Hi Chas, tel mentioned this, but Amazon allows organizations to store protected health information (PHI) provided they use dedicated machines in their own VPC.

Hi Chas, tel mentioned this, but Amazon allows organizations to store protected health information (PHI) provided they use dedicated machines in their own VPC. I recently had to migrate our company into this model to get our BAA signed. I like what you've built, but I think you might be missing the real pain point. I agree that it's a hassle to setup a compliant infrastructure on Amazon. But, this is a one-time process. Most serious healthcare IT companies (and startups) will undertake this responsibility themselves to have tight control over their infrastructure. The real challenge is maintaing the system and providing access control as the system grows. We handle upwards of 50K clinical notes a day. When we encounter an issue we have to be able to track which note caused the problem and get access to it all within the confines of our system. Our access policy requires: 1. Connection to the dedicated VPC 2. SSH access to specific instances Here's what I regard as the real problem ---> Once you're SSH'd onto the instance, you can do basically anything. There's no front-end for manipulating PHI. I could scp every PHI document onto my laptop. I could elaborate some more if you like.