Case study — HealthTech

HIPAA-grade migration off legacy ECS to multi-region EKS in 11 weeks.

A telehealth platform moved PHI workloads from single-region ECS to multi-region EKS with Vault and Cilium — and passed its compliance audit on the first try.

11 wk
end-to-end migration
3×
request capacity
100%
audit-pass on first try

Context

Vyna's telehealth platform tripled its patient volume in a year. Everything ran in a single-region ECS cluster built in 2019 — including every PHI data path.

A HIPAA audit was scheduled in one quarter, and the existing setup couldn't demonstrate the required access controls, encryption posture, or disaster-recovery story.

The challenge

PHI can't take downtime and can't leak: every migration step had to keep data paths encrypted, logged, and inside the BAA boundary.

The audit date was fixed. The migration either finished — with evidence — in 11 weeks, or the audit failed.

Approach

  1. Compliance mapping

    Weeks 1–2

    Built the control matrix mapping each HIPAA safeguard to an enforceable platform control, plus data-flow diagrams for every PHI path.

  2. Landing zone

    Weeks 3–5

    Multi-region EKS (active/passive) with Karpenter provisioning, Vault for secrets and PHI encryption keys, Cilium eBPF network policies default-deny.

  3. Strangler migration

    Weeks 6–10

    Service-by-service migration with shadow traffic: each service ran in both environments with live-mirrored requests until parity was proven, then cut over.

  4. Audit preparation

    Week 11

    Automated evidence collection — policy reports, access logs, encryption attestations — generated from the platform itself rather than screenshots.

Architecture

Edge
WAFRoute 53 failoverTLS 1.3
Security
VaultCilium default-denymTLS
Platform
EKS × 2 regionsKarpenterOPA policies
Data
RDS multi-AZCross-region replicasS3 CRR
Active/passive multi-region with default-deny networking; every PHI path encrypted via Vault-managed keys.

Results

11 wk
end-to-end

Fixed deadline met with one week of buffer to spare.

3×
request capacity

Karpenter-provisioned headroom absorbed the next year of growth.

100%
audit pass

First-try pass; auditors cited the automated evidence pipeline.

18 min
regional failover (RTO)

Down from a 4-hour manual runbook.

“The auditors asked how we generated the evidence packet. That's the first time an audit ended with them taking notes.”

— CTO, Vyna Health

Stack

EKSKarpenterVaultCilium