HIPAA-compliant Cloud Infrastructure

Lane Health is a healthcare financing provider that offers a unique HSA Advance program to assist individuals enrolled in High Deductible Health Plans (HDHP) to cover their medical expenses. Additionally, they enable employees to manage their Health Savings Account (HSA) contributions. Through the Lane Health Card with the Heart, individuals no longer need to put off healthcare decisions due to high out of pocket costs, as the card provides instant credit at the time of purchase without requiring a credit check.

Challenge

Lane Health was established to provide corporate employees with a cost-effective way to pay for healthcare through pre-tax dollars. The HSA Advance program, which is available to individuals who have High Deductible Health Plans (HDHP), removes the need for credit checks and offers predictable repayment terms, as well as tax savings and no costs for employers. Moreover, employers also benefit from a reduction in payroll tax obligations. To manage the program, a suite of dedicated HSA Advance applications was created for employees, employers, and administrators.

The team at Lane Health wanted to upgrade the HSA Advance applications to make them more secure, scalable, flexible, reliable, and cost-efficient. They sought to introduce a more advanced technology stack and infrastructure, and to migrate the applications to the AWS cloud. Doing so would enable them to innovate quicker, have more stable releases, lower the Total Cost of Ownership, and fulfill HIPAA compliance for storing PHI data. As the product had to be launched in under four months, Lane Health needed a dependable partner to make it happen.

For this purpose, Lane Health partnered with Provectus, an AWS Premier Consulting Partner, to migrate its applications to an enterprise-level technology stack and construct an infrastructure on AWS.

Solution

In response to the issues concerning Lane Health’s implementation of the HSA Advance applications, Provectus took immediate action to review the business logic, external dependencies, data structures, and compliance level of the applications. The applications, built on a no-code platform, had limited flexibility and posed ownership and maintenance problems. Additionally, there was no proper versioning system or database rollback mechanisms, making each product release a risk. Testing, logging, monitoring, alerting, and database migration and management tools were also lacking. Taking this into consideration, Provectus proposed abandoning the legacy platform and building a HIPAA-compliant infrastructure on AWS.

The AWS infrastructure was designed to be reliable, highly available, and compliant with HIPAA Security and Compliance guidelines. It included CI/CD pipelines for automated testing, a centralized hub for logging, monitoring, and alerting, ETL pipelines for user enrollment and data quality verification, and microservices to support core business logic and third-party integrations. The infrastructure and migration plan were approved by Lane Health’s team.

To ensure successful migration, Provectus implemented comprehensive test coverage on each step of the migration. Integration, functional, manual, and end-to-end tests were conducted to confirm that the applications were working as intended and meeting the standards of the legacy applications.

The newly created solution from Provectus addressed and accounted for the challenges Lane Health’s team was facing with the HSA Advance applications. The HIPAA-compliant infrastructure is now live and ready for use.

Outcome

Provectus designed and built a reliable, highly available, and HIPAA-compliant infrastructure on AWS in a timely manner, allowing Lane Health’s engineering team to create cloud-native applications from the ground up, without the limitations of no-code platforms. This new infrastructure incorporated automated CI/CD pipelines, data quality verification pipelines, and the necessary tooling for versioning, automated testing, logging, monitoring, and alerting, in addition to making product updates deployable with a single click.

Despite building the HSA Advance applications from scratch, Provectus made sure that their core business logic remained intact throughout the migration process, thus guaranteeing business continuity. As a result, Lane Health’s administrators and registered users (i.e. employees and employers) were still able to use the HSA Advance applications as they were accustomed to.

The improvements made by Provectus have made the HSA Advance applications more agile, flexible, scalable, and secure. This has enabled Lane Health’s engineering team to take full ownership of the solution and ensure steady and regular releases.

Lenny Blyukher, CTO of Lane Health, expressed his appreciation and stated that “The development team of Provectus has helped us build a new generation, scalable, cloud-based architecture in record time”.

He also noted that with the migration and augmentation of the HSA Advance applications, Lane Health was able to streamline their operations and reduce the Total Cost of Ownership by 60%. This has allowed Lane Health to unlock its full potential and accelerate its growth in the healthcare lending market more quickly and efficiently, while also offering better data protection.