Skip to main content

Dossier — AWS demonstrable use-case catalog for a HIPAA-compliant healthcare platform (2026-09-04)

Generated at build time from research/aws-demo-catalog/dossier.md in the repo — edit the source, not this page.

Lead synthesis of brief.md, catalog-v0.md, comparison.md (C1–C79, X1–X9, G1–G16) and validation.md. Every claim below carries its comparator id (C-n), the date of its primary source, the primary URL, and one of three confidence labels:

  • High (validated) — the validator re-fetched the primary source on 2026-09-04 and it says what the claim says.
  • Medium — primary facts verified but the claim is a synthesis, inference or fit judgement; or the validator could positively verify only part of it.
  • Scout-only — a sub-fact the validator did not re-check (listed inline as "Scout-only:" so downstream teams know which detail is single-sourced).

Validator summary as received: 74 CONFIRMED / 0 UNSOURCED / 4 CONTESTED of 78 verdict-bearing claims (C59 was a gap placeholder, since closed by the validator). The four CONTESTED claims (C11, C24, C29, C46) are carried with the validator's corrected wording. Three CONFIRMED claims had an unsourced or wrong sub-claim (C1, C43, C69); the sub-claims are removed or corrected here and listed in §6. The validator's twelve-item downgrade list is applied in full (each application is marked "[downgrade n]" in §3).

Resulting label counts across the 79 claims (C1–C79): High (validated) 74 · Medium 5 (C18, C34, C52, C65, C71) · Scout-only whole claims 0 (15 Scout-only sub-facts flagged inline). Four claims carry a Medium-Low sub-claim on HIPAA eligibility by the feature rule (C11, C28, C47, C55).

The companion deliverable, catalog-v1.md, applies these findings item by item; this dossier is the evidence layer it cites.

1. Topic summary​

An AWS-using consultant/engineer wants a small catalog of demonstrable use cases (not a service tour) that together show how modern AWS is used to build a healthcare-grade platform: a responsive web portal plus native iOS and Android apps, HIPAA-compliant, with generative AI embedded in the workflows through Amazon Bedrock and AgentCore, and custom ML models trained on high volumes of connected-device data with SageMaker AI. Each catalog item (F0 landing zone, U1 patient portal, U2 remote patient monitoring, U3 ambient clinical documentation, U4 document intake, U5 population-health data platform, U6 contact centre, P0 the education portal itself) is meant to become a public repo that takes an empty account to a running deployment plus a chapter in an education portal. The research question was twofold: what already exists publicly for each item (so nothing is rebuilt that AWS or the community already demonstrates), and what the September 2026 building blocks are — HIPAA-eligible services, health-specific service lifecycles and prices, the recommended mobile/push/device stack, and how AWS structures learn-by-deploying content. Four scouts covered those angles; the comparator reconciled them into 79 claims; the validator re-fetched every cited primary source.

2. Headline findings​

One to three per catalog item, strongest evidence first. Label in brackets.

F0 — HIPAA-ready landing zone​

U1 — Patient portal + companion mobile app​

  • No AWS-official U1 Tier 1 exists (portal + native iOS/Android + Cognito + HealthLake); three independent absence searches (REPO, PORT, MOB) plus validator spot-checks (org:aws-samples patient portal → 0). Highest-value new build. — C13. [High (validated), absence]
  • Amplify Gen 2 is the only supported path: Gen 1 in maintenance from 2026-05-01, EOL 2027-05-01 (amplify-cli #14881, 2026-05-14). Swift 2.60.2 (2026-09-01) and Android 2.41.1 (2026-09-02) have passkeys and AppSync Events; Flutter 2.15.0 (2026-08-19) has neither (#6094, #6106 open; WebAuthn PR #6851 draft since 2026-04-08). — C15, C16. https://github.com/aws-amplify/amplify-cli/issues/14881 [High (validated)]
  • Amazon Pinpoint end of support 2026-10-30 (no new customers since 2025-05-20). AWS-named successors: push/SMS/voice/OTP → AWS End User Messaging (same send-messages API); email → SES; engagement → Amazon Connect Customer outbound campaigns + Customer Profiles (push possible via journeys + Lambda action); analytics → Kinesis; In-App Messaging has no successor. SNS mobile push is documented, undeprecated and valid but not the named successor. — C20, C21. https://docs.aws.amazon.com/pinpoint/latest/userguide/migrate.html [High (validated)]

U2 — Remote patient monitoring at scale​

  • No end-to-end RPM example exists (devices → IoT Core → Kinesis → Flink → InfluxDB/Iceberg → alerts → app) and AWS publishes no guidance at all for HealthKit or Health Connect ingestion. Every U2 tier is new work. — C26, C30. [High (validated), absence]
  • The phone → IoT Core path AWS documents is Cognito identity pool + IAM role plus an IoT policy attached to the Cognito identity; iOS via AWS IoT Device SDK for Swift (GA 2026-06-24, Apache-2.0, MQTT 5 per the IoT SDKs docs page); Android via IoT Device SDK for Java v2; Amplify Swift/Android have no PubSub category. The classic AWS Mobile SDKs reached end of support 2026-08-01. — C29 (corrected), C17. https://docs.aws.amazon.com/iot/latest/developerguide/cognito-identities.html [High (validated)]
  • Two independent weaknesses converge on the hot/cold stores: no IoT Core → Timestream for InfluxDB sample with IaC exists, and neither Timestream for InfluxDB nor S3 Tables appears on the HIPAA Eligible Services Reference by name (only "Amazon Timestream" and "Amazon S3"). — C28, C55. https://aws.amazon.com/compliance/hipaa-eligible-services-reference/ [High (validated) for absence; Medium-Low for eligibility — G2/G3 open]

U3 — Ambient clinical documentation​

  • HealthScribe is us-east-1 only, en-US, US$0.10/min, HIPAA-eligible under "AWS Transcribe [Includes Healthscribe]", and its developer guide now carries a banner steering to Connect Health Ambient. This is the binding region constraint for the whole catalog. — C35. https://docs.aws.amazon.com/transcribe/latest/dg/health-scribe.html [High (validated)]
  • Amazon Connect Health GA 2026-03-05, HIPAA-eligible, us-east-1 + us-west-2; GA: patient verification, ambient documentation; preview: appointment management, patient insights; gated preview: medical coding. Pricing (validator, G14 closed): ambient documentation US$99/user/month (600 encounters), overage US$0.036/min; patient verification US$0.15/action. — C37, C60. https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-connect-health-agentic-ai-healthcare/ [High (validated)]
  • The best Connect Health sample cannot be linked as-is: sample-amazon-connect-health-unified-clinical-workflow (pushed 2026-08-31) uses Bedrock Agents classic with six action groups and needs a registered Connect instance + Connect Health domain. The best stack-spine match is sample-healthscribe-bedrock-clinical-analysis (CDK TS, Fargate, React+Vite, Cognito, CloudFront, pushed 2026-04-07, empty→running). — C38, C39. [High (validated)]

U4 — Intelligent document intake​

  • U4 is the best-covered item. GenAI IDP Accelerator (accelerated-intelligent-document-processing-on-aws, pushed 2026-09-04, 302 stars, MIT-0): one-click CloudFormation in us-east-1/us-west-2/eu-central-1, Pattern 1 = Bedrock Data Automation, Pattern 2 = Textract → Bedrock, built-in human review (not A2I), MLflow evaluation, MCP via AgentCore Gateway. — C44, C51. https://github.com/aws-solutions-library-samples/accelerated-intelligent-document-processing-on-aws [High (validated)]
  • sample-healthcare-agents (pushed 2026-09-03, CDK TS, AgentCore Runtime + Gateway, Strands, HealthLake FHIR R4, Comprehend Medical, B2B Data Interchange 837P, CDS Hooks) is full for U4 Tier 2 — prior auth, eligibility, coding, claims, appeals. Corrected: it has payor-policy PDF upload tools but no patient/clinical-document intake. — C46 (corrected). https://github.com/aws-samples/sample-healthcare-agents [High (validated)]
  • BDA is the 2026 default in AWS's own code; Textract is on the HIPAA list by name, BDA only via the GA-features rule. — C47. [High (validated) for default; Medium-Low for BDA eligibility]

U5 — Population health analytics and risk models​

  • Closest artefact is the Multi-Modal Data Analysis Guidance (pushed 2024-12-17, MIT-0): notebook-driven, QuickSight-era (now Amazon Quick), no S3 Tables/Iceberg, no de-identification, no cost table. All healthcare readmission/outcome samples are 2021–2022; the generic Pipelines/Model Registry CDK spine (amazon-sagemaker-pipeline-deploy-manage-100x-models-python-cdk) is current (2026-07-28). — C53, C57. [High (validated)]
  • Clarify successor (G5, closed by validator): SageMaker Clarify is "no longer open to new customers … we do not plan to introduce new features"; AWS points to open-source monitoring (aws-samples/sample-aiops-on-amazon-sagemakerai/monitoring), bias metrics in pandas/scikit-learn, SHAP, SageMaker AI MLflow, CloudWatch, Quick and Bedrock Evaluations (FM evaluation only). Model Monitor, A2I, Ground Truth and Debugger are likewise in maintenance (no new customers from 2026-07-30). — C59 (now resolved). https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-availability-change.html [High (validated)]

U6 — Contact centre with AI agents (optional)​

  • Connect Health makes U6 Tier 1's identity verification (GA) and scheduling (preview) first-party product features, not Lex + Lambda code; sample-healthcare-realtime-eligibility (2026-03-03) plugs eligibility into it. Amazon Connect and Lex are HIPAA-listed. — C60, C61. https://aws.amazon.com/products/connect/health/ [High (validated)]
  • The modern-agent-stack U6 Tier 2 sample is sample-Nova-Sonic-AgentCore-Healthcare-Call-Center (2026-05-21, CDK Python, MIT not MIT-0, no Amazon Connect). sample-amazon-connect-bedrock-agent-voice-integration (2025-11-18) uses Bedrock Agents classic and cannot be linked. — C62, C63. [High (validated)]

P0 — Education portal​

  • P0 is build-new: no public "education portal" repo for this purpose exists. AWS's three content surfaces have stable, copyable contracts — Workshop Studio contentspec.yaml v2.0 (accountSources: [WorkshopStudio, CustomerProvided]), the Solutions Library Guidance page anatomy (cost table and deploy steps live in the repo README, not the page), and the aws-samples MIT-0 README convention with serverless-patterns' _pattern-model/example-pattern.json as the smallest proven docs-from-metadata contract. Repo-generated site precedents: HCLS Agents Toolkit GitHub Pages (Astro) and eks-workshop-v2 (Docusaurus). — C66, C68, C69 (path corrected), C70. [High (validated)]
  • Every Workshop Studio / Builder Center page is client-rendered and unreadable to the fetch tool; every "link this workshop" judgement rests on titles and backing repos and is provisional until a browser session closes G1. — C67. [High (validated) that it is a gap]

Cross-cutting​

  • Dossier item F-15 closes as confirmed: Bedrock FAQ — "your content is not used to improve the base models and is not shared with any model providers"; compliance list HIPAA eligible, SOC 1/2/3, ISO 9001/27001/27017/27018/27701/22301/20000, CSA STAR L2, GDPR, FedRAMP Moderate; FedRAMP High in GovCloud (US-West). — C72. https://aws.amazon.com/bedrock/faqs/ [High (validated); the "per-region model deployment accounts" phrase stays Medium]
  • Bedrock Guardrails sensitive-information filters evaluate model text only — verbatim, they do not evaluate toolUse.input, toolResult or toolSpec.*; invocation logs always contain the unmodified request; built-in health types are only CA and UK health numbers. The mechanism that makes "Guardrails at the tool boundary" achievable is AgentCore Gateway (AWS ML blog 2026-06-01): Cedar-based Policy on tool access, Lambda REQUEST interceptors with read/write on the tool body, RESPONSE interceptors that "can also integrate with … Amazon Bedrock Guardrails for … PII redaction". No healthcare sample of this exists. — C74, C75. https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html ; https://aws.amazon.com/blogs/machine-learning/secure-ai-agents-with-policy-and-lambda-interceptors-in-amazon-bedrock-agentcore-gateway/ [High (validated)]
  • Claude Fable 5 / 5.1 require the aws_review retention mode (up to 30 days within AWS; classifier-flagged traffic may be human-reviewed by AWS); Opus 4.8 permits none; enforceable by SCP on bedrock:DataRetentionMode / bedrock-mantle:DataRetentionMode; retained data lands in the inference destination region. — C73. https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html [High (validated) facts; Medium for the routing inference]
  • Every catalog-named service is on the HIPAA Eligible Services Reference (Last Updated 2026-09-03) except, by name, S3 Tables, Timestream for InfluxDB, the Valkey engine, and Bedrock Knowledge Bases / Guardrails / Data Automation — all of which rest solely on "generally available features of each of the HIPAA eligible services listed are also considered HIPAA eligible". — C11 (corrected). [High (validated) for listed services; Medium-Low for the feature-rule set]
  • Region: us-east-1 is the only region where every catalog service and sample works; the constraint is HealthScribe alone (HealthLake is in seven regions incl. both defaults; Connect Health in both; Device Farm us-west-2 only). — C78, C24 (corrected), C25. [High (validated) facts; Medium for "pin us-east-1"]

3. Full claim register (corrections applied)​

Format: C-n — claim · source date · primary URL · label. "[downgrade n]" marks where a validator downgrade-list item was applied.

F0​

U1​

U2​

  • C26 — No end-to-end RPM example; no AWS HealthKit/Health Connect guidance. · absence · High (validated), absence
  • C27 — Components: guidance-for-aws-iot-greengrass-foundations (CDK v2 TS, pushed 2026-07-23, MIT-0); aws-greengrass-ec2-device-farm (CDK v2, 2026-08-30, Apache-2.0, simulated fleet); flink-keyed-random-cut-forest-example (2025-12-19, MIT-0, no IaC); amazon-sagemaker-deepar-mlops-pipeline-cdk (2025-04-10, MIT-0); aws-appsync-iot-core-realtime-dashboard (Amplify Gen 2, npx ampx sandbox, pushed 2026-09-03, MIT-0, 126 stars). · GitHub API 2026-09-04 · High (validated). Scout-only: transactional-datalake-using-amazon-datafirehose-iceberg.
  • C28 — No IoT Core → Timestream for InfluxDB sample with IaC; "Timestream for InfluxDB" absent from the HIPAA list (only "Amazon Timestream"). · https://aws.amazon.com/compliance/hipaa-eligible-services-reference/ · High (validated) for absence; Medium-Low for eligibility (G3)
  • C29 (CONTESTED → corrected) — Phone → IoT Core: Cognito identity pool + IAM role plus an IoT policy attached to the Cognito identity (AttachPolicy); MQTT over WebSocket/SigV4. iOS: AWS IoT Device SDK for Swift GA 2026-06-24 (What's New; macOS/iOS/tvOS/Linux; Shadow/Jobs/Fleet Provisioning; TLS 1.3; Apache-2.0); MQTT 5 per the IoT SDKs docs page; iOS-version floor not sourced (needs the SDK README) [downgrade 4]. Android: IoT Device SDK for Java v2. Amplify Swift/Android: no PubSub. No AWS guidance for X.509 per phone. · https://docs.aws.amazon.com/iot/latest/developerguide/cognito-identities.html ; https://aws.amazon.com/about-aws/whats-new/2026/06/aws-iot-device-sdk-swift/ · High (validated)
  • C30 — HealthKit / Health Connect are on-device stores; Apple guideline 5.1.3(ii) forbids storing personal health information in iCloud; Health Connect has background reads and sync. Only AWS-adjacent code: cleverdevil/healthlake (community, archived, pushed 2022-06-08, no licence). · https://developer.apple.com/app-store/review/guidelines/ ; https://developer.android.com/health-and-fitness/guides/health-connect · High (validated)
  • C31 — aws-amplify-cdk-iot-ble-swift-app: CDK v1→v2 migration commits 2026-06-09 (least-privilege IoT policy), but BLEX/Podfile pins Amplify ~> 1.0, AWSIoT, AWSMobileClient (classic SDK, EOS 2026-08-01); README still "CDK 1.105.0". Fork the CDK/IoT-policy structure only. · https://github.com/aws-samples/aws-amplify-cdk-iot-ble-swift-app · High (validated)
  • C32 — U2 Tier 2 (telemetry as typed MCP tools): no example; Guardrails PII filter does not evaluate tool I/O (see C74/C75). · High (validated)
  • C33 — SageMaker Edge Manager inaccessible since 2024-04-26 (AWS: ONNX + Greengrass v2); greengrass-v2-sagemaker-edge-manager-python (dead component dependency) and amazon-sagemaker-aws-greengrass-custom-timeseries-forecasting (archived 2024-07-26, IoT Analytics + Greengrass v1) cannot be linked; only current Greengrass-v2 ML Guidance is Strands SLM-at-edge (pushed 2025-10-27, MIT-0). · https://docs.aws.amazon.com/sagemaker/latest/dg/edge-eol.html · High (validated)
  • C34 — Flink → SageMaker endpoint pattern exists generically (amazon-sagemaker-feature-store-streaming-inference-msk-kda, 2024-01-04, fraud domain, "KDA" naming); "AWS IoT Greengrass" listed without version qualifier. · Medium (fit)

U3​

  • C35 — HealthScribe GA 2023-11-27; GIRPP template 2025-02; "AWS Transcribe [Includes Healthscribe]"; "available in the US East (N. Virginia) region"; US$0.10/min; en-US; Connect Health Ambient banner. sup-hcls-generate-clinical-notes-with-ai (pushed 2024-07-23, MIT-0) ships a Transcribe/Transcribe Medical fallback "for regions where HealthScribe is not yet available". · https://docs.aws.amazon.com/transcribe/latest/dg/health-scribe.html ; https://aws.amazon.com/healthscribe/pricing/ · High (validated)
  • C36 — Transcribe Medical and Comprehend Medical quiet, not retired (docs live, absent from the 2026-06 maintenance post; Comprehend Medical ICD-10-CM model refreshed 2025-02-10 and 2025-08-05); medical-transcription-analysis pushed 2023-07-18; amazon-comprehend-medical-fhir-integration archived 2024-07-24 [downgrade 9]. · High (validated). Scout-only: last What's New dates 2021-01 / 2020-07.
  • C37 — Connect Health GA 2026-03-05; HIPAA-eligible; us-east-1 + us-west-2; patient verification GA, ambient documentation GA, appointment management preview, patient insights preview, medical coding gated preview. AI-landscape dossier's 2026-04-28 date is the Connect rename post (X9). · https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-connect-health-agentic-ai-healthcare/ · High (validated)
  • C38 — sample-amazon-connect-health-unified-clinical-workflow (pushed 2026-08-31, MIT-0, three CloudFormation stacks): Bedrock Agents classic with six action groups; prerequisites include a registered Connect instance, Connect Health domain, HealthLake datastore; coding gated preview. Sibling sample-amazon-connect-health-point-of-care (pushed 2026-03-31, MIT-0, CloudFormation): direct Bedrock synthesis, no Agents, but needs a Connect Health domain and subscription + HealthLake (G16 closed). · https://github.com/aws-samples/sample-amazon-connect-health-unified-clinical-workflow · High (validated)
  • C39 — sample-healthscribe-bedrock-clinical-analysis (pushed 2026-04-07, MIT-0): CDK TS; Fargate WebSocket service behind ALB; React + Vite on S3/CloudFront; Cognito; HealthScribe streaming; 12 specialist agents orchestrated by Step Functions; ./deploy.sh dev with ACM cert ARN; no HealthLake write-back or Comprehend Medical coding. · https://github.com/aws-samples/sample-healthscribe-bedrock-clinical-analysis · High (validated)
  • C40 — Guidance "Identifying Diagnosis Codes from Clinical Notes on AWS": repo CDK Python, MIT-0, pushed 2026-04-13, 4 stars; README "approximately $500 per month" (April 2025), OpenSearch Serverless US$350.42. Scope caveat [downgrade 7]: the code implements S3 → Lambda → Comprehend Medical → Bedrock (Claude) → OpenSearch Serverless only; HealthScribe, Lake Formation, Athena and QuickSight are on the page diagram, not in the repo. No review UI, Step Functions or HealthLake write-back. · https://docs.aws.amazon.com/solutions/identifying-diagnosis-codes-from-clinical-notes-on-aws/ ; https://github.com/aws-solutions-library-samples/guidance-for-identifying-diagnosis-codes-from-clinical-notes-on-aws · High (validated)
  • C41 — aws-healthscribe-demo (pushed 2025-04-08, MIT-0, 60 stars) is Amplify Gen 1 (aws-amplify ^6.14, no @aws-amplify/backend). · https://github.com/aws-samples/aws-healthscribe-demo · High (validated). Scout-only: CodeCommit-based docs/deploy.md.
  • C42 — U3 Tier 3: none; only LLM-as-judge / clinical-report evaluation notebooks (healthcare-LLM-as-a-Judge, eval-genai-techniques-clinicalreport 2024-04-15). · High (validated), absence
  • C43 — Comprehend Medical DetectPHI returns entities with offsets and scores, does not redact; entities "don't map 1:1 to the … Safe Harbor method"; FAQ: "does not meet the requirements for de-identification of protected health information in accordance with HIPAA." The sentence "Transcribe (Medical) PHI identification is free in all regions" is removed — unsourced [downgrade 5]. · https://docs.aws.amazon.com/comprehend-medical/latest/dev/textanalysis-phi.html ; https://aws.amazon.com/comprehend/medical/faqs/ · High (validated)

U4​

  • C44 — GenAI IDP Accelerator: pushed 2026-09-04, MIT-0, 302 stars; regions us-west-2/us-east-1/eu-central-1; Pattern 1 BDA, Pattern 2 OCR → Bedrock; built-in HITL (no A2I); MLflow optional; Cognito + WAF; MCP via AgentCore Gateway; CDK and Terraform alternates. · https://github.com/aws-solutions-library-samples/accelerated-intelligent-document-processing-on-aws · High (validated). Scout-only: version v0.6.6.
  • C45 — IDP Guidance page: AgentCore Runtime / Identity (Cognito workload token) / Gateway (MCP), Strands, Textract, ECS chat dashboard, AgentCore Observability; Security pillar names Comprehend Medical PHI identification/redaction; Operational Excellence pillar still carries legacy Step Functions/Comprehend text. Sample aws-ai-intelligent-document-processing (pushed 2026-05-04, 244 stars): README describes the same multi-agent AgentCore architecture (G13 narrowed) but GitHub detects no licence (README says MIT-0) — confirm LICENSE text before forking [downgrade 8]. · https://docs.aws.amazon.com/solutions/intelligent-document-processing-on-aws/ ; https://github.com/aws-samples/aws-ai-intelligent-document-processing · High (validated) page; Medium repo
  • C46 (CONTESTED → corrected) — sample-healthcare-agents: pushed 2026-09-03, MIT-0; infra-cdk/ TypeScript, cdk deploy --all; Amplify-hosted React + Cognito OIDC; AgentCore Runtime + Gateway; Strands (LangGraph alternative); HealthLake FHIR R4; Comprehend Medical; B2B Data Interchange EDI 837P; CDS Hooks; six workflows (prior auth, eligibility, coding, claims assembly, claims submission, appeals). Corrected: no patient/clinical-document intake, but it has payor-policy PDF upload/search tools (upload_policy_document, list_policy_documents) into a knowledge base [downgrade 6]. · https://github.com/aws-samples/sample-healthcare-agents · High (validated)
  • C47 — BDA is the default pattern in AWS's own code; "Amazon Textract" is on the HIPAA list, "Bedrock Data Automation" is not (feature rule). Two official workshops exist ("Intelligent Document Processing with AWS AI Services"; "Document Processing with Amazon Bedrock Data Automation"). · High (validated) default; Medium-Low BDA eligibility. Scout-only: workshop titles/coverage (client-rendered).
  • C48 — sample-scalable-intelligent-document-processing-with-amazon-bedrock-data-automation (pushed 2026-07-28) uses A2I + Ground Truth labelling workforces → cannot link; amazon-textract-idp-cdk-constructs stale (2024-04-29). · High (validated)
  • C49 — aws-ai-phi-deidentification (pushed 2025-04-23, MIT-0; Textract → Comprehend Medical → redaction UI, CDK) is the only deployable de-id pipeline found; Clario blog 2026-08-19: Bedrock PHI detection F1 0.9775 (PDF), 0.9750 (DICOM burned-in), 0.9951 (DICOM tags) with human review. · https://github.com/aws-samples/aws-ai-phi-deidentification ; https://aws.amazon.com/blogs/architecture/how-clario-automates-phi-pii-detection-in-dicom-images-using-amazon-bedrock/ · High (validated) repo; Medium for the Bedrock pattern and "only" (absence)
  • C50 — U4 Tier 3: none; the Accelerator classifies with Bedrock. · High (validated), absence
  • C51 — U4 is the best-covered item; lowest new-build value at Tier 1–2. · High (validated), judgement
  • C52 — "Guidance for Ingesting PDF and Image Files to AWS HealthLake" is architecture-only (no sample-code link); "Intelligent Healthcare Systems: FHIR, AI, and AWS HealthLake" workshop is the nearest healthcare IDP tutorial (modules unreadable). · https://aws.amazon.com/solutions/guidance/ingesting-pdf-and-image-files-to-aws-healthlake/ · Medium (workshop coverage Scout-only)

U5​

  • C53 — Multi-Modal Data Analysis Guidance: pushed 2024-12-17, MIT-0; one-click CloudFormation SageMaker domain + sequential notebooks; HealthOmics/HealthLake/HealthImaging → Lake Formation → Athena → QuickSight; Feature Store → AutoGluon → endpoint; Synthea Coherent; no cost table, no Iceberg/S3 Tables, no de-identification. · https://github.com/aws-solutions-library-samples/guidance-for-multi-modal-data-analysis-with-aws-health-and-ml-services · High (validated)
  • C54 — Patient Entity Resolution Guidance (pushed 2025-09-11, MIT-0; AWS Entity Resolution over HealthLake identifiers; CloudFormation + Lambda) = EMPI component. · https://github.com/aws-solutions-library-samples/guidance-for-patient-entity-resolution-with-aws-healthlake · High (validated). Scout-only: the "Patient Matching" workshop.
  • C55 — S3 Tables absent from the HIPAA list by name ("Amazon Simple Storage Service (S3)" and "Amazon S3 Glacier" only); no healthcare sample lands data in S3 Tables. · High (validated) absence; Medium-Low eligibility (G2)
  • C56 — "Amazon Quick" is HIPAA-listed; every U5 artefact still says QuickSight; healthlake-workshop archived (pushed 2026-01-29). · High (validated)
  • C57 — Healthcare readmission/outcome samples are 2021–2022 (amazon-sagemaker-data-wrangler-hospital-readmission-prediction 2021-10-25; aws-ml-readmission-prediction 2022-04-18; amazon-healthlake-patient-outcome-prediction archived 2022-09-07); generic MLOps CDK spine current (2026-07-28). · High (validated). Scout-only: Clean Rooms ML samples (2026-05/07).
  • C58 — extract-medical-insights-from-amazon-healthlake-with-bedrock (pushed 2024-11-05, Apache-2.0; Streamlit; Bedrock text-to-SQL over Athena/FHIR; no IaC). · https://github.com/aws-samples/extract-medical-insights-from-amazon-healthlake-with-bedrock · High (validated)
  • C59 (resolved by validator) — Clarify: "no longer open to new customers … we do not plan to introduce new features"; replacements named by AWS: aws-samples/sample-aiops-on-amazon-sagemakerai/monitoring, pandas/scikit-learn bias metrics, SHAP, SageMaker AI MLflow, CloudWatch, Quick, Bedrock Evaluations (FM only, "not a replacement for predictive … bias detection"). Model Monitor, A2I, Ground Truth, Debugger also in maintenance (no new customers from 2026-07-30). · https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-availability-change.html · High (validated)

U6​

  • C60 — Connect Health product capabilities as in C37; sample-healthcare-realtime-eligibility (pushed 2026-03-03, MIT-0) is an RTE Lambda for Connect Health. Pricing: ambient US$99/user/month (600 encounters), overage US$0.036/min; verification US$0.15/action; 60-day / 30,000-action free tiers. · https://aws.amazon.com/products/connect/health/ · High (validated)
  • C61 — "Amazon Connect" and "Amazon Lex" on the HIPAA list (the product is now marketed as Amazon Connect Customer per the AI-landscape dossier). · High (validated)
  • C62 — sample-amazon-connect-bedrock-agent-voice-integration (pushed 2025-11-18, MIT-0, CDK TS): Bedrock Agent custom actions via Lex → cannot link; Connect + Lex + CDK structure reusable. · High (validated). Scout-only: voice-enabled-patient-diary Lex version.
  • C63 — sample-Nova-Sonic-AgentCore-Healthcare-Call-Center (pushed 2026-05-21, MIT, CDK Python, AgentCore + Nova 2 Sonic over WebSocket, no Amazon Connect). · https://github.com/aws-samples/sample-Nova-Sonic-AgentCore-Healthcare-Call-Center · High (validated)
  • C64 — No healthcare-specific Connect workshop or Guidance; U6 Tier 3 demand forecasting is a Connect product feature. · High (validated), absence. Scout-only: the Connect forecasting workshop.
  • C65 — Because Pinpoint's engagement successor is Connect Customer campaigns + Customer Profiles, U1 reminders/journeys and U6 share a service. · Medium (inference)

P0​

Cross-cutting​

  • C72 — F-15 closed (see §2). "Per-region model deployment accounts" phrase not on the fetched pages → Medium. · https://aws.amazon.com/bedrock/faqs/ ; https://aws.amazon.com/bedrock/security-compliance/ · High (validated)
  • C73 — Retention modes none < default < aws_review < provider_data_share; Fable 5 / 5.1 allowed_modes: ["aws_review", "provider_data_share"]; Opus 4.8 permits none; 30-day boundary; SCP keys; destination-region storage; Enterprise Frontier Safeguards ZDR through 2026-12-31. Design consequence (Medium): an SCP pinning none on PHI accounts makes Fable 5.1 unavailable there by construction. · https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html ; https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html · High (validated) facts
  • C74 — Guardrails scope (see §2). · https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html · High (validated)
  • C75 — AgentCore Gateway Policy + interceptors (see §2). · AWS ML blog 2026-06-01 · High (validated)
  • C76 — Security Hub CSPM "AI Security Best Practices" standard (network isolation, encryption, VPC placement, KMS); practical HIPAA pairing = FSBP + NIST 800-53 r5 + Config HIPAA pack. · https://docs.aws.amazon.com/securityhub/latest/userguide/standards-reference.html · High (validated); pairing is a recommendation
  • C77 — Retired-service dependents (see §7). · High (validated)
  • C78 — us-east-1 as primary demo region; binding constraint is HealthScribe alone. · High (validated) facts; Medium inference
  • C79 — Licence census: MIT-0 default; Apache-2.0 on LZA, aws-greengrass-ec2-device-farm, extract-medical-insights-…, eks-workshop-v2, IoT Device SDK for Swift; MIT on sample-Nova-Sonic-…; CC-BY-SA-4.0 on SRA examples and on the whole of amazon-archives/medical-mobile-iot-with-aws; no licence on cleverdevil/healthlake; aws-ai-intelligent-document-processing has no GitHub-detected licence [downgrade 8]. · High (validated). Scout-only: the Clean Rooms sibling.

4. Contradictions​

Both sides stated with sourcing. "Resolved" only where a primary check settled it; "Unresolved — decision" where the sources show a trade-off and the choice is recorded in catalog-v1.md as a lead decision, not a finding.

#ContradictionSide A (source)Side B (source)Status
X1"Guardrails at the tool boundary" (catalog-v0 U2 T2 and every Tier 2 line)catalog-v0 assumed a Bedrock Guardrail on the model call covers MCP tool I/OGuardrails doc (C74): tool inputs/results/definitions are not evaluated; AgentCore Gateway blog 2026-06-01 (C75): interceptors + Cedar Policy can call Guardrails on tool I/OResolved as a design correction. catalog-v0's wording was wrong; the intent is achievable via Gateway REQUEST/RESPONSE interceptors calling ApplyGuardrail, Cedar Policy on tool access, and CloudWatch Logs data-protection policies (logs keep the raw prompt). Open residue: no healthcare sample exists; whether the interceptor Lambda is an acceptable PHI processor is a risk-analysis question (new gap G17).
X2Pinpoint successorcatalog-v0: "SNS/EventBridge successor"Migration guide (C21): push/SMS/voice/OTP → End User Messaging; email → SES; engagement → Connect Customer; analytics → Kinesis; EventBridge not namedResolved. EUM is the named push successor; SNS mobile push is a supported alternative (not deprecated); EventBridge is a fan-out mechanism, not a successor. Residual (new gap G18): AWS names the APIs as unaffected, not the Pinpoint application resource that EUM Push uses as --application-id.
X3Connect Health reshaping U3/U6REPO/COMP: Connect Health is current and eligible in both regions; REPO called the unified-workflow sample "near-full"Comparator + validator: that sample uses Bedrock Agents classic and needs a Connect instance + Connect Health domain + HealthLake; PORT never saw Connect HealthPartly resolved (sample is not near-full; product is real). Unresolved by evidence — lead decision: U3 Tier 1 on HealthScribe direct (CDK TS sample fits the spine, us-east-1 only, US$0.10/min) vs Connect Health Ambient (both regions, US$99/user/month subscription, Connect instance required, couples U3 to U6). Recommendation recorded in catalog-v1 §U3.
X4U3 fork baseREPO: sample-healthscribe-bedrock-clinical-analysis (CDK TS, UI, no coding step)PORT: diagnosis-codes Guidance (CDK Python; repo implements only Comprehend Medical → Bedrock → OpenSearch Serverless — C40 caveat)Unresolved by evidence — lead composition decision (catalog-v1 §U3): fork the CDK-TS sample for structure, port the Comprehend Medical ICD-10 step from the Guidance repo, build review + write-back.
X5U5 Tier 3REPO: "stale only → build"PORT: "fork the Multi-Modal Guidance"Unresolved by evidence — lead decision (catalog-v1 §U5): fork modelling content, build infrastructure on the 2026-07-28 Pipelines/Registry CDK spine.
X6BLE Swift sample freshnessREPO: stale, CDK v1MOB: migrated to CDK v2 2026-06-09Resolved — both half right (C31): CDK current, iOS layer on an EOS SDK. Fork CDK only.
X7"Zero AWS-official Amplify Gen 2 samples"REPO (name/description search)MOB: aws-appsync-iot-core-realtime-dashboard is Gen 2Resolved (C27): no Gen 2 sample with healthcare framing or a native-mobile client; at least one Gen 2 web + IoT Core sample exists.
X8U4 primary artefactREPO: IDP Accelerator + sample-healthcare-agentsPORT: IDP Guidance + two workshopsComplementary, not conflicting. Lead choice (catalog-v1 §U4): Accelerator = primary link; sample-healthcare-agents = Tier 2 fork; Guidance page = architecture explainer; Guidance repo fork blocked on licence check (C45).
X9Connect Health GA dateAI-landscape dossier: 2026-04-28REPO + COMP: What's New 2026-03-05Resolved: 2026-03-05. The AI dossier (research/aws-ai-services-landscape/dossier.md line 35) should be corrected downstream.

Unresolved after this pass: X3 (HealthScribe vs Connect Health for U3 Tier 1), X4 (U3 fork base), X5 (U5 Tier 3 fork-vs-build) — all three are trade-offs the sources describe but cannot settle; the lead's choices are in catalog-v1 and marked as decisions.

5. Gaps​

Closed or narrowed during this pass​

  • G5 Clarify successor — closed by validator (C59).
  • G13 IDP Guidance repo contents — narrowed: README matches the page architecture; remaining risk is the undetected licence (C45).
  • G14 Connect Health pricing — closed (C60).
  • G16 sample-amazon-connect-health-point-of-care — closed: direct Bedrock calls, not Agents classic; still needs a Connect Health domain + subscription (C38).

Still open​

#GapImpactNext step
G1Workshop Studio module lists for every healthcare workshop (HealthLake, SMART on FHIR, Intelligent Healthcare Systems, Patient Matching, HCLS Agents) and the component workshops; HealthScribe workshop URL never locatedEvery "link this workshop" verdict is provisionalBrowser session before any chapter links a workshop
G2S3 Tables HIPAA eligibility by name (re:Post thread 403)U5/U2 cold pathAsk the AWS account team; until then keep the Iceberg landing de-identified
G3Timestream for InfluxDB HIPAA eligibility by name (FAQ sentence sits under LiveAnalytics)U2 hot pathSame as G2; keep hot-store rows device-keyed and de-identified
G4IoT Core → Timestream for InfluxDB sample with IaC — noneU2 T1 is new work regardless of G3Build
G6Comprehend Medical per-unit prices (DetectPHI, ICD-10-CM, RxNorm) and primary region listCost tables for U3/U4/U5Fetch the pricing page in a browser
G7Whether HIPAA is among Control Catalog's "seven new compliance frameworks" (2025-06 / 2025-11)F0b controls-dedicated pathCheck Control Catalog docs
G8Amplify compliance page unreadable; Gen 2 backend eligibility rests on per-service list + "AWS Amplify Console"; Android feature-matrix REST ambiguityU1 compliance chapter wordingBrowser fetch
G9"Guidance for Patient Outcome Prediction on AWS" — docs URL 404; related repo archived 2022U5 T3 (treat as retired)None needed unless AWS re-publishes
G10Bedrock IL4/IL5; Anthropic third-party model terms pageCompliance chapter completenessFetch terms page
G11An AWS recommendation (not just supported paths) for HealthKit / Health Connect / BLE ingestionU2 device-pairing chapter must say "no AWS guidance; this is our pattern"None available; state plainly
G12Exact wording of Amplify's "Migrate from Pinpoint-backed features" pageU1 push chapterBrowser fetch
G15Community "Apple Watch → IoT Core → Flutter dashboard" repo — never locatedNoneTreat as non-existent
G17 (new)Whether an AgentCore Gateway interceptor Lambda that reads raw PHI to call ApplyGuardrail is an acceptable PHI processor under the requester's risk analysisEvery Tier 2 designRisk-analysis decision, not a sourcing task
G18 (new)Whether the Pinpoint application resource used as EUM Push --application-id survives 2026-10-30 (AWS names APIs, not the resource)U1/U2 push channel choiceConfirm with AWS before 2026-10-30; SNS mobile push is the fallback
G19 (new)iOS minimum version for AWS IoT Device SDK for Swift (What's New is silent)U2 mobile floorRead the SDK README
G20 (new)Transcribe / Transcribe Medical PHI-identification pricing (pricing page silent)U3 cost tableConfirm on the pricing page or via account team
G21 (new)HealthLake demo cost: pricing page implies ≈US$197/month per data store (US$0.27/hr) while sample-intelligent-security-for-healthcare-apis README says "~$500/month" — probably storage/query included, not verifiedCost tablesReconcile when building the cost chapter

6. Flagged — insufficient sourcing​

No whole claim was UNSOURCED. These sub-claims were removed or corrected and are listed so a deep pass knows what still needs evidence:

ClaimSub-claimAction takenWhat would source it
C1Quoted phrase "not designed for single-account deployments"Removed; replaced with the LZA Mandatory-accounts and Prerequisites wordingIt does not exist in LZA docs — do not reinstate
C43"Transcribe (Medical) PHI identification is free in all Transcribe regions"RemovedA Transcribe pricing-page statement (G20)
C69Root-level example-pattern.json pathCorrected to _pattern-model/example-pattern.jsonDone
C72"Per-region model deployment accounts" phraseKept at MediumThe Bedrock data-protection page, not fetched
C29"iOS 16+" and MQTT5 attributed to the What's NewiOS floor removed (G19); MQTT 5 re-attributed to the IoT SDKs docs pageSDK README
C16"Gen 2 dropped Push/Predictions as first-class categories"Reworded to "not listed on the Gen 2 feature matrix"An Amplify statement on Push in Gen 2
C11"KB and Guardrails named as eligible in the 2025-10-13 industries blog"Removed; eligibility rests on the feature rule (Medium-Low)Their appearance on the eligible-services page by name
C77Last-mile BLE Guidance uses Timestream "likely LiveAnalytics"Kept as inference (page says only "Amazon Timestream")The Guidance repo (no sample-code link on the page)

7. Do not link as-is — repos with retired-service dependencies (C77, validated)​

RepoRetired dependencyLast pushLicenceUsable for
aws-samples/serverless-patient-engagement-stackAmazon Pinpoint (EOS 2026-10-30)2025-04-01MIT-0Fork the CDK TS + Connect structure; replace Pinpoint with EUM/SES/Connect Customer campaigns
aws-samples/sample-amazon-connect-health-unified-clinical-workflowBedrock Agents classic (6 action groups)2026-08-31MIT-0Read for Connect Health Ambient → HealthLake DocumentReference flow; also not empty→running
aws-samples/sample-amazon-connect-bedrock-agent-voice-integrationBedrock Agents classic2025-11-18MIT-0Connect + Lex + CDK TS structure only
aws-samples/sample-scalable-intelligent-document-processing-with-amazon-bedrock-data-automationA2I + Ground Truth (maintenance from 2026-07-30)2026-07-28MIT-0Nothing — superseded by the IDP Accelerator
aws-samples/greengrass-v2-sagemaker-edge-manager-pythonSageMaker Edge Manager (gone 2024-04-26)—MIT-0Nothing — use Greengrass v2 + ONNX
aws-samples/amazon-sagemaker-aws-greengrass-custom-timeseries-forecastingIoT Analytics, Greengrass v1 (archived 2024-07-26)archivedMIT-0Nothing
amazon-archives/medical-mobile-iot-with-awsKinesis Data Analytics naming, archived 2020-07-272020-07-27CC-BY-SA-4.0Nothing (licence also non-permissive)
Guidance "App-based condition monitoring for last-mile logistics""Amazon Timestream" (flavour unstated; LiveAnalytics inferred)page only—Android BLE gateway → IoT Core architecture diagram only
aws-samples/aws-amplify-cdk-iot-ble-swift-app (iOS layer)Amplify iOS v1 + classic aws-sdk-ios pods (EOS 2026-08-01)2026-06-09 (CDK)MIT-0Fork the CDK v2 + least-privilege IoT policy; rewrite iOS on Amplify Swift 2.x + IoT Device SDK for Swift
aws-samples/aws-healthscribe-demoAmplify Gen 1 (maintenance; EOL 2027-05-01)2025-04-08MIT-0UI patterns only
aws-samples/aws-security-reference-architecture-examples(not retired — CC-BY-SA-4.0 licence)2026-09-04CC-BY-SA-4.0Link only, never fork
cleverdevil/healthlake(community, archived 2022, no licence)2022-06-08noneDo not use

Safe despite its name: aws-samples/amazon-bedrock-agents-healthcare-lifesciences (Strands + AgentCore, no classic Agents).

Retired / maintenance list additions for catalog rule 4 (all validated): Amazon Pinpoint (EOS 2026-10-30); SageMaker Edge Manager (inaccessible since 2024-04-26); classic AWS Mobile SDKs for iOS/Android (EOS 2026-08-01); Amplify Gen 1 (maintenance 2026-05-01, EOL 2027-05-01); SageMaker Clarify, Model Monitor, A2I, Ground Truth, Debugger (maintenance, no new customers from 2026-07-30); "Kinesis Data Analytics" naming (now Managed Service for Apache Flink); QuickSight naming (now Amazon Quick).

8. Fork / link / build — per catalog item and tier​

Evidence-level reconciliation (the catalog-v1 file turns this into the actionable per-item plan with URLs, licences and remaining work).

Item / tierVerdictFork or link target(s)Evidence
F0 org layer (F0b)LinkLZA Solution + LZA-for-Healthcare config; Control Tower controls-dedicated experience; SRA examples (link only, CC-BY-SA)C1, C3, C10
F0 single account (F0a)Buildnone exists; borrow the startup-security-baseline CDK shapeC2, C4–C8
U1 T1Buildfork sample-intelligent-security-for-healthcare-apis for the API boundary; aws-healthlake-smart-on-fhir for FHIR wiringC13–C21, C24
U1 T2Fork scaffolding, build assistantHCLS Agents Toolkit; sample-healthcare-agent-with-agentcore-on-aws; public-sector blueprint blogC22, C74, C75, C73
U1 T3Buildamazon-sagemaker-pipeline-deploy-manage-100x-models-python-cdk for mechanicsC23
U2 T1Buildfork guidance-for-aws-iot-greengrass-foundations, aws-greengrass-ec2-device-farm, aws-appsync-iot-core-realtime-dashboard (Gen 2), BLE sample CDK onlyC26–C31
U2 T2Buildnone; Gateway interceptor pattern per X1C32, C74, C75
U2 T3Buildfork flink-keyed-random-cut-forest-example logic (add IaC), amazon-sagemaker-deepar-mlops-pipeline-cdk; edge = Greengrass v2 + ONNXC27, C33, C34
U3 T1–T2Fork + buildfork sample-healthscribe-bedrock-clinical-analysis; port coding step from diagnosis-codes Guidance repo; build review + HealthLake write-back; us-east-1C35–C41, X3, X4
U3 T3Buildreuse LLM-as-judge notebooks for the harnessC42
U4 T1–T2Link + forklink IDP Accelerator; fork sample-healthcare-agents; embed IDP Guidance page; add aws-ai-phi-deidentificationC44–C49, X8
U4 T3Build—C50
U5 T1Fork + buildfork Multi-Modal Guidance + Entity Resolution Guidance; build S3 Tables landing, Quick rename, de-idC53–C56
U5 T2Buildextract-medical-insights-… is a snippet onlyC58
U5 T3Fork content, build infraMulti-Modal modelling into the 100x-models CDK spine; SHAP + MLflow for bias (Clarify successor)C57, C59, X5
U6 T1–T2Link product; optional forkConnect Health product; sample-healthcare-realtime-eligibility; sample-Nova-Sonic-AgentCore-Healthcare-Call-CenterC60–C63
U6 T3LinkConnect forecasting/capacity/scheduling (product feature)C64
P0Buildcopy contracts: Guidance README, contentspec.yaml, _pattern-model JSON; precedents eks-workshop-v2, HCLS toolkit siteC66–C71

9. Sources index (primary, all retrieved or re-fetched 2026-09-04)​

Compliance and controls: https://aws.amazon.com/compliance/hipaa-eligible-services-reference/ (Last Updated 2026-09-03) · https://aws.amazon.com/compliance/hipaa-compliance/ · https://docs.aws.amazon.com/artifact/latest/ug/accept-org-agreement.html · https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-hipaa_security.html · https://github.com/awslabs/aws-config-rules (HIPAA pack YAML history) · https://docs.aws.amazon.com/securityhub/latest/userguide/standards-reference.html · https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-compliance.html · https://aws.amazon.com/about-aws/whats-new/2025/12/security-hub-near-real-time-risk-analytics/ · https://docs.aws.amazon.com/macie/latest/user/mdis-reference.html · https://docs.aws.amazon.com/macie/latest/user/discovery-asdd-settings-defaults.html · https://docs.aws.amazon.com/whitepapers/latest/architecting-hipaa-security-and-compliance-on-aws/document-revisions.html · https://docs.aws.amazon.com/wellarchitected/latest/healthcare-industry-lens/document-revisions.html · AWS "Service Availability Updates" post, 2026-06.

Landing zone: https://github.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare · https://github.com/awslabs/landing-zone-accelerator-on-aws (v1.16.2, 2026-09-02) · https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/ (overview, cost, prerequisites, mandatory-accounts) · https://github.com/aws-solutions/aws-control-tower-customizations · https://aws.amazon.com/about-aws/whats-new/2026/07/aws-control-tower-account/ · https://aws.amazon.com/about-aws/whats-new/2025/11/aws-control-tower-controls-dedicated-experience/ · https://github.com/aws-samples/deploy-conformance-pack-for-aws-startup-security-baseline · https://github.com/aws-samples/aws-security-reference-architecture-examples (LICENSE).

Bedrock / AgentCore: https://aws.amazon.com/bedrock/faqs/ · https://aws.amazon.com/bedrock/security-compliance/ · https://docs.aws.amazon.com/bedrock/latest/userguide/compliance-validation.html · https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html · https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html · https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html · https://aws.amazon.com/blogs/machine-learning/secure-ai-agents-with-policy-and-lambda-interceptors-in-amazon-bedrock-agentcore-gateway/ (2026-06-01) · https://aws.amazon.com/blogs/publicsector/architecting-hipaa-compliant-ai-agents-to-safeguard-health-data-with-aws/ (2026-08-14) · https://aws.amazon.com/blogs/industries/hipaa-compliance-for-generative-ai-solutions-on-aws/ (2025-10-13; usage statement only).

Health services: https://docs.aws.amazon.com/transcribe/latest/dg/health-scribe.html · https://aws.amazon.com/healthscribe/pricing/ · https://aws.amazon.com/healthlake/pricing/ · https://aws.amazon.com/healthlake/faqs/ · https://docs.aws.amazon.com/comprehend-medical/latest/dev/textanalysis-phi.html · https://aws.amazon.com/comprehend/medical/faqs/ · https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-connect-health-agentic-ai-healthcare/ (2026-03-05) · https://aws.amazon.com/products/connect/health/ (product + pricing) · https://aws.amazon.com/blogs/architecture/how-clario-automates-phi-pii-detection-in-dicom-images-using-amazon-bedrock/ (2026-08-19).

Mobile / device: https://github.com/aws-amplify/amplify-cli/issues/14881 · https://docs.amplify.aws/swift/start/migrate-to-gen2/feature-matrix/ · amplify-swift / amplify-android / amplify-flutter release feeds · https://github.com/aws-amplify/amplify-flutter (issues #6094, #6106, PR #6851) · https://github.com/aws-amplify/aws-sdk-ios and …/aws-sdk-android READMEs · https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html · https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html · https://docs.aws.amazon.com/pinpoint/latest/userguide/migrate.html · https://aws.amazon.com/pinpoint/faqs/ · https://docs.aws.amazon.com/push-notifications/latest/userguide/reference-send-message.html · https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-application-as-subscriber.html · https://docs.aws.amazon.com/prescriptive-guidance/latest/modernization-integrating-microservices/appsync-api-gateway.html · https://docs.aws.amazon.com/iot/latest/developerguide/iot-sdks.html · https://docs.aws.amazon.com/iot/latest/developerguide/cognito-identities.html · https://aws.amazon.com/about-aws/whats-new/2026/06/aws-iot-device-sdk-swift/ (2026-06-24) · https://github.com/aws/aws-iot-device-sdk-swift · https://github.com/aws/aws-iot-device-sdk-java-v2/blob/main/documents/ANDROID.md · https://docs.aws.amazon.com/general/latest/gr/devicefarm.html · https://developer.apple.com/app-store/review/guidelines/ (5.1.3) · https://developer.android.com/health-and-fitness/guides/health-connect.

SageMaker: https://docs.aws.amazon.com/sagemaker/latest/dg/edge-eol.html · https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-availability-change.html · https://github.com/aws-samples/amazon-sagemaker-pipeline-deploy-manage-100x-models-python-cdk · https://github.com/aws-samples/sample-aiops-on-amazon-sagemakerai.

Repositories (U1–U6): https://github.com/aws-samples/aws-healthlake-smart-on-fhir · https://github.com/aws-samples/sample-intelligent-security-for-healthcare-apis · https://github.com/aws-samples/amazon-bedrock-agents-healthcare-lifesciences · https://github.com/aws-samples/sample-healthcare-agent-with-agentcore-on-aws · https://github.com/aws-samples/serverless-patient-engagement-stack · https://github.com/aws-solutions-library-samples/guidance-for-aws-iot-greengrass-foundations · https://github.com/aws-samples/aws-greengrass-ec2-device-farm · https://github.com/aws-samples/flink-keyed-random-cut-forest-example · https://github.com/aws-samples/amazon-sagemaker-deepar-mlops-pipeline-cdk · https://github.com/aws-samples/aws-appsync-iot-core-realtime-dashboard · https://github.com/aws-samples/aws-amplify-cdk-iot-ble-swift-app · https://github.com/aws-solutions-library-samples/guidance-for-deploying-ai-agents-to-device-fleets-using-aws-iot-greengrass · https://github.com/aws-samples/amazon-sagemaker-feature-store-streaming-inference-msk-kda · https://github.com/aws-samples/sample-healthscribe-bedrock-clinical-analysis · https://github.com/aws-samples/sample-amazon-connect-health-unified-clinical-workflow · https://github.com/aws-samples/sample-amazon-connect-health-point-of-care · https://github.com/aws-solutions-library-samples/guidance-for-identifying-diagnosis-codes-from-clinical-notes-on-aws · https://github.com/aws-samples/aws-healthscribe-demo · https://github.com/aws-samples/sup-hcls-generate-clinical-notes-with-ai · https://github.com/aws-solutions-library-samples/accelerated-intelligent-document-processing-on-aws · https://github.com/aws-samples/aws-ai-intelligent-document-processing · https://github.com/aws-samples/sample-healthcare-agents · https://github.com/aws-samples/aws-ai-phi-deidentification · https://github.com/aws-solutions-library-samples/guidance-for-multi-modal-data-analysis-with-aws-health-and-ml-services · https://github.com/aws-solutions-library-samples/guidance-for-patient-entity-resolution-with-aws-healthlake · https://github.com/aws-samples/extract-medical-insights-from-amazon-healthlake-with-bedrock · https://github.com/aws-samples/sample-healthcare-realtime-eligibility · https://github.com/aws-samples/sample-Nova-Sonic-AgentCore-Healthcare-Call-Center · https://github.com/aws-samples/sample-amazon-connect-bedrock-agent-voice-integration.

Solutions Library / workshops / portal patterns: https://docs.aws.amazon.com/solutions/guidance-disclaimers/ · https://docs.aws.amazon.com/solutions/intelligent-document-processing-on-aws/ · https://docs.aws.amazon.com/solutions/identifying-diagnosis-codes-from-clinical-notes-on-aws/ · https://docs.aws.amazon.com/solutions/multi-modal-data-analysis-with-aws-health-and-ml-services/ · https://aws.amazon.com/solutions/guidance/ingesting-pdf-and-image-files-to-aws-healthlake/ · https://aws.amazon.com/about-aws/whats-new/2025/11/workshops-available-aws-builder-center · https://github.com/aws-samples/rancher-on-aws-workshop/blob/main/contentspec.yaml · https://github.com/aws-samples/serverless-patterns/tree/main/_pattern-model · https://github.com/aws-samples/eks-workshop-v2 · https://aws-samples.github.io/amazon-bedrock-agents-healthcare-lifesciences/ · https://adr.github.io/madr/ · https://github.com/aws/mit-0.

10. Budget note (D-002)​

~/.claude/skills/team-research/memory/decisions.md D-002 is still DRAFT — needs Sara's confirmation. The standing draft ceiling is ≤150k tokens for a topic's pilot pass. After the first real pilot (2026-08-12, 260,863 tokens, ~74% over), the proposed revision is ≤300k for a 3-angle topic (triage ~30k, each scout ~40k, comparator ~40k, validator ~50k, lead ~25k), scaling proportionally with angle count. This run used four angles, so the pro-rated proposed ceiling is ~305k (30 + 4×40 + 40 + 50 + 25). The orchestrator's logged total should be compared against both numbers in the chat report: the unconfirmed 150k draft and the pro-rated 305k proposal. This lead did not tally tokens.