DevOps for Healthcare — secure, auditable multi-cloud

What regulates the infrastructure

What actually goes wrong here

• Third-party concentration in the clinical and revenue chain: a single clearinghouse or pathology lab is a shared dependency for many providers at once. The June 2024 Qilin ransomware attack on Synnovis, a pathology joint venture serving south-east London NHS trusts, forced postponement of roughly 1,700 elective operations and about 10,000 outpatient appointments and triggered blood supply shortages; full service restoration took until December 2024.
• Restoring the database is not restoring the service. Clinical estates depend on HL7v2/FHIR interface engines, PACS/DICOM archives and validated medical devices that must be revalidated after recovery, which is why hospital ransomware recovery is measured in weeks or months rather than in the hours the storage RTO implies.
• Data-residency leakage through the side channels rather than the primary store. Telemetry, log shipping, backup replication and out-of-hours vendor support access routinely cross borders; under §393 SGB V or the HDS v2.0 EEA-hosting requirement, that voids compliance even though the patient database never left the permitted jurisdiction.
• Backups destroyed alongside production because they sit inside the same identity domain. Healthcare estates concentrate authentication in a single directory shared by clinical, administrative and imaging systems, so credential compromise reaches the recovery copies unless they are immutable or air-gapped.
• Downtime becomes a patient-safety event, not a revenue event. When an EHR is unavailable, providers divert ambulances, revert to paper ordering and lose medication reconciliation and allergy checking — the failure mode is clinical harm and the recovery involves reconciling paper records back into the system afterwards.
• Long retention converts an old breach into a current one. Because records are held for decades, a compromise of an archive tier exposes patients who left the provider's care long ago, and breach notification duties still attach to them.

How demand behaves

Clinical traffic is continuous but strongly diurnal, following clinic and theatre hours, with emergency departments as the always-on floor under it. Three distinct patterns sit on top: imaging generates large-object bursts (a single CT or MRI study is hundreds to thousands of DICOM objects), billing and claims run as heavy month-end and period-end batches, and payer enrolment portals spike into narrow statutory windows rather than spreading across the year. Epidemic and respiratory seasons raise the whole baseline for months at a time rather than producing a single peak.

Data you will be holding

Patient records are "protected health information" under HIPAA in the US and a special category of personal data under GDPR Article 9 in the EU — processing is prohibited by default unless an Article 9(2) condition applies. Article 9(4) lets member states impose extra national conditions, which is why country-specific hosting rules (French HDS certification, German §393 SGB V) sit on top of GDPR rather than being displaced by it. The data classes are unusually hard to contain: genomic sequences and imaging studies are effectively non-anonymisable and very large, and clinical records carry statutory retention periods measured in decades, so a single archive holds far more history than most other sectors' live datasets.

Architecture this pushes you toward

Clinical estates are integration-heavy rather than monolithic: an interface engine brokers HL7v2 and increasingly FHIR messages between the EHR, laboratory (LIS), radiology (RIS/PACS), pharmacy and billing systems, so the messaging tier — not the application tier — is usually the availability bottleneck. Imaging drives a distinct storage profile of write-once, read-rarely, very large objects with decades-long retention, which pushes tiered object storage with strict deletion controls rather than uniform block storage. Because national rules pin hosting to specific jurisdictions, multi-region designs in this sector tend to be multi-AZ within one country or one EEA footprint rather than genuinely global.

Availability expectation

Clinical hosting contracts commonly specify 99.9% or better with 24/7 support and defined RTO/RPO, and maintenance windows negotiated around theatre and clinic schedules rather than by calendar convenience. The distinguishing feature is that the availability figure does not discharge the obligation: providers are still expected to maintain documented paper "downtime procedures" and rehearse them, because the fallback for an unavailable EHR is clinical, not commercial.