What we do

We build, run, secure, and optimize healthcare systems on the cloud.

Building is optional. We take on systems you built, build new ones for you, or build alongside your team. All of it is held accountable to the outcomes your leadership tracks.

Build

Professional services for healthcare systems.

Healthcare data has its own standards, its own regulators, and its own failure modes. We have worked in nothing else since 2011.

We build new systems, extend the ones you have, or work alongside your engineers. When the build is done, we can run it, or hand it to your team.

Healthcare data and interoperability

HL7 v2, C-CDA, FHIR, IHE, OMOP, X12 claims, NCPDP SCRIPT, DICOM, Direct Messaging, TEFCA, and QHIN connectivity. Quality and payer programs including HEDIS, CMS Stars, and Da Vinci.

Platforms and applications

Clinical data repositories and analytics environments
Contact centers on Amazon Connect
Cloud migrations, including Epic on the cloud

AI systems, designed safely

We help healthcare organizations design AI systems that are safe, secure, and compliant from the start. Our founder, Gerry Miller, served on the HITRUST AI Working Group in 2024, which defined HITRUST's AI controls. More on AI in healthcare.

Run

Managed cloud, managed security, and managed compliance.

For systems we built and systems we didn't, across AWS, Microsoft Azure, and Google Cloud.

Managed cloud

Architecture, daily operations, remediation, and optimization of cost and performance.

Managed security

Monitoring and response for security events, each mapped to the controls it affects.

Managed compliance

Technical monitoring, control mapping, evidence support, and controls you can inherit toward your own HITRUST assessment.

247

We carry part of your compliance load.

Customers inherit controls from Cloudticity's own HITRUST r2 assessment: 33 fully and 214 partially inheritable under HITRUST Shared Responsibility Matrix 1.5.5. Every inherited control is one your team doesn't have to implement and evidence alone.

We have been HITRUST certified since 2017, completed the 2026 HITRUST r2 v11.7 assessment, and served on HITRUST's Shared Responsibility, Inheritance, Shared Responsibility Matrix, and AI working groups. We also help complete the security questionnaires your customers send you, and meet with them when it helps you win the deal.

Connect

What comes with the relationship.

Introductions

We introduce our customers to one another, and those introductions often turn into business between them.

Cloud provider relationships

We have long-standing working relationships with the cloud providers, AWS in particular, and we put them to work for you. Cloudticity is an AWS Premier Tier Services Partner with the AWS Healthcare and DevOps Competencies.

Funding

We help customers pursue cloud provider funding for their projects, including through the AWS Migration Acceleration Program.

Resale

We can resell cloud services when that suits you.

Working with us

How an engagement works.

Ways to start

A review. A Well-Architected Framework Review of an environment you already run, with findings and a prioritized plan.
A project. A migration, a build, or a re-architecture, scoped and delivered as professional services.
Ongoing service. We run, secure, and keep an environment compliant, with Cloudticity Oxygen™ and a Cloud Value Architect.
Alongside your team. Our engineers work with yours on a system you own.

Getting started

Kickoff. We agree goals, contacts, and how incidents reach you.
Your Cloud Value Architect is named. One person owns the relationship and the plan.
Accounts are connected. Your AWS accounts, Azure subscriptions, or Google Cloud projects are connected to Oxygen. You keep ownership of them.
Baseline. Oxygen shows your security events, compliance status, and cost, and we agree what to fix first.
First value review. Progress is reported against the goals from kickoff.

Who is responsible for what

Your cloud provider

Data centers and physical security
The underlying compute, storage, and network services

Cloudticity

Architecture and daily operation of the environment
Monitoring, and response to security and infrastructure incidents
Backup plans for supported resources, and restores
Mapping events to compliance controls, and support with evidence
Cost and performance optimization

You

Your applications and the integrity of the data in them
Business priority: which work comes first
Your own policies, people, and the HITRUST requirements that stay with you

This is a summary. The full split is written into each agreement, and for HITRUST it follows the Shared Responsibility Matrix: 33 requirements fully inheritable and 214 partially inheritable from us.

Support coverage

Urgent, around the clock

A production outage or a suspected security incident pages our on-call engineer immediately. Our target is a response within 15 minutes. Our actual response time averages under 2 minutes, 24 hours a day, every day of the year.

Everything else, in business hours

Requests and questions come through the support portal or by email, and are handled during business hours.

One severity scale

Every incident is rated from 1 to 4 on the same scale. We set the severity, you own the business priority, and severity 1 and 2 incidents get a root cause analysis.

How it adds up

The services are the means.

Every engagement is planned against the Cloud Value Journey and owned by a Cloud Value Architect, who reports what changed for your organization in regular value reviews. See what a value review looks like.

Still deciding? Read the frequently asked questions, the questions to ask any cloud partner, or the guides.