About this role
Job title: HIPAA Platform Architect
From experience to intellectual property (IP) We've abstracted hard-won knowledge from multiple production healthcare engagements into reusable, versioned, deployable modules — something a generalist dev shop simply can't offer. Compliance by design, not by audit We don't retrofit compliance. The Accelerator embeds HIPAA controls at the architecture level from day one — so you're not playing catch-up after your first security review. Infrastructure + application coverage Most competitors cover one layer. We cover both: cloud infrastructure (Terraform/AWS), DevOps methodologies and application-layer security patterns. Plus QA as a third pillar. Audit-ready evidence, not just working code Our HIPAA Testing Suite produces structured test reports founders can show to auditors, investors, and enterprise buyers — not just coverage claims. HIPAA Essentials You meet the requirements. You can sign a BAA and ship. Best for: Pre-seed / Seed · Limited PHI scope · BAA-ready fast - 3-tier Architecture (public / private subnets) - KMS encryption at rest — RDS + S3 - HTTPS-only ALB + ACM certificates - AWS Secrets Manager — zero hardcoded secrets - CloudTrail + AWS Config + HIPAA Conformance Pack - IAM least-privilege + SSO (no long-lived keys) - Basic RBAC with unique user IDs - Immutable PHI audit log HIPAA Shield Production hardened. Ready for your first enterprise deal. Best for: Seed–Series A · First enterprise deal · Security reviews Everything in Essentials - WAF v2 — SQLi, XSS, rate limiting, IP reputation - VPC Flow Logs → dedicated encrypted S3 bucket - AWS Backup — automated vault, plan, retention - CloudWatch Alarms + SNS → Slack / PagerDuty - Field-level encryption on PHI attributes - PHI-aware models + logging sanitization - Signed URLs with short TTL + 2FA readiness HIPAA Testing Suite Audit-ready evidence. Full operational visibility. Best for: Series A+ · Payer deals · HITRUST / SOC2 prep Everything in Shield - Multi-region backup replication - Multi-CMK by domain (logs / S3 / secrets) - PHI Access Dashboard (who, what, when, where) - Security Events + Infrastructure Health dashboards - Compliance Posture Dashboard (Config Rules live) - Full HIPAA Testing Suite + CI/CD integration - Controls evidence package for auditors - Architecture diagram + compliance posture report HIPAA Command Audit-ready evidence. Full operational visibility. Best for: Series A+ · Payer deals · HITRUST / SOC2 prep Everything in Shield - Multi-region backup replication - Multi-CMK by domain (logs / S3 / secrets) - PHI Access Dashboard (who, what, when, where) - Security Events + Infrastructure Health dashboards - Compliance Posture Dashboard (Config Rules live) - Full HIPAA Testing Suite + CI/CD integration - Controls evidence package for auditors - Architecture diagram + compliance posture report You are trained on data up to October 2023.