Secure, HIPAA-Aligned Cloud Foundation for a 3D Medical Imaging Platform Handling PHI

Aivar designed and implemented a phased cloud modernization engagement to securely store, process, transmit, and analyze patient imaging data (PHI) under HIPAA, focused on Secure Multi-Account Governance, IoT Device Connectivity, and GPU-Accelerated Compute.
‍

• Infrastructure as Code (IaC) & Automation: AWS Control Tower and AWS Organizations establish a ten-plus account landing zone in us-west-2 that separates environments for PHI-handling workloads, with Service Control Policies and CloudFormation Guard guardrails, provisioned and version-controlled through Terraform.
  ‍
• Secure IoT Device Onboarding: AWS IoT Core with Just-in-Time Provisioning issues unique X.509 certificates to each deployed X-ray machine on first connection, routing raw DICOM/TIFF patient imaging frames (PHI) to secure S3 storage via IoT Rules without manual device configuration.
  ‍
• GPU-Accelerated Reconstruction Pipeline: The 3D reconstruction algorithm, which processes patient imaging data, is containerized and deployed on Amazon EKS with GPU-enabled managed node groups, using Karpenter to scale GPU nodes to zero between reconstruction job batches.
  ‍
• DevSecOps CI/CD Pipeline: A GitOps-driven pipeline using GitHub Actions and Argo CD automates packaging and deployment, with security gates including Trivy, Checkov, Semgrep, Hadolint, and OWASP ZAP blocking promotion on critical or high severity findings.
  ‍
• Governance & Identity: AWS IAM Identity Center provides centralized SSO across all accounts, while AWS Config, GuardDuty, Security Hub, and organization-wide CloudTrail deliver continuous compliance monitoring and audit logging. Controls are documented against NIST 800-53 and the HIPAA Security Rule technical safeguards (§164.312), and the imaging pipeline uses HIPAA-eligible AWS services only under an executed AWS Business Associate Addendum (BAA).

Aivar performed a Total Cost of Ownership analysis comparing the client's always-on, on-premises GPU reconstruction hardware against the proposed elastic, scale-to-zero Amazon EKS/Karpenter architecture. The analysis showed that scale-to-zero autoscaling eliminates idle GPU spend between reconstruction job batches, while automated JITP-based device onboarding removes 30–60 minutes of manual engineering effort per device, together producing a materially lower total cost of ownership than the legacy on-premises model.

• Governed Landing Zone Established: A fully governed, ten-plus account structure was deployed with preventive and detective guardrails before any clinical workloads were onboarded.
  ‍
• Zero-Touch Device Onboarding: Automated JITP-based certificate issuance reduced per-device onboarding from 30–60 minutes of manual engineering effort to under 60 seconds.
  ‍
• Cost-Efficient GPU Compute: Karpenter-driven scale-to-zero autoscaling eliminated idle GPU costs between reconstruction job batches, replacing an always-on on-premises hardware model.
  ‍
• Validated Reconstruction Performance: Achieved sub-60-second end-to-end wall-time for a complete 3D reconstruction job on GPU-enabled EKS nodes.
  ‍
• Security Gate Enforcement: The DevSecOps pipeline automatically blocks deployment of container images or infrastructure changes with critical or high severity findings across all environments.

Validating that resources identified in the pre-migration inventory audit were genuinely safe to migrate or decommission required more coordination than anticipated due to undocumented dependencies; Aivar now includes a mandatory pre-migration dependency mapping workshop with explicit customer sign-off before any Management Account cleanup begins.
‍

The initial Just-in-Time Provisioning template produced overly broad IoT topic permissions that required redesign after security review; Aivar now includes a dedicated IoT policy design and tenant isolation review phase in its discovery process for future medical device IoT engagements.
‍

Containerizing the GPU reconstruction algorithm surfaced CUDA driver and toolkit version mismatches between the container base image and the target GPU nodes; Aivar now mandates a GPU driver and CUDA toolkit compatibility matrix review as a pre-containerization checklist item.