HIPAA controls mapped
2 days → 11 min
at-rest + in-transit
external pen-test
01 — Challenge
MediSync coordinated care across clinics on click-ops infrastructure — shared credentials, unencrypted snapshots, and deploys that needed a hero. A hospital partnership required HIPAA controls they could prove, not promise.
02 — Approach
We built a multi-account landing zone with private EKS clusters, IRSA-scoped service identities, Secrets Manager via Vault, and GitOps promotion with signed artifacts. Every control maps to a Terraform module and a Config rule — evidence generated by the pipeline, not assembled before the audit.
Healthcare partnerships die on security questionnaires. MediSync needed controls that were real before they were documented — encryption, identity, and delivery discipline provable from the infrastructure itself.
No shared credentials, no public nodes, no long-lived keys. Workloads assume IAM roles via IRSA, operators authenticate with SSO + hardware keys, and every secret rotates on schedule. Network policies default-deny; each allowance is a reviewed YAML file, not a console click.
Config rules, CloudTrail aggregation, and signed SBOMs flow into an evidence bucket per environment. The audit packet is generated, not gathered — which is why the external pen-test returned zero criticals and the partnership closed two weeks early.
“The auditors asked for evidence and we sent pipeline links. That has never happened before.”
Dr. Samuel Adeyemi — Founder, MediSync