--- cuppy_hub: aws cuppy_path: examples/healthcare-master-data/README.md cuppy_section: docs cuppy_doc: 9R0D-3HVZ cuppy_doc_uuid: 76a9efc8-2cb6-45e9-a74a-f1e4d3f9585a cuppy_permalink: https://cuppy.io/aws/d/9R0D-3HVZ cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/examples/healthcare-master-data/README cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: dc8245f51d23862897c7d86275d242c7f896fa6213e14c4b1bdb8547d416f8a9 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Healthcare master data on AWS without an MDM licence A worked example of building a healthcare master data management capability — one trustworthy record per patient, provider, organisation and location — from AWS-native services rather than a licensed MDM product, under HIPAA. The question this set answers is not "can it be done". It is "which parts does AWS supply, which parts are yours, and is the trade sound". The short answer: AWS has productised the hardest algorithmic component and none of the operational ones. ## The architecture in five sentences Source systems land every payload unchanged into an immutable S3 raw zone with Object Lock, and AWS Glue standardises and quality-checks the data into a curated zone registered in the Glue Data Catalog and governed by Lake Formation. AWS Entity Resolution matches records from those curated tables, using exact waterfall rules as the primary technique and a preset ML model as a second pass, writing match groups and match IDs back to S3. Custom code then does the work no AWS service performs: resolving match IDs to a stable master identifier through a crosswalk, replaying steward decisions, applying per-attribute survivorship rules, and writing versioned golden records with attribute-level provenance into Aurora PostgreSQL. AWS HealthLake holds the FHIR R4 view for interoperability, with its own deterministic resource matching producing FHIR `Linkage` resources, and change events publish to consumers through EventBridge, SNS and SQS. Everything runs in a multi-account Control Tower landing zone under a single AWS business associate addendum, with KMS customer managed keys, CloudTrail, the AWS Config HIPAA Security conformance pack and Security Hub CSPM as the compliance substrate. ## Why this is a legitimate pattern AWS says so itself, in the HealthLake documentation on resource matching: > "When aggregating data from multiple systems, resource matching connects the same entity written > as several separate resources so you can build an accurate, unified view without operating a > master data management system." That sentence is the warrant for the whole set. The same page is equally clear about the limits: it links rather than merges, and "does not perform probabilistic or demographic fuzzy matching on names, dates of birth, or addresses". ## Reading order | Document | What it settles | | --- | --- | | [00 overview and decision](00-overview-and-decision.md) | Why native, and when it is the wrong call | | [01 reference architecture](01-reference-architecture.md) | End-to-end flow, service roles, accounts | | [02 identity resolution](02-identity-resolution-and-survivorship.md) | The matchers, and the custom core | | [03 data model and FHIR](03-data-model-and-fhir.md) | HealthLake, FHIR R4, the master schema | | [04 security and HIPAA](04-security-and-hipaa.md) | BAA, eligibility table, encryption, audit | | [05 stewardship and quality](05-stewardship-and-data-quality.md) | Glue Data Quality; the steward application | | [06 operations](06-operations-scaling-and-performance.md) | Quotas, idempotency, backup and DR | | [07 cost model](07-cost-model.md) | Billing dimensions, a worked estimate, savings | | [08 gaps register](08-gaps-and-custom-code-register.md) | All 24 gaps with severity and effort | | [09 interview brief](09-interview-brief.md) | The study sheet and what not to claim | Read 00 then 01 for the shape. Read 02 and 08 if you only have time for two: they carry the verified limits and the honest account of what must be built. ## The nine capabilities, and AWS's coverage | Capability | AWS coverage | | --- | --- | | Ingestion and standardisation | Strong — Glue, Lambda, Kinesis, MSK | | Data quality measurement | Strong — Glue Data Quality with DQDL | | Identity resolution, matching | Strong — Entity Resolution, HealthLake matching | | Survivorship and golden record | No managed equivalent found | | Master identifier and crosswalk | No managed equivalent found | | Stewardship workflow and UI | No managed equivalent found | | Lineage and audit | Partial — CloudTrail, Lake Formation; attribute lineage custom | | Publish and subscribe | Partial — EventBridge, SNS, SQS, HealthLake FHIR Subscriptions | | Interoperability, FHIR | Strong — HealthLake, a managed FHIR R4 store | ## Evidence standard used throughout Every claim about an AWS service in this set is quoted from a page listed in that document's `provenance` block, each read on 2026-10-21. Three rules were applied: - **No invented facts.** No service feature, limit, price or compliance status appears unless it was read on an AWS page. - **Silence is recorded as silence.** Where documentation does not support a claim, the text says the cited pages contain no statement, rather than asserting the capability is absent. - **Inferences are labelled.** The one significant inference in the set — that a Preview feature is not covered by the eligibility caveat for generally available features — is marked as an inference wherever it appears. Numbers worth carrying from this set: Entity Resolution at $0.25 per 1,000 records processed; a 100,000,000 record ceiling per rule-based workflow, which is adjustable, against one concurrent matching job per Region, which is not; a HealthLake data store at $0.27 per hour, about $197 per month before storage; Glue at $0.44 per DPU-hour; and `GetMatchId` at 50 requests per second against `GenerateMatchId` at 10. ## Two things to know before quoting anything here **AWS Audit Manager is no longer open to new customers** — its documentation now says exactly that, following a cutoff dated 30 April 2026 that has passed. Its HIPAA frameworks still exist for existing customers. New landing zones should use the AWS Config conformance pack `Operational-Best-Practices-for-HIPAA-Security` instead, which is AWS's own stated direction. **The "Architecting for HIPAA Security and Compliance on AWS" whitepaper is archived.** Its HTML edition returns only a notice pointing to the HIPAA Eligible Services Reference, while the older PDF still serves the full text under an archived watermark — so it looks current and is not. Several AWS pages still link to that PDF. Cite the reference. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.