Medicare meets the cloud: the development of a secure platform for the storage and analysis of claims data

Abstract

Introduction: Cloud-based solutions are a modern-day necessity for data intense computing. This case report describes in detail the development and implementation of Amazon Web Services (AWS) at Emory—a secure, reliable, and scalable platform to store and analyze identifiable research data from the Centers for Medicare and Medicaid Services (CMS). Materials and Methods: Interdisciplinary teams from CMS, MBL Technologies, and Emory University collaborated to ensure compliance with CMS policy that consolidates laws, regulations, and other drivers of information security and privacy. Results: A dedicated team of individuals ensured successful transition from a physical storage server to a cloud-based environment. This included implementing access controls, vulnerability scanning, and audit logs that are reviewed regularly with a remediation plan. User adaptation required specific training to overcome the challenges of cloud computing. Conclusion: Challenges created opportunities for lessons learned through the creation of an end-product accepted by CMS and shared across disciplines university-wide. Lay Summary Data-intensive computing has been traditionally performed on large physical servers that store data and software programs. More recently, many organizations have elected to move their data from physical servers to cloud-based platforms. Cloud-based platforms are similar to internet-based computer hardware and software platforms that can run large numbers of computers and programs at any given time. There are many cloud-based platforms available, but the most common are Amazon Web Services (AWS), Google Cloud Platform, and Microsoft Azure. In this report, we describe the process involved in transition from a physical server to the AWS cloud-based computing platform. This transition was through agreement with the Centers for Medicare and Medicaid Services (CMS) in our effort to examine the healthcare outcomes of hospitalized Medicare beneficiaries. Through a series of meetings with CMS and their technology affiliate, we developed a platform within AWS that met all the security features required by the US Department of Health and Human Services. Documents were provided that outlined criteria that were needed to secure Medicare claims; detailed documents that required signatures from data stewards at Emory University. Unexpected challenges were the learning curve associated with the use of AWS and the costs associated with a cloud-based platform.