Skip to main content

aws-healthcare-use-cases — demonstration catalog

Generated at build time from AGENT-PLAN.md in the repo — edit the source, not this page.

  • 1. Ground Rules: The four open catalog decisions are confirmed and written down. — acceptance: ADRs for single-account landing zone, us-east-1 primary, the scale target, and native Swift + Kotlin exist in docs/decisions id 7483ecb4 Detail: the four ambiguities in docs/catalog/catalog-v1.md; defaults are already stated there, this item records the confirmed answers.
  • 2. Portal Contract: Every use-case repo ships the same documentation shape and the portal renders it automatically. — acceptance: a stub use case with README, catalog-item.json, ADR, diagram and contentspec appears as a chapter in the generated portal id d1e4be5f
    • 2.1. Content Contract: A template repo folder defines the README, catalog-item.json, decisions, architecture and contentspec files every item must ship. — acceptance: the template validates with a script in CI id 3a75dee0
    • 2.2. Portal Skeleton: The education site builds from the use-case folders and is served from CloudFront. — acceptance: the site deploys and shows the stub chapter id e6b05a5f
  • 3. HIPAA Baseline: A bare AWS account becomes audit-ready in one deploy. — acceptance: the Config HIPAA pack and Security Hub standards pass, Macie PHI identifiers are on, and an evidence bundle exports to S3 id 42d58f31
    • 3.1. Account Runbook: A reader can go from sign-up to a BAA-accepted "AWS (advanced)" account by following the chapter. — acceptance: runbook tested on a fresh account id 2ca2a392
    • 3.2. Baseline Stacks: KMS, CloudTrail, Config, Security Hub CSPM, GuardDuty, Macie, VPC, WAF and Secrets Manager deploy from one CDK app. — acceptance: cdk deploy completes and all standards report id d686375c
    • 3.3. Evidence Export: Compliance findings land in an Object-Locked S3 bucket an auditor could read. — acceptance: bundle present after deploy id 99fe287e
  • 4. Patient Portal: Patients can sign in, see results, message their care team and upload documents on web, iPhone and Android. — acceptance: the same patient journey completes on all three clients against HealthLake, with every PHI access logged id 49497690
    • 4.1. Backend and Web: The FastAPI service, Cognito passkey and MFA sign-in, HealthLake record and React portal work end to end. — acceptance: web journey passes id 5ad5e603
    • 4.2. iPhone App: The same journey works in a native Swift app on Amplify Gen 2. — acceptance: iOS journey passes on a device id 6276a858
    • 4.3. Android App: The same journey works in a native Kotlin app on Amplify Gen 2. — acceptance: Android journey passes on a device id 383cd73e
    • 4.4. Notifications: Patients get "new result" pushes, SMS codes and emails with no PHI in the payload. — acceptance: push, SMS and email each arrive from the demo id 045bbfc1
  • 5. Remote Monitoring: Readings from a patient's devices stream through their phone into trends and care-team alerts. — acceptance: a simulated fleet plus one real phone show live trends in the portal and trigger an alert id ca12b595
    • 5.1. Ingest Pipeline: IoT Core, Kinesis, Managed Flink, Timestream for InfluxDB and S3 Tables deploy from CDK and carry simulated readings. — acceptance: readings queryable hot and cold id 6bcb9c53
    • 5.2. Phone Gateways: The iPhone and Android apps forward HealthKit, Health Connect and BLE readings to IoT Core. — acceptance: a real reading from each phone lands in the pipeline id fa80b231
    • 5.3. Alerts and Device UI: Thresholds raise alerts and the portal manages devices in real time. — acceptance: alert reaches the app; device list updates live id e06b9fa6
    • 5.4. Scale Proof: The pipeline holds at the agreed scale target. — acceptance: load test report at 1.5x peak published in the chapter id b1ecdb6a
  • 6. Document Intake: Faxes and referrals are extracted, reviewed by a person, and assembled into a prior-auth packet. — acceptance: a sample referral flows from S3 through review to a packet, with PHI masked in logs id 80414cd0 Detail: links the AWS IDP Accelerator and forks sample-healthcare-agents; new work is the Comprehend Medical, Macie and de-identification layer plus HealthLake landing.
  • 7. Patient Assistant: A patient can ask what a result means and get an answer from their own record with PHI protected at the tool boundary. — acceptance: a negative test shows the interceptor masking PHI that a model-call Guardrail misses, and the retention-mode policy blocks a non-compliant model id 5116f550
    • 7.1. Assistant: Bedrock plus AgentCore Gateway with patient-scoped FHIR tools answers in the web and mobile apps. — acceptance: question answered on all three clients id 04b24d28
    • 7.2. Compliance Evidence: The chapter demonstrates interceptors, Cedar Policy, retention modes, Macie selection and the eligibility-by-feature table with runnable tests. — acceptance: tests pass and the chapter is published id 9f834be9
  • 8. Clinical Documentation: A recorded visit becomes a clinician-approved note in the patient record. — acceptance: recording to SOAP note with timestamp citations to approval to a HealthLake DocumentReference, in us-east-1 id c39b478e
  • 9. Assistants Everywhere: The monitoring, document and analytics workflows each get an assistant that reuses the patient-assistant pattern. — acceptance: telemetry trend question, prior-auth packet request and natural-language lake question each answered through interceptor-protected tools id 6f2b2f52
  • 10. Population Analytics: Analysts see de-identified dashboards over a governed lake and can ask it questions in plain language. — acceptance: an Amazon Quick dashboard over S3 Tables with Lake Formation access, and a natural-language question answered id 3c830f0e
  • 11. Learned Models: Models trained on the platform's own data score back into the apps. — acceptance: a no-show reminder, an anomaly alert, and a readmission-risk flag are each visible in the patient or care-team app and traceable to a registered model id a58da1f9
    • 11.1. Pipelines Spine: SageMaker Pipelines, Model Registry, Feature Store and MLflow deploy once and the no-show model runs through them. — acceptance: reminder fires from a batch score id 009b99bc
    • 11.2. Device Models: Anomaly detection in Flink, deterioration forecasting, retraining on drift and an edge model on Greengrass score live readings. — acceptance: anomaly alert from a live reading; edge score from the gateway id 594c2a19
    • 11.3. Risk Models: Readmission risk scores land in DynamoDB and show as flags in the portal. — acceptance: flag visible with SHAP explanation in MLflow id 434bcfc1
    • 11.4. Quality Models: A note-quality classifier and a document-type classifier show when a trained model beats a prompt. — acceptance: evaluation harness report published id 4903cc14
  • 12. Product Chapters: The contact centre and the organisation-level landing zone are demonstrated as AWS products rather than built. — acceptance: Connect Health verification and ambient documentation shown running; LZA-for-Healthcare chapter published with the retention-mode SCP id 8e70c175