage
• Block public access policies for S3
• IAM least-privilege policies

Detective Controls

• CloudWatch monitoring and alarms
• CloudTrail for all API activity
• Centralized audit logs

Corrective Controls

• Automatic remediation for misconfigurations
• Enforcement of encryption for storage

7. Operational Governance

Key metrics tracked include:

These metrics ensure continuous visibility into security posture and operational governance.

8. Business Outcomes

Improved Security Posture

• Layered security controls and centralized monitoring protect sensitive medical data

Compliance Assurance

• Alignment with GDPR, CNDP, ISO security best practices, and HIPAA requirements for handling sensitive healthcare and patient data

Operational Efficiency

• Automation reduces manual effort and configuration drift

Scalable Cloud Platform

• Supports development and production workloads with controlled costs
• Frontend deployment via Amplify enables faster feature releases