Healthcare
AWS for Clinics, Healthcare Providers and Labs in Colombia
In healthcare, the cloud is not only about cost. Medical records are sensitive data, they must be kept for at least 15 years, and they cannot go offline when a patient walks in. CloudTing designs and runs AWS infrastructure so your clinic keeps data encrypted, knows who accessed what, and can recover from an outage or ransomware without losing information.
What we solve
- Encryption of medical records and backups, with keys managed in AWS KMS
- Role-based access with a full log of who viewed or changed what, stored in AWS CloudTrail
- Low-cost long-term retention with S3 Glacier and deletion protection (S3 Object Lock)
- Tested backups and a recovery plan with RPO and RTO defined per system
- Ransomware protection: immutable copies isolated from the production account
- AWS Region choice that takes the international transfer rules of Law 1581 into account
Who it is for
- Clinics, healthcare providers and practices running their medical record software on their own server
- Labs and imaging centers that store large files and must keep them for years
- Healthcare software companies that host patient data for several institutions
- Teams already on AWS that never reviewed encryption, access or backup restores
What Colombian rules require
- Health data is sensitive data under Law 1581 of 2012: it needs explicit consent and stronger security measures.
- Medical records must be kept for at least 15 years after the last visit (Resolution 839 of 2017), and twice as long for victims of human rights violations.
- Law 2015 of 2020 created the interoperable electronic medical record, and Resolution 866 of 2021 defined the data that must be exchangeable.
- Law 1581 limits sending personal data to countries without an adequate level of protection. The SIC published the list of adequate countries, which includes the United States and Mexico.
- In July 2026 the Ministry of Health published a draft resolution that would replace Resolutions 1995 of 1999 and 839 of 2017. Until it is issued, those remain in force.
What we do not do
We do not give legal advice. We make sure the infrastructure covers the technical side (encryption, access, retention, backup), and your legal advisor or data protection officer validates the legal reading.
Reference architecture
A typical pattern for a clinic: staff come in through AWS WAF and a load balancer, medical records run on ECS Fargate across two Availability Zones with RDS Multi-AZ, documents go to S3 through a private endpoint, everything is encrypted with KMS and logged in CloudTrail, and backups go to an isolated account with 15-year retention.
How we start
- 1Free review: where patient data lives today, how it is backed up and who has access
- 2Report with prioritized risks and a proposed AWS architecture
- 3Migration or changes in stages, without stopping patient care
- 4A real restore test before the project is closed
- 5Ongoing operation and support, if you need it
Frequently asked questions
Can I store medical records on AWS if there is no Region in Colombia?
AWS has no Region in Colombia, so the data is stored in another country. Law 1581 allows transfers to countries the SIC considers adequate, such as the United States or Mexico, or under the exceptions the law provides. We choose the Region with that in mind, and your legal advisor validates patient consent.
How do I keep medical records for 15 years without a huge bill?
Data used often stays in standard storage, and older data moves automatically to archive classes like S3 Glacier, which cost much less. With S3 Object Lock nobody can delete or change those records early, not even an administrator.
What happens if we are hit by ransomware?
If backups live on the same server or in the same account, the attack encrypts them too. That is why we keep immutable copies in a separate account and test the restore before it is needed.
Are you lawyers, or do you certify compliance?
No. We are AWS consultants. We put the technical controls and the evidence (access logs, retention policies, backup tests) in place so your legal team or auditor can validate compliance.
Next step
AWS for Clinics, Healthcare Providers and Labs in Colombia