Security controls designed to protect sensitive health data
RBAC, multi-factor authentication, encryption and full auditability, running on secure AWS or Microsoft Azure cloud infrastructure.
Role-based access control (RBAC)
Least-privilege permissions by role, department and facility, so every user sees only what their job requires.
Multi-factor authentication
MFA with authenticator apps or OTP, plus SSO integration capabilities with your identity provider.
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest, with keys managed in AWS KMS or Azure Key Vault.
Immutable audit trails
Who viewed or changed which record, when and from where, logged for every patient record.
Consent & privacy by design
Patient consent captured and enforced, with data minimisation aligned to the DPDP Act, 2023.
Secure cloud on AWS or Azure
Private networks, WAF and DDoS protection, encrypted backups and India-region hosting options.
Defence in depth, from login to infrastructure
Layered controls across identity, data, cloud infrastructure, monitoring, resilience and governance.
Identity & access
- Role-based access control (RBAC) by role, department and facility
- Multi-factor authentication (authenticator app or OTP)
- Single sign-on integration capabilities (SAML 2.0 / OpenID Connect)
- Strong password policies and account lockout
- Session timeouts, device sign-out and session revocation
- Emergency "break-glass" access with mandatory justification and audit
- Periodic access reviews and automatic de-provisioning
Data protection
- Encryption in transit with TLS 1.2 or higher
- Encryption at rest with AES-256
- Keys managed in AWS KMS or Azure Key Vault, with rotation
- Masking of sensitive identifiers such as Aadhaar and ABHA numbers
- Field-level access rules for sensitive clinical data
- Encrypted backups with point-in-time recovery
- Configurable data retention and secure deletion
Cloud infrastructure
- Deployment on AWS or Microsoft Azure
- Hosting in Indian cloud regions to support data residency
- Private network isolation (VPC / VNet) with no public database access
- Web application firewall and DDoS protection
- Secrets stored in managed vaults, never in code
- Least-privilege cloud IAM for services and administrators
- Hardened, regularly patched infrastructure
Monitoring & detection
- Immutable, record-level audit trails
- Centralised logging of application and infrastructure events
- Threat detection and alerting on suspicious activity
- Alerts for unusual access patterns, such as bulk record views
- Security event review and incident response process
Resilience & recovery
- High-availability deployment across multiple availability zones
- Automated, encrypted daily backups
- Disaster recovery with defined recovery objectives (RPO / RTO)
- Regularly tested restore procedures
Governance & compliance
- Privacy by design and data minimisation
- Designed to support the Digital Personal Data Protection (DPDP) Act, 2023
- Aligned with ABDM security and consent requirements
- Secure development lifecycle with code review and dependency scanning
- Regular vulnerability assessment and penetration testing (VAPT)
- Documented security policies and incident response
Built for AWS or Microsoft Azure
Each control maps to managed cloud security services. This reference mapping shows the typical services used; the exact set depends on your chosen cloud and deployment.
| Control | On AWS | On Microsoft Azure |
|---|---|---|
| Identity & SSO | AWS IAM Identity Center | Microsoft Entra ID |
| Encryption keys | AWS KMS | Azure Key Vault |
| Secrets management | AWS Secrets Manager | Azure Key Vault |
| Network isolation | Amazon VPC | Azure Virtual Network |
| WAF & DDoS protection | AWS WAF & AWS Shield | Azure WAF & DDoS Protection |
| Threat detection | Amazon GuardDuty | Microsoft Defender for Cloud |
| Logging & monitoring | AWS CloudTrail & CloudWatch | Azure Monitor & Microsoft Sentinel |
| Backup & recovery | AWS Backup | Azure Backup |
Security in the cloud follows a shared-responsibility model. AWS and Microsoft Azure secure the underlying infrastructure and hold their own certifications (such as ISO/IEC 27001 and SOC 2) for it. AIpath HealthTech is responsible for securing the application, configuration and data access on top of that infrastructure.
Governance you can explain to auditors
Every user is assigned a role and facility scope, signs in with multi-factor authentication, and every view or change to a patient record is logged with the user, time and action. Health information exchange happens only against a recorded patient consent.
We state only the specific approvals and certifications that AIpath HealthTech has actually obtained. Ask our team for the current status of security assessments, VAPT reports and ecosystem approvals relevant to your deployment.
See Your Hospital Operations, Unified.
A guided walkthrough of AIpath HealthTech, mapped to your departments and workflows.