Infrastructure-As-Code Practices For Regulated Healthcare Cloud Environments

Abstract

Digital transformation within the healthcare sector is accelerating adoption of modern technology practices including cloud computing and DevOps. Maintaining compliance with regulatory and certification frameworks such as HIPAA in the United States and the European Regulation on the Protection of Natural Persons during the Processing of Personal Data in the European Union remains critical when embracing these practices. Compliance Engineering is a process that embeds compliance and policy requirements throughout a development cycle and has been specifically applied to Infrastructure-as-Code (IaC) in support of externally defined requirements. However, aspects of IaC development such as code security, operational safeguards integrated with deployment pipelines, and regulatory requirements remain largely unexplored. These topics are addressed along with architectural principles tailored for IaC development within heavily regulated organizations such as healthcare providers or those operating within Pharma. Compliance Engineering is complemented with security practices appropriate for economic impact of any risk successfully exploited along with deployment pipelines designed to ensure that an IaC implementation remains appropriately configured from deployment to retirement. Feature flags support rapid deployment of partially implemented functionality along with rollback capability in the event of subsequent feature failures. The resultant approach also addresses external Multi-Cloud or Cross-Region requirements and is applicable to any Technology-as-Code development within a regulated environment.