Security Architecture
TL;DR / Key Takeaways
- •Zero-Trust architecture deployed entirely inside your AWS VPC — no data egress.
- •ConnectHealth team never hosts, stores, or transits your Protected Health Information (PHI).
- •AI Guardrails automatically redact PHI before it reaches any LLM.
- •Encryption at rest (KMS) and in transit (TLS 1.2+) across all components.
- •Audit logs are heavily redacted to prevent PHI exposure in CloudWatch.
ConnectHealth is built on a Zero-Trust Architecture designed specifically for regulated healthcare environments. Our "glass box" deployment model ensures that your PHI never leaves your control, and every action is authenticated, authorized, and audited.
1. Deployment Model: 100% In Your Cloud
Unlike traditional SaaS integration engines that pull your patient data into their multi-tenant cloud, ConnectHealth deploys directly into your AWS account via AWS Marketplace.
HIPAA-Compliant Zero-Trust Architecture
Security
Gateway
TLS 1.2+ Terminated Load Balancer & WAF Threat Protection.
ConnectHealth Core
Isolated Compute Engine
Encrypted Storage
Customer Managed KMS
Audit Logging
6-Year Retention Trails
Secrets Isolation
Native AWS Vaults
Your VPC
ConnectHealth runs as ECS containers inside your Amazon Virtual Private Cloud (VPC). We (the vendor) have zero access to your environment unless you explicitly grant support access via IAM roles.
Private Subnets Only
The application operates entirely within Private Subnets without public IP addresses. All external communication (e.g., to Epic or Stedi) routes safely through NAT Gateways or standard AWS VPC Endpoints.
2. Encryption Everywhere
We enforce comprehensive encryption standards to protect data both in transit and at rest.
In Transit
- All external HTTP traffic relies on TLS 1.2+ terminated at your AWS Application Load Balancer (ALB).
- Internal service-to-service traffic between ECS containers is encrypted.
- HL7 v2 MLLP connections can be wrapped in TLS tunnels.
At Rest
- Application state and internal databases use Customer-Managed AWS KMS Keys. You own the encryption keys.
- EFS storage volumes used for temporary file processing (e.g., FHIR Bulk Exports) are encrypted by default.
- EHR API credentials (SMART on FHIR Client Secrets) are securely stored and encrypted in AWS Secrets Manager, resolved dynamically at runtime based on the tenant context.
3. AI Guardrails & PHI Protection
ConnectHealth's agentic workflows feature powerful LLM capabilities. To prevent data leakage to external models (like OpenAI or Anthropic), customers can optionally implement the AI Guardrails node to define and enforce strict, fail-closed data policies on their own workflows.
Input Scrubbing
Before a prompt is sent to an LLM, the Guardrail engine scans for identifiers (Names, DOBs, MRNs, SSNs) and redacts them, while preserving clinical context (Conditions, Medications).
Output Validation (Zero-Trust Mode)
When configured to "Block" mode, any detection of PHI or policy violation in the AI's output triggers an immediate block, overriding the LLM response with a sanitized failure message.
Fail-Safe Architecture
If the Guardrail service experiences a timeout or error, the system fails closed. It assumes the payload is sensitive and blocks it securely preventing any raw stack traces or data from escaping.
4. Logging & Observability
ConnectHealth provides a "glass box" approach to observability, writing directly to your AWS logging infrastructure.
Application Logs
Structured JSON logs are sent natively to AWS CloudWatch (e.g., /ecs/connecthealth-prod), enabling actionable monitoring using CloudWatch Insights. These logs include execution traces, latency details, and API status codes, while raw PHI payloads are aggressively redacted to prevent accidental exposure. Customer observability tools can parse these logs to track workflow success rates, EHR API latency, and connector uptime natively within your AWS environment.
5. Comprehensive Compliance & HA
By running purely as infrastructure atop AWS primitives, ConnectHealth inherently supports strict governance controls spanning healthcare and security standards.
High Availability & Cost Optimization
- Multi-AZ Resilience: Application Load Balancers span 2 Availability Zones and route to highly available ECS Fargate tasks with NAT Gateways in each AZ for redundancy.
- Auto-Scaling: Fargate seamlessly scales (Target 70% CPU limits) saving you money by paying only for used compute.
- Resource Locality: Deep use of VPC endpoints guarantees traffic stays completely off the public internet, accelerating data transfers and increasing security.
Foundational Security Controls for Compliance
ConnectHealth provides the foundational infrastructure controls needed to support your own HIPAA and SOC 2 compliance posture:
- HIPAA-Ready Controls: Leverages AWS KMS for encryption at rest, TLS 1.2+ for transit, strict IAM security groups, and minimum 6-year CloudWatch audit logging lifecycles. For Enterprise customers, ConnectHealth can sign Business Associate Agreements (BAAs).
- SOC 2 & GDPR Support: Complete integrity tracking using CloudTrail changes, AWS WAF logic protection, SNS incident alerts, and CloudWatch performance traces. Right-to-deletion processes cascade gracefully to S3 lifecycle constraints.
What's Next?
- HIPAA Compliance — Learn about Business Associate Agreements and audit trails
- Getting Started — Deploy ConnectHealth into your AWS environment
- Workflow Builder — See how visual workflows operate securely