The eight items
One use case pulls in many services. A verdict says how much is new work: build where nothing public exists, fork where a permissively licensed AWS sample is the right base, link where AWS already demonstrates it and rebuilding would teach the wrong thing.
| Item | Use case | The story | Verdict |
|---|---|---|---|
| F0a / F0b | HIPAA-ready landing zone | A bare "AWS (advanced)" account becomes audit-ready in one deploy; the organisation layer is linked, not rebuilt. | Build / Link |
| U1 | Patient portal + native mobile apps | The reference application: sign in with a passkey, see results, message the care team — on web, iPhone and Android. | Build |
| U2 | Remote patient monitoring | Vitals stream through the patient’s phone into trends, alerts, and models trained on the fleet’s own history. | Build |
| U3 | Ambient clinical documentation | A recorded visit becomes a clinician-approved note with timestamp citations in the FHIR record. | Fork + build |
| U4 | Intelligent document intake | Faxes and referrals are extracted, reviewed by a person, and assembled into a prior-auth packet. | Link + fork |
| U5 | Population health analytics | A governed, de-identified lake you can ask questions of; risk models flow back into the apps. | Fork + build |
| U6 | Patient engagement contact centre | Amazon Connect Health demonstrated as a product rather than rebuilt. | Link |
| P0 | The education portal | This site — generated from each use-case repo so it never drifts from what is deployed. | Build |
Three tiers per use case
Every item climbs the same ladder, so a reader who learns one already knows the shape of the next.
Core
The working system on the shared spine: CDK, FastAPI on Fargate Express Mode, Aurora Serverless v2, DynamoDB, Cognito, CloudFront, HealthLake.
Embedded AI
An assistant inside the workflow — Bedrock plus AgentCore Gateway, with PHI protected at the tool boundary by interceptors and Cedar policy, not a model-call guardrail alone.
Learned models
Models trained on the platform’s own data through one SageMaker Pipelines spine, scoring back into the apps and traceable to a registered version.
Rules that hold everywhere
- Nothing retired in a new designApp Runner, Bedrock Agents classic, Kendra, Q Business, Pinpoint, Amplify Gen 1, the classic Mobile SDKs and the rest of the 2026-06 maintenance wave are out. The eligibility list is not a lifecycle signal.
- PHI at the agent tool boundaryA Guardrail on the model call sees prompt and completion text only. Tool inputs and results are protected by AgentCore Gateway interceptors, Cedar policy and a logs data-protection policy.
- Zero-retention models for PHIPHI prompts go to a model whose retention mode can be
none; Claude Fable 5.x requiresaws_reviewand is used only on de-identified inputs. - Eligible by name or by feature — say whichS3 Tables, Timestream for InfluxDB, Valkey and Bedrock KB / Guardrails / Data Automation rest on the GA-features clause; chapters say so and design so it does not matter.
- us-east-1, "AWS (advanced)", BAA firstHealthScribe pins the primary region; the empty-account runbook starts from an advanced account with the BAA accepted before any PHI step.
- Reuse before rebuild, and label itFork MIT-0 / Apache-2.0 / MIT only; CC-BY-SA is link-only; community repos are labelled; forked chapters carry AWS’s own usage disclaimer.