Intelligent Utilization Management

1. Product overview

A HIPAA-aware backend service that automates Prior Authorization (PA) and Utilization Management (UM) review. It ingests clinical documentation, performs OCR and PHI-aware extraction, evaluates cases against medical-necessity guidelines using large language models on Amazon Bedrock, and produces reviewer-ready determinations, letters, and analytics.

Key capabilities: PA intake and processing, longitudinal patient summarization, inpatient and concurrent review, automated determination letters, dashboards and turnaround-time analytics, and built-in content guardrails with PHI/PII redaction.

The service exposes a REST API (OpenAPI/Swagger) and runs from a single container image in two roles: an API server and one or more background workers.

2. Product at a glance

Runtime: FastAPI + Uvicorn (Python 3.11), non-root container Listening port: 7000/tcp (HTTP, behind a TLS-terminating load balancer) Health endpoint: GET /health (unauthenticated, no PHI) API docs: GET /docs, GET /redoc State: stateless - all persistent data lives in external, buyer-owned AWS services

3. Prerequisites

Provision the following in your own account and supply their coordinates via environment variables:

• Amazon DocumentDB (MongoDB-compatible, TLS) - primary datastore: cases, users, guidelines, audit logs
• Redis (Amazon ElastiCache) - task broker, result backend, and cache
• Amazon S3 - source documents, OCR output, generated letters
• Amazon Bedrock (Claude models enabled in-Region) - LLM inference
• OCR service (e.g., Amazon Textract) - text extraction from clinical PDFs/images
• Enterprise identity provider (OAuth 2.0 / SAML SSO) - sign-in and role mapping
• Amazon ECS or EKS + Application Load Balancer - runtime and HTTPS termination

Enable Bedrock model access in the deployment Region, and keep DocumentDB, Redis, and S3 in the same VPC/Region as the compute.

4. Deployment (high level)

1. Subscribe to the product and pull the container image from Amazon ECR (URI and tag shown on the product's Launch page).
2. Provision the prerequisites in Section 3.
3. Store secrets (database/Redis passwords, identity-provider client secret, OCR key, JWT signing keys) in AWS Secrets Manager or SSM Parameter Store, and inject them as environment variables. Never bake secrets into the image.
4. Deploy on ECS or EKS:
   • Run one API service (container port 7000) behind an ALB with health check path /health.
   • Run one or more worker services (same image, worker command) to process background tasks.
   • Attach an IAM task role / IRSA with least-privilege access to Bedrock, S3, Secrets Manager, and KMS (Section 9).
5. Verify: confirm the service is healthy, then: curl https:///health # -> {"status":"ok","service":"...-api","version":"1.0.0"} Open https:///docs for the API reference, and complete an SSO sign-in to confirm end-to-end authentication.
6. Scale by running additional API and worker containers behind the load balancer.

5. Configuration (high level)

Configuration is entirely environment-variable driven. The main groups are:

• Datastore: MONGO_URL (TLS + retryWrites=false), or host/user/password/db.
• Cache and broker: REDIS_HOST, REDIS_PORT, REDIS_PASSWORD, REDIS_SSL.
• Storage: AWS_REGION, AWS_BUCKET_NAME.
• AI / Bedrock: Claude model/inference-profile ARNs and model names.
• Authentication: identity-provider client ID/secret/tenant and JWT signing keys (JWT_SECRET_KEY, SECRET_KEY) with configurable token lifetimes.
• OCR: OCR service endpoint/key.
• Security and ops: CORS allow-list, security headers/CSP, PHI_TMPDIR, log level, and CloudWatch metrics export.

Optional feature flags gate modules such as inpatient review, letter generation, and intelligent allocation; leave them at defaults unless enabling a specific capability.

6. Data, sensitive information and encryption

Where data is stored - the container holds no durable data:

• PHI, users, guidelines, audit logs -> Amazon DocumentDB (buyer-owned).
• Documents, OCR output, letters -> Amazon S3 (buyer-owned).
• Task/cache data -> Redis (ephemeral).
• Transient PHI temp files -> an owner-only container directory (PHI_TMPDIR, mode 0700/0600), deleted after use - never world-readable /tmp.
• Secrets -> AWS Secrets Manager / SSM (buyer-owned).

Encryption:

• In transit: TLS everywhere - ALB terminates HTTPS to clients; DocumentDB connections enforce TLS; enable in-transit encryption for Redis (REDIS_SSL); all AWS SDK calls use HTTPS.
• At rest: enable AWS KMS encryption on DocumentDB, S3, ElastiCache, and Secrets Manager when you provision them.
• Decryption: the app uses no proprietary encryption. Managed services transparently decrypt for the container's IAM role; JWTs issued by the API are signed (not encrypted) with JWT_SECRET_KEY and verified per request.

7. Credentials and rotation

Store all credentials in Secrets Manager / SSM and rotate on a regular cadence (align to your security policy, typically 90 days or less):

• JWT signing key / app secret (JWT_SECRET_KEY, SECRET_KEY) - rotating invalidates outstanding tokens; roll API and workers together.
• DocumentDB / Redis passwords - use managed rotation and redeploy so all services pick up the new value.
• Identity-provider client secret and OCR key - rotate before expiry; overlap old/new during cutover.
• AWS access: use IAM task roles / IRSA - avoid long-lived access keys.

Procedure: update the secret -> rolling redeploy of API + all workers -> confirm health -> revoke the old value.

8. Backup, recovery and health

Backup / recovery (standard, non-proprietary stores):

• DocumentDB (system of record): enable automated snapshots + point-in-time recovery; restore to a new cluster and repoint the connection string. Required indexes are re-created automatically at startup.
• S3: enable versioning (and optional cross-Region replication for DR).
• Redis: treated as ephemeral; in-flight work is re-driven from DocumentDB state.

Because the container is stateless, DR is: restore DocumentDB + S3, redeploy the image, repoint environment variables.

Health monitoring:

• In the ECS/EKS console, confirm running count = desired count and tasks/pods are healthy (the container has a built-in health check and the ALB checks /health).
• Call GET /health for a fast liveness signal (it does not probe downstreams, so downstream slowness never falsely marks the API down).
• Enable CloudWatch metrics export (token usage, cost, latency, decisions, guardrails) and send container logs to CloudWatch Logs (logs are PHI-safe).
• Recommended alarms: unhealthy target hosts, service running-count below desired, DocumentDB/Redis CPU and connections, and Bedrock throttling/error rate.

9. Service quotas, IAM and pricing

Service quotas - request increases proactively via Service Quotas:

• Amazon Bedrock per-model requests-per-minute and tokens-per-minute is the primary scaling constraint.
• Also monitor ECS/Fargate tasks, DocumentDB instances/connections, ElastiCache nodes, and OCR TPS.

IAM (least privilege, task role / IRSA): bedrock:InvokeModel* on the configured models; s3:GetObject/PutObject/ListBucket/DeleteObject on the configured bucket(s); secretsmanager:GetSecretValue / ssm:GetParameter* and kms:Decrypt on the relevant resources; CloudWatch PutMetricData / log permissions when enabled. The execution role additionally needs ECR pull and secret-read permissions.

Pricing - software is billed through AWS Marketplace at the listed rate. You separately pay standard AWS rates for the infrastructure you run it on: ECS/EKS compute, DocumentDB, ElastiCache, S3, Amazon Bedrock per-token inference (usually the largest variable cost), OCR, load balancer, Secrets Manager, and CloudWatch. Estimate with the AWS Pricing Calculator; Bedrock token spend and compute/DocumentDB sizing dominate total cost.

10. Security and compliance (PHI)

This product processes Protected Health Information. To operate it in a HIPAA-eligible manner: execute an AWS Business Associate Addendum and use HIPAA-eligible services; enable KMS encryption at rest and TLS in transit; run all containers and data stores in private subnets exposing only the ALB; restrict the container security group so port 7000 is reachable only from the load balancer; keep the container non-root; scope IAM to least privilege; retain the DocumentDB audit trail per policy; and keep input/output guardrails and PII redaction enabled in production.

11. Upgrades and release notes

Upgrades are a rolling image replacement with no data migration (indexes are ensured idempotently at startup):

1. Review release notes for the target version and any new required environment variables.
2. Snapshot DocumentDB and confirm S3 versioning before upgrading production.
3. Pull the new image tag and roll out the API and all worker services to the same version.
4. Verify health and run a smoke test. Roll back to the prior image tag if needed - rollback is immediate since no destructive migration runs.

Release notes (v1.0.0 - initial release): PA/UM API with OCR, Bedrock-powered extraction and guideline evaluation, patient summarization, inpatient/concurrent review, determination letters, analytics, and governance guardrails; hardened non-root container with PHI-safe temp handling and TLS-enforced database connectivity. Future releases are labeled Critical (security), Important, or Optional.

12. Support

This product is provided by Penguin AI. For product support, questions, or issues, contact support@penguinai.co . AWS infrastructure issues are handled through AWS Support. A running instance serves its interactive API reference at /docs and /redoc.