Cloud and DevOps services
Landing zones, CI/CD and infrastructure as code for new healthcare platforms.
Healthcare / Cloud Managed Services
Cloud managed services for healthcare workloads
Running PHI on AWS, Azure or Google Cloud means someone has to own patching, backups, access, cost and the alert at three in the morning. Agnotic Technologies operates your cloud environment under a BAA, with the HIPAA Security Rule safeguards written as runbooks your auditors can read.
AWS, Azure, GCP
Operated under each provider's BAA
Runbooks
Security Rule safeguards as written procedures
Restores
Backups tested by restoring them
Trusted by global innovators
Industry Overview
What are cloud managed services for healthcare?
Cloud managed services for healthcare are the ongoing operation of the AWS, Azure or Google Cloud environment that hosts health applications and PHI: monitoring, patching, backups, access control, cost management and incident response. Agnotic Technologies delivers them as an operations service under a business associate agreement, with each HIPAA Security Rule safeguard mapped to a runbook, an owner and evidence.
Where it fits
Which cloud work comes before managed operations?
Managed operations start once an environment exists. These pages cover the build and migration work that leads into it.
Cloud migration and modernization
Moving existing health systems to the cloud with a cutover plan and a rollback.
Healthcare DevOps services
Pipelines, environments and release automation built for PHI workloads.
HIPAA requirements for software teams
The safeguards the runbooks on this page implement.
Industry Challenges
Why do healthcare cloud environments fail audits and budgets?
The environment was built well and then left to run itself. The same findings come up in most reviews we do.
A BAA was accepted, but PHI sits in services the BAA does not cover.
Application servers are patched; databases, agents and base images are not.
Backups run every night and nobody has ever restored one.
Spend grows month on month because no one owns rightsizing and clean-up.
Logs are collected and never reviewed, so the activity review the Security Rule requires does not happen.
Shared responsibility
Who is responsible for what in a managed healthcare cloud?
Cloud providers secure the cloud itself; everything built on it is the customer's responsibility. This is how we split that customer side with you.
| Area | Cloud provider | Agnotic (managed operations) | Your organisation |
|---|---|---|---|
| Physical data centres and hypervisors | Owns | Verifies the BAA and eligible services | Approves the provider |
| Operating systems, containers and dependencies | Patches managed services | Patches and rebuilds images | Approves maintenance windows |
| Identity and access | Provides IAM | Runs least privilege, reviews and break-glass | Approves who needs access |
| Backups and restore tests | Provides storage and snapshots | Schedules, tests and documents restores | Sets recovery objectives |
| Monitoring and incident response | Reports provider incidents | Monitors, pages and runs the incident runbook | Named contact and decisions |
| Cost management | Bills | Rightsizes, tags and reports | Sets the budget |
| Risk analysis and policies | Publishes compliance reports | Supplies evidence and findings | Owns the HIPAA risk analysis |
| Breach notification | Notifies the customer | Reports incidents to you under the BAA | Decides and notifies as the covered entity |
Our Approach
How we operate cloud environments that hold PHI
Three principles make the operations auditable rather than heroic.
Everything as code
Infrastructure, alert rules and access policies live in version control, so every change has an author, a review and a rollback.
Least privilege and break-glass
Engineers hold no standing access to PHI data stores. Elevated access is time-boxed, approved and logged.
Evidence by default
Patch records, restore tests, access reviews and incident reports are produced by the runbooks, not assembled before an audit.
Capabilities
What do cloud managed services include?
The operations work a healthcare cloud environment needs every month.
Monitoring and on-call
Infrastructure, database and security monitoring with paging for the severities in your SLA.
Patching and vulnerability management
Scheduled patch windows for operating systems, containers and managed services, with scan results tracked to closure.
Backups and disaster recovery
Backup schedules, retention, cross-region copies and restore tests against your recovery objectives.
Identity and access operations
Role design, joiner and leaver processes, MFA enforcement and periodic access reviews with records.
Cost management
Tagging, rightsizing, reserved capacity decisions and a monthly spend report against budget.
Incident response
A written incident runbook, severity triage, communication to your named contact and a post-incident report.
Engineering Stack
Platforms and tools we operate
We run the services your environment already uses and standardise the operations around them.
AWS
EC2EKSRDSS3CloudWatchGuardDuty
Azure
AKSAzure SQLAzure MonitorDefender for CloudKey Vault
Google Cloud
GKECloud SQLCloud MonitoringCloud KMS
Automation
TerraformAnsibleGitHub ActionsPagerDuty
Safeguards as runbooks
How do HIPAA Security Rule safeguards become runbooks?
Each safeguard that touches cloud operations is written as a runbook with an owner and the evidence it produces. This is the core of how we work.
| Safeguard (45 CFR 164) | Runbook | Evidence we keep |
|---|---|---|
| 164.308(a)(1)(ii)(D) Information system activity review | Weekly review of audit logs, access reports and security alerts | Review tickets with findings and sign-off |
| 164.308(a)(5)(ii)(B) Protection from malicious software | Patch and vulnerability runbook with scan, fix and verify steps | Scan reports and patch records per system |
| 164.308(a)(6) Security incident procedures | Incident response runbook with triage, containment and reporting steps | Incident timeline and post-incident report |
| 164.308(a)(7)(ii)(A) Data backup plan | Backup schedule and restore test runbook | Restore test results and retention settings |
| 164.312(a)(2)(iv) Encryption and decryption | Key management runbook: KMS keys, rotation and encryption at rest | Key rotation records and encryption configuration |
| 164.312(b) Audit controls | Logging runbook: what is logged, where it is kept and for how long | Log retention configuration and access to log stores |
Measured Impact
What does a monthly cloud operations report cover?
The measures in the report we send every month, agreed at handover.
Patch status
Systems inside the patch window
Which systems are current and which are waiting for a window.
Restores
Restore tests completed
Backups proven by restoring them, with the time each took.
Spend
Cost against budget
Monthly spend, trend and the rightsizing actions taken.
Incidents
Incidents by severity
What happened, how long it took to restore and what changed afterwards.
My Lauren Maternal Health Platform | Built by Agnotic
A HIPAA-ready maternal health platform enabling remote patient monitoring, care coordination, and personalized engagement from pre-pregnancy through postpartum.
Case Study
LERA Health: Compliant Women’s Health App Platform
A women’s health product experience focused on guided care journeys, education, and compliance-aware workflows to support long-term engagement.
Case Study
Use Cases
Who uses cloud managed services?
Teams that have PHI in the cloud and no operations team to run it.
01
Digital health startups
After the first release, when the founders no longer want to carry the pager.
02
Hospitals with cloud-hosted portals
Patient and provider portals that IT wants operated under written procedures.
03
RPM and telehealth platforms
Device data pipelines and video services that must stay available.
04
Payer member apps
Member-facing applications with strict access and logging needs.
05
Health IT vendors
Software vendors that need HIPAA-ready operations without building the team.
06
Research platforms
Data environments with de-identified and identified zones kept separate.
Integrations
What does the environment connect to?
The systems a healthcare cloud environment depends on, inside and outside the account.
Clinical
EHR interfaces (FHIR, HL7 v2)
Access
Identity providers (Okta, Microsoft Entra ID)
Security
SIEM and log platforms
Operations
Ticketing (Jira, ServiceNow)
Resilience
Backup and archive targets
Edge
DNS, CDN and WAF
Compliance-First Development Services Backed by Global Standards
We build secure, scalable products designed for privacy, interoperability, and regulatory readiness from day one across every sector we serve.
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, and strict access controls.
Our Edge
Why Global Leaders Choose Us
We combine deep technical expertise with industry-specific knowledge to deliver solutions that aren't just functional, but transformational.
Enterprise-Grade Security
We implement rigorous security protocols and compliance standards (HIPAA, GDPR, SOC2) across all industrial solutions to protect sensitive data.
High-Performance Scaling
Our architectures are built to handle massive data loads and user bases, keeping performance steady whether you're serving ten or ten million.
Accelerated Time-to-Market
Using our suite of internal tools and proven frameworks, we reduce development cycles and get your product to market 40% faster.
Embedded AI Integration
Beyond simple wrappers, we build deep-learning integrations and predictive analytics directly into the core of your industry-specific workflows.
Engagement Model
How does a cloud managed services engagement start?
Timing depends on the size of the environment; we agree the review scope on the scoping call.
01
Scoping call
Which clouds, accounts and workloads hold PHI, who runs them today and what the SLA must cover.
02
Environment review
BAA scope, eligible services, identity, patching, backups, logging and cost, written up as findings.
03
Hardening sprint
The findings that block safe operation are fixed first, as code, with evidence.
04
Operations handover
Runbooks, dashboards, on-call rota and the monthly report are set up and we take the pager.
05
Monthly report and quarterly review
Patch status, restores, spend and incidents each month; scope and roadmap each quarter.
Facts and sources
Rules and vendor terms behind cloud managed services
Short facts we operate against, each linked to its primary source.
HIPAA defines a business associate as a vendor that creates, receives, maintains or transmits protected health information for a covered entity, so a cloud service that maintains ePHI falls inside the definition.
Source: 45 CFR 160.103 (eCFR)The HIPAA Security Rule contingency plan standard requires a data backup plan that creates and maintains retrievable exact copies of ePHI and a disaster recovery plan to restore any loss of data.
Source: 45 CFR 164.308(a)(7) (eCFR)AWS states that there is no HIPAA certification for a cloud service provider; customers accept the AWS Business Associate Addendum through AWS Artifact and should process PHI only in HIPAA Eligible Services.
Source: AWS, HIPAA compliance documentationMicrosoft offers its HIPAA Business Associate Agreement as part of the Microsoft Product Terms to customers that are covered entities or business associates, for in-scope Azure services.
Source: Microsoft Learn, Azure HIPAA compliance offeringNIST SP 800-61 Rev. 3, published in April 2025, gives incident response recommendations as a Cybersecurity Framework 2.0 Community Profile and supersedes Rev. 2 from 2012.
Source: NIST SP 800-61 Rev. 3
Voice of success
We don't just build products; we forge lasting partnerships. See how we've helped industry leaders transform their vision into technical reality.
“I can clearly see how Agnotic has a unique way of handling end-to-end development. They are always active on quick chat and provide support quickly.”
Aaron Phelan
Founder, Benchmark
“Agnotic combines deep technical expertise with strong domain knowledge. They understand the business context, anticipate challenges, and make collaboration smooth and effective.”
John Pasmore
Founder, Latimer
“Agnotic is the best technical team we evaluated. Their engineering excellence made our work dramatically easier and allowed us to stay focused on what matters most for maternal care outcomes. They took full ownership of the technical execution, and we are always happy to continue working together.”
Kim Smith
Founder, My Lauren
More in Healthcare
More Healthcare Solutions
Explore other production-grade engineering platforms we deliver across healthcare.
Cross-Industry Reach
The Same Engineering Patterns, Across Other Industries
The technical patterns behind this platform translate naturally into adjacent verticals.
Frequently Asked Questions
It depends on the number of accounts and workloads and on what the environment review finds. We agree the review scope on the scoping call and set the handover date from its findings.
Yes. Operating an environment that stores PHI makes Agnotic a business associate, so we sign a business associate agreement before we receive any access.
Yes. Each provider offers its own: AWS through AWS Artifact, Microsoft as part of the Product Terms, and Google Cloud for its infrastructure. We check it is in place and that PHI only runs in the services it covers.
Yes. Most engagements start with an environment built in-house or by another vendor. The environment review tells both of us what must be hardened before we take the pager.
The number of accounts and workloads, the hours and severities the SLA covers, how much hardening the review finds, and the reporting your auditors need. We size it after the review, and cloud spend itself stays on your bill.
Yes. The review and the hardening sprint can be scoped and priced on their own, and you decide afterwards whether we run the environment.
Not by default. Cloud managed services cover the infrastructure; application support, releases and user questions are scoped separately so each layer has a clear owner. Many clients take both.
AI tools help our engineers draft infrastructure code, alert rules and runbooks, but every change is reviewed by a person and applied through the same pipeline, with the same tests, as any other change.
Industries