Self-Service Clinical Analytics on a FHIR Data Store for a Cardiology Network

About project

The Challenge

Three copies of the record, and none of them queryable. The clinical data existed in three disconnected forms: inside each device vendor’s proprietary analysis software, as PDF reports sent to referring physicians, and as files accumulating in Amazon S3 with no data model and no query layer over them. Clinic records were held per site, so the network had eight partial views of itself.

One cohort question cost a working day. The reference question is the simplest one a cardiology network can ask: how many patients with atrial fibrillation were treated across all sites in the last 30 days. Answering it meant opening the device software at each of the eight clinics, exporting, filtering, counting by hand, and reconciling the sites in a spreadsheet. That was 6 hours of work, and the answer arrived the next day. The harder questions the cardiologists wanted to ask, such as which patients show a different pattern at night than by day, were not being asked at all.

Operational reporting was manual and late. The monthly cross-site report on study volumes, test mix and turnaround from device fitting to signed report took 14 hours of administrator time to assemble from per-site exports. A multi-site clinical operation was being managed on numbers that were already stale when they arrived.

A custodian has to account for health information it cannot see. Cardio Study is a health information custodian under Ontario’s Personal Health Information Protection Act. Personal health information spread across vendor software, PDF attachments and unstructured storage is harder to protect, to log and to produce on request than the same information held in one encrypted, access-controlled store.

Our Approach

1. Decide the residency boundary before anything else. The whole solution was placed in ca-central-1, the Canadian Region where AWS HealthLake became available in October 2025. The FHIR data store was created there in November 2025, and no health data was ever held in any other Region.
2. Make ingestion the clinics’ least interesting task. Each site pushes its device exports and clinic records nightly over SFTP, with its own user and its own IP allow-list. No clinic had to install software or change how its technologists work.
3. Model the data as FHIR, and decide per element whether it is structured or narrative. Summary values from the Holter and ABPM analyses are mapped to LOINC-coded Observations with explicit day and night components. The natural language processing over the cardiologist’s interpretation is enrichment on top of that, never a substitute for a value the source already provides in a field.
4. Put the analytics on top of the data store rather than beside it. The FHIR store publishes its own analytics tables, so there is no second copy of the clinical record, no ETL job to maintain and no capacity to provision before anyone asks a question.
5. Curate the natural-language topics with the cardiologists. Clinicians ask in clinical shorthand and about windows relative to the study date, not the calendar. Synonyms, a default date field and verified answers were built with the cardiologists as a delivery milestone with its own acceptance, not as tuning after go-live.

Our Solution

Ingestion. Each of the eight clinics pushes its Holter and ABPM analysis exports, as vendor CSV and PDF files and HL7 v2 ORU messages, and its clinic records nightly through AWS Transfer Family over SFTP, under a per-site user with key-based authentication and an IP allow-list. Files land in an Amazon S3 landing bucket encrypted with a customer-managed AWS KMS key, versioned, with public access blocked and a bucket policy that denies any request that is not TLS. Amazon GuardDuty Malware Protection scans every object on arrival.

Transformation. An object-created event routed through Amazon EventBridge triggers AWS Lambda functions that parse each vendor export and clinic record into FHIR R4 resources: Patient, Practitioner, Organization, Encounter, LOINC-coded Observation for the ECG and blood pressure readings, DiagnosticReport for the Holter and ABPM reports, and DocumentReference carrying the signed PDF and the free-text interpretation. AWS Step Functions runs the nightly bulk import into the data store, records the outcome and raises an alarm on failure.

System of record. AWS HealthLake holds the FHIR R4 record, encrypted with a customer-managed key, with integrated natural language processing enabled on the clinical notes, so that a finding written in narrative becomes a coded resource a cohort query can reach. A self-managed FHIR server was rejected: it would have handed a clinic network with no platform team an application, a database, a search index and a patching schedule, with the clinical NLP still to be built.

Analytics. HealthLake writes the imported data to its SQL analytics tables in Apache Iceberg format in S3, one table per FHIR resource type, registered in the AWS Glue Data Catalog and queried with Amazon Athena in a dedicated workgroup whose results are encrypted with their own key. AWS Lake Formation grants are issued per clinic, so the data-access boundary sits below the reporting tool rather than inside it.

Consumption. Amazon QuickSight Enterprise carries the dashboards: study volumes by site and test type, turnaround from device fitting to signed report, atrial fibrillation prevalence, and day-night blood pressure patterns. Row-level security maps every user to the clinics and the role they are entitled to, column-level security removes direct identifiers from the operational datasets, and SPICE is encrypted with a customer-managed key. Amazon Q in QuickSight answers questions typed in clinical vocabulary against three curated topics: patient cohorts, monitoring throughput and referral turnaround.

Identity and governance. Human access is federated through AWS IAM Identity Center, for the console and for QuickSight alike, with no IAM users and no long-lived access keys. AWS CloudTrail records management events and S3 data events into a log bucket under S3 Object Lock. AWS Config evaluates the Operational Best Practices for HIPAA Security conformance pack, AWS Security Hub aggregates control state, and Amazon GuardDuty provides threat detection. The estate is defined in Terraform. There is no VPC-hosted compute, no database instance and no operating system anywhere in it.

The Results

Two KPIs were agreed with the customer before the build and measured against baselines taken before the go-live of 4 March 2026.

Time to answer a clinical cohort question fell from 6 hours to 4 minutes, against a target of under 10 minutes. The figure is the median across the 12 recurring cohort questions the clinical lead tracks, measured in April 2026, each question run by the person who asks it rather than by a report writer.

Preparation of the monthly cross-site operations report fell from 14 hours per month to 2.5 hours, against a target of under 4 hours, measured in May 2026 from the hours logged by the administrator who owns the report.

All eight clinics have fed the data store nightly since go-live, at the network’s rate of about 40,000 patient encounters a year. The QuickSight subscription serves 4 authors and 26 readers, 19 of them weekly active in June 2026.

An AWS Well-Architected Framework review of the estate on 4 September 2026 closed with zero high-risk issues, both on the framework lens and on the Healthcare Industry Lens.

Dedicatted is an AWS Premier Tier Services Partner. We design, build and operate regulated healthcare workloads on AWS, from FHIR data foundations to the analytics and the governance around them.