HIPAA-Compliant Multi-Tenant Cloud EHR Platform

Protecting ePHI in a Multi-Tenant Cloud Architecture

A healthcare SaaS provider needed to scale their clinical documentation platform across hundreds of hospital networks. Standard disk-level database encryption (TDE) was insufficient because database administrators could theoretically inspect plaintext patient records. The platform required client-side column-level envelope encryption where data keys are managed independently per healthcare tenant.

Zero-Trust Security Architecture Highlights

AES-256 GCM Column Envelope Encryption Implementation

Patient identifiers (SSN, MRN, clinical notes) are encrypted application-side using tenant-specific Data Encryption Keys (DEKs) encrypted by AWS KMS Master Keys:

export async function encryptEphiField(
  plaintext: string,
  tenantKmsKeyId: string
): Promise<{ cipherText: string; encryptedDataKey: string; iv: string }> {
  // 1. Request a one-time Data Encryption Key (DEK) from AWS KMS
  const kmsClient = new KMSClient({ region: 'us-east-1' });
  const dataKeyCommand = new GenerateDataKeyCommand({
    KeyId: tenantKmsKeyId,
    KeySpec: 'AES_256',
  });
  const { Plaintext: rawDek, CiphertextBlob: encryptedDek } = await kmsClient.send(dataKeyCommand);

  // 2. Encrypt the sensitive payload using AES-256 GCM
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', rawDek!, iv);
  const encryptedPayload = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const authTag = cipher.getAuthTag();

  return {
    cipherText: Buffer.concat([encryptedPayload, authTag]).toString('base64'),
    encryptedDataKey: Buffer.from(encryptedDek!).toString('base64'),
    iv: iv.toString('base64'),
  };
}

HL7 FHIR R4 Interoperability Endpoints

To fulfill 21st Century Cures Act information blocking rules, all clinical data is accessible via authenticated SMART on FHIR OAuth2 endpoints returning standard Patient and Encounter JSON resources.

SOC-2 Type II & HIPAA Compliance Outcome