Building a Secure Foundation for NHS Compliance on AWS

Acorn is a HealthTech leader dedicated to helping healthcare providers and the NHS meet rigorous compliance standards. To launch their next-generation platform, Squirrel 2, they needed an infrastructure partner who understood that security wasn't just a feature—it was the entire product. North Point Digital stepped in as Fractional CTO, architecting a secure, scalable AWS environment that meets NHS Data Security and Protection Toolkit (DSPT) standards, enabling Acorn to onboard healthcare providers with absolute confidence.

As Acorn prepared to launch Squirrel 2, they faced the 'Triple Constraint' common to healthcare innovation: • Strict Regulatory Standards: The platform handles sensitive compliance data for NHS providers. Any architecture had to be 'secure by design' to meet DSPT and GDPR requirements without slowing down development. • Scalability for Launch: Acorn needed to move from a development environment to a production-ready infrastructure capable of handling rapid user onboarding from large healthcare organisations. • Operational Efficiency: With limited internal DevOps resources, Acorn needed a partner to not just build the infrastructure, but to establish the 'Fractional CTO' strategy for long-term management and cost optimisation. • Cost Optimisation: As an incredibly cost-conscious company, Acorn needed to redesign their infrastructure to move off expensive EC2 instances, reducing infrastructure costs while maintaining performance and security.

Acorn chose North Point Digital because they needed more than just a developer—they needed strategic leadership. • Industry-Specific Expertise: North Point Digital brought deep experience in regulated industries, understanding that 'move fast and break things' doesn't work when patient data privacy is at stake. • Trust & Security: As an AWS Partner, North Point Digital used the 'most trusted healthcare cloud' to ensure the platform was built on a foundation of global compliance certifications.

North Point Digital acted as the strategic infrastructure lead, executing a modernisation and migration plan aligned with AWS Well-Architected best practices: • Secure Landing Zone: Deployed a multi-account AWS architecture with strict isolation between development and production environments to prevent data leakage. • Encryption & Compliance: Implemented end-to-end encryption (at rest and in transit) using AWS Key Management Service (KMS), ensuring Squirrel 2 met the highest standards of data sovereignty. • Automated Infrastructure: Utilised Infrastructure as Code (IaC) to automate compliance checks, ensuring that every server launched was automatically compliant with security policies. • Infrastructure Cost Optimisation: Redesigned their infrastructure architecture to move off expensive EC2 instances, implementing serverless and managed services where appropriate to significantly reduce costs while maintaining performance and security. • Document Generation Modernisation: Modernised their Document Generation infrastructure utilising core AWS services including Amazon S3 for vector storage, AWS Bedrock for embeddings, and AWS SageMaker for machine learning capabilities, enabling intelligent document processing and generation at scale.