Armakuni Contact us
← All case studies

A misread dosage doesn't stay on the page.
It follows the patient into the next system.

A U.S. healthcare data platform turns millions of scanned forms, handwritten prescriptions and multilingual patient letters into structured records, and the work had been done by hand by clinical staff. We built a HIPAA-ready AWS foundation, an extraction pipeline that knows when it isn't sure, and patient messages in each patient's own language.

Before

Clinical staff spent their time retyping documents.

Every customer's compliance team had to approve the platform first.

After
40%faster document processing
35%lower extraction cost
25%better text-extraction accuracy

As the company reported.

Clinical staff spent their time retyping documents

The incoming documents included scanned forms, handwritten prescriptions, clinical shorthand, typed records from electronic health systems and patient correspondence in different languages. Every patient interaction depends on the right information reaching the right system, and getting it there was a manual job, one document at a time, done by the clinical staff patients needed.

Handwriting made it riskier. Drug names, dosages and patient identifiers were extracted with no confidence score, so a missing dosage or a misread identifier could carry into the next workflow unless someone happened to catch it. Non-English documents were treated as low-confidence noise, so patients who didn't speak English got worse service.

Every customer's compliance team had to approve the platform first

Healthcare customers won't move a single document onto a platform until their compliance teams have approved how data is encrypted, isolated, accessed and logged. The platform needed to prove those things with its architecture, every time, without delaying every deal.

A confidence score decides what goes to a person

The design rule was simple to say: extract everything a machine can read reliably, and route everything it can't to a person before it moves on. The confidence score decides which is which, and the audit trail proves it.

How we built it

3 decisions, in the order we made them. Each one says what we did and why, with what it did drawn beside it.

  1. The foundation healthcare customers ask for first
  2. Confidence decides what moves on
  3. Messages in the patient's own language

The foundation healthcare customers ask for first

Built withKMSECSFargateWAFIAMCloudTrail
A documentEncryption with KMS keysIts own containerWAF, IAM and CloudTrailCloudWatch alarms
The engineering

The compliance controls went in before the extraction pipeline, because nothing else could ship without them:

  • Encryption at rest and in transit with KMS-managed encryption keys, with key rotation and per-tenant key separation.
  • Isolated processing on Amazon ECS and AWS Fargate, with each extraction job in its own contained, scalable container rather than on shared infrastructure.
  • AWS WAF, IAM and CloudTrail working together, so every access event is logged, attributable and tamper-evident, along with network isolation.
  • CloudWatch dashboards and alarms tracking extraction latency, error rates and access events that matter for HIPAA.

These controls produce the evidence for customer security reviews, and help the team investigate access and processing events. Auditors give more weight to records the system keeps itself than to a policy document.

Confidence decides what moves on

Built withS3LambdaTextractDynamoDBECSFargate
Confidence decides what moves on Moves on Review below the line, a person checks it
The engineering

The pipeline handles a confident result and an uncertain one in different ways:

  • Documents land in encrypted S3 storage, and Lambda coordinates ingestion, extraction, validation and persistence, so a document's processing status can be followed across the whole workflow.
  • Textract reads typed documents, scanned forms and supported handwriting. The recognition layer, tuned for healthcare, picks out patient identifiers, drug names, dosages, diagnostic codes and provider details.
  • Confidence scores decide which extractions can proceed and which need review, and difficult handwriting is put in front of a reviewer before the record moves downstream.
  • DynamoDB stores extraction metadata and entity indexes, linking each structured result to its source document and making it reusable for later lookups.
  • ECS and Fargate run the containerized processing jobs, and CloudWatch tracks latency and errors as document volumes change.

Why: in healthcare an extraction error can put a wrong dose into someone's record.

Messages in the patient's own language

Built withTextract
Language set at intakeEvery message follows it
The engineering

Patients had to repeat their language preference to every system, and it rarely stuck. Now language preference is captured with the patient record at intake and used by the communication workflow. The Textract pipelines handle correspondence in several languages with the same confidence scoring, and language-specific templates feed email and SMS through Amazon Pinpoint, linking document processing to what patients actually receive.

What we'd tell another CTO

1Build the compliance foundation first. In healthcare it's what lets everything else ship, and per-tenant keys with contained processing for each job are what a customer's compliance team asks to see.
2Make confidence a routing decision: a high-confidence result moves on, and a low-confidence one goes to a person before it spreads into the next system. Link every structured record to its source scan, so a reviewer or an auditor gets from the field back to the page in one step.
3Small decisions compound too. Storing a patient's language preference once, at intake, means every message after it respects it.

What else changed

As the company reported.

  • 98% fewer data-exposure and compliance incidents since the encryption, isolation and audit logging went into production.
  • Audit evidence produced by the platform, so customer compliance reviews are answered from logs and architecture.
  • Patient communication in each patient's language.

What comes next

The next phase is in progress: prior-authorization support, billing reconciliation and clinical summarization, using the extracted records as context. Retrieval draws on patient records, encounter histories and provider documents, built on the existing governed data layer, with clinical judgment staying a human responsibility.

How we'd do it today

This project came before our current offers. Here's how we'd approach the same work now.

For the AI agents now being built on this data, no AI agent would hold private data, read untrusted text and be able to send data out at the same time, because that combination is how data gets stolen. Each would get its own identity in AgentCore Identity with Cedar policies at the gateway, deny by default and checked on every tool call, and acting for a person it would get that person's rights and no more.

A golden set of real prior-authorization and billing cases with the right outcome, plus a sealed set, would gate every change, with a wrong patient or a wrong drug as critical cases, and the HIPAA evidence would come from the controls as they run, starting from a data-flow map approved before any data moves. With Guaranteed AI Outcomes, the first AI agent, prior authorization for example, would be signed against a number the business already tracks, such as days to authorization, with go or stop at week 4 and payment on the result after it.

Modernize with AI AK AI Factory Guaranteed AI Outcomes

More work like this

  1. AIGreen, yellow, redA U.S. agricultural cooperativea verdict on the chemicals on screenThe mixing screen showed the chemicals. It never said whether they were safe together.4–5 weeks to a proof of concept that checks the chemicals on the mixing screen142 Safety Data Sheets in one searchable databaseOn AWS Nova Pro · S3 · Aurora · OpenSearch
  2. AIFirstA U.S. drug testing networklabeled sensor dataset for this kind of testing, and a working prototypeCameras weren't allowed in the room. So we built a way to sense cheating without seeing anyone.24,000+ tests a day the pipeline is sized for120 testing centersOn AWS S3 · Lambda · DynamoDB · API Gateway
  3. AIParallelA Canadian legal software companyreading of every bundle, so throughput is no longer capped by headcountA new law firm arrived with 400 pages. Someone had to read every one before it went live.5–6 weeks to a working prototype that reads onboarding bundles in parallel300–400 pages per bundleOn AWS Bedrock · S3 · ECS · Fargate

All case studies →

Have a problem like this one?

A free workshop: a few hours with the architects who'd do the work, on your own systems. No cost.

Book a free workshop