Multi-Cloud Security Guardrails for a Regional Health System
Clinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Client name withheld by agreement- Client
- Regional health system, 14 hospitals and 190 outpatient sites
- Region
- Pittsburgh, Pennsylvania
- Year
- 2025
- Duration
- 22 weeks
- Scope
- 86 AWS accounts · 41 Google Cloud projects · 2.1 PB of imaging
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A regional health system with 14 hospitals had moved its imaging archive to Google Cloud and its analytics and patient engagement apps to AWS, under two teams with two security models. Its 86 AWS accounts and 41 Google Cloud projects had grown without a shared baseline.
Its cyber insurer and its own internal audit flagged the same gaps: long-lived service keys, inconsistent logging and storage that research partners could reach without a clear agreement. Radiologists read around 9,000 studies a day, so any control that slowed image retrieval would be rolled back.
What we did
The approach, step by step.
- 01
One baseline for two clouds
We wrote a single control baseline mapped to the HIPAA Security Rule and the HHS cybersecurity performance goals, then enforced it as AWS service control policies and Google Cloud organization policies.
- 02
Long-lived keys retired
1,340 service account and access keys were replaced with workload identity federation and short-lived credentials, starting with anything that could read patient data.
- 03
Data perimeters around patient data
VPC Service Controls and resource policies now keep imaging and clinical data inside approved networks and identities, and research sharing runs through de-identified, logged datasets.
- 04
Logs in one place
Audit, data access and network logs from both clouds now feed the security operations platform with 400 days of retention.
- 05
Guardrails checked in the pipeline
Infrastructure changes are scanned against the baseline before deployment, and drift is ticketed to the owning team within the hour.
Outcomes
What changed, in numbers.
- 127
- cloud accounts and projects on one baseline
- 1,340
- long-lived keys retired
- 2.1 PB
- of imaging inside a data perimeter
- 0 ms
- added to median image retrieval
When the board asks how patient data is protected, we finally have one answer for both clouds.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Cleveland, Ohio · 22 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Certification for a Precision Machining SupplierCertified at the C3PAO assessment, keeping the supplier on two prime contractors’ approved lists.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.