# EmpowerHealth - Comprehensive Architecture Design Document
## Executive Summary
The EmpowerHealth platform is a cloud-native healthcare analytics application designed to process Epic EMR data through Snowflake, providing AI-powered DRG analysis and patient risk scoring. This architecture leverages Azure services for infrastructure, hosting, and backup ML capabilities, while primarily utilizing Snowflake's Cortex AI for machine learning workloads.
## Table of Contents
1. [High-Level System Architecture](#high-level-system-architecture)
2. [Frontend Architecture](#frontend-architecture)
3. [Backend Services Architecture](#backend-services-architecture)
4. [Data & ML Pipeline Architecture](#data--ml-pipeline-architecture)
5. [Infrastructure & Networking](#infrastructure--networking)
6. [Security & Compliance Architecture](#security--compliance-architecture)
7. [CI/CD & Deployment Pipeline](#cicd--deployment-pipeline)
8. [Monitoring & Observability](#monitoring--observability)
9. [Implementation Details](#implementation-details)
10. [Cost Optimization Strategy](#cost-optimization-strategy)
---
## High-Level System Architecture
This diagram shows the complete end-to-end architecture from users to data processing:
```mermaid
graph TB
%% User Layer
subgraph "User Access Layer"
DOCTOR[Healthcare Providers]
ADMIN[Hospital Administrators]
ANALYST[Data Analysts]
end
%% Frontend Infrastructure
subgraph "Frontend Infrastructure"
DNS[Azure DNS]
CDN[Azure Front Door CDN]
WAF[Azure WAF]
CERT[Key Vault Certificates]
end
%% Application Layer
subgraph "Application Layer"
REACT[React Frontend]
STATICWEB[Azure Static Web Apps]
BLOB[Blob Storage Static Hosting]
end
%% Authentication
subgraph "Authentication & Authorization"
AAD[Azure AD B2C]
SAML[Hospital SSO/SAML]
JWT[JWT Tokens]
end
%% Backend Infrastructure
subgraph "Backend Infrastructure"
ALB[Application Gateway]
APPSERVICE[App Service]
FASTAPI[FastAPI Application]
CACHE[Azure Cache for Redis]
end
%% Data Platform
subgraph "Data Platform"
SNOWFLAKE[Snowflake Data Cloud]
STAGING[Data Staging]
WAREHOUSE[Data Warehouse]
MODELS[ML Models]
end
%% Primary ML Engine
subgraph "Primary ML Engine (Snowflake)"
CORTEX[Snowflake Cortex AI]
DRG_SF[DRG Classification]
RISK_SF[Risk Scoring]
NLP_SF[Clinical NLP]
end
%% Backup ML Engine
subgraph "Backup ML Engine (Azure)"
AML[Azure Machine Learning]
TEXTANALYTICS[Text Analytics for Health]
OPENAI[Azure OpenAI Service]
FUNCTIONS_ML[Azure Functions ML]
end
%% External Data Sources
subgraph "Data Sources"
EPIC[Epic EMR]
HL7[HL7 FHIR]
LABS[Lab Systems]
PHARMACY[Pharmacy Systems]
end
%% Security & Monitoring
subgraph "Security & Monitoring"
KEYVAULT[Key Vault]
MONITOR[Azure Monitor]
ACTIVITYLOG[Activity Log]
ALERTS[Event Grid Alerts]
end
%% User Connections
DOCTOR --> DNS
ADMIN --> DNS
ANALYST --> DNS
%% Frontend Flow
DNS --> CDN
CDN --> WAF
WAF --> CERT
CERT --> STATICWEB
STATICWEB --> REACT
STATICWEB --> BLOB
%% Authentication Flow
REACT --> AAD
AAD --> SAML
AAD --> JWT
%% Backend Flow
REACT --> ALB
ALB --> APPSERVICE
APPSERVICE --> FASTAPI
FASTAPI --> CACHE
%% Data Platform Connections
FASTAPI --> SNOWFLAKE
SNOWFLAKE --> STAGING
STAGING --> WAREHOUSE
WAREHOUSE --> MODELS
%% Primary ML Flow
MODELS --> CORTEX
CORTEX --> DRG_SF
CORTEX --> RISK_SF
CORTEX --> NLP_SF
%% Backup ML Flow (dotted lines)
FASTAPI -.-> AML
FASTAPI -.-> TEXTANALYTICS
FASTAPI -.-> OPENAI
FASTAPI -.-> FUNCTIONS_ML
%% Data Ingestion
EPIC --> STAGING
HL7 --> STAGING
LABS --> STAGING
PHARMACY --> STAGING
%% Security Connections
FASTAPI --> KEYVAULT
APPSERVICE --> MONITOR
ALB --> ACTIVITYLOG
MONITOR --> ALERTS
%% Styling
classDef users fill:#e8f5e8,stroke:#2e7d32,stroke-width:3px,color:#000
classDef frontend fill:#e3f2fd,stroke:#1565c0,stroke-width:3px,color:#000
classDef auth fill:#fff3e0,stroke:#f57c00,stroke-width:3px,color:#000
classDef backend fill:#f3e5f5,stroke:#7b1fa2,stroke-width:3px,color:#000
classDef data fill:#e0f2f1,stroke:#00695c,stroke-width:3px,color:#000
classDef ml_primary fill:#e8f5e8,stroke:#388e3c,stroke-width:3px,color:#000
classDef ml_backup fill:#ffebee,stroke:#c62828,stroke-width:3px,color:#000
classDef sources fill:#f1f8e9,stroke:#689f38,stroke-width:3px,color:#000
classDef security fill:#fce4ec,stroke:#ad1457,stroke-width:3px,color:#000
class DOCTOR,ADMIN,ANALYST users
class DNS,CDN,WAF,CERT,REACT,STATICWEB,BLOB frontend
class AAD,SAML,JWT auth
class ALB,APPSERVICE,FASTAPI,CACHE backend
class SNOWFLAKE,STAGING,WAREHOUSE,MODELS data
class CORTEX,DRG_SF,RISK_SF,NLP_SF ml_primary
class AML,TEXTANALYTICS,OPENAI,FUNCTIONS_ML ml_backup
class EPIC,HL7,LABS,PHARMACY sources
class KEYVAULT,MONITOR,ACTIVITYLOG,ALERTS security
```
### Architecture Overview
The EmpowerHealth system follows a modern cloud-native architecture with the following key principles:
- **Microservices Architecture**: Loosely coupled services that can be developed, deployed, and scaled independently
- **Infrastructure as Code**: All infrastructure managed through Terraform for consistency and repeatability
- **Security by Design**: Multi-layered security approach with defense in depth
- **High Availability**: Multi-zone deployment with auto-scaling and failover capabilities
- **Cost Optimization**: Environment-specific resource allocation and auto-scaling
---
## Frontend Architecture
The frontend layer provides a secure, scalable, and performant user interface for healthcare professionals:
```mermaid
graph TB
subgraph "Global Distribution"
subgraph "DNS Layer"
DNS[Azure DNS]
HEALTH[Health Checks]
end
subgraph "CDN Layer"
FD_GLOBAL[Azure Front Door Global]
EDGE[Edge Locations]
CACHE_POLICY[Cache Policies]
end
end
subgraph "Security Layer"
WAF_LAYER[Azure WAF]
BOT_CONTROL[Bot Control]
RATE_LIMIT[Rate Limiting]
GEO_BLOCK[Geo Blocking]
SSL_TERM[SSL Termination]
end
subgraph "Multi-Environment Hosting"
subgraph "Development Environment"
SWA_DEV[Static Web Apps Dev]
BLOB_DEV[Blob Storage Dev]
CDN_DEV[Azure CDN Dev]
end
subgraph "Staging Environment"
SWA_STAGE[Static Web Apps Staging]
BLOB_STAGE[Blob Storage Staging]
CDN_STAGE[Azure CDN Staging]
end
subgraph "Production Environment"
SWA_PROD[Static Web Apps Production]
BLOB_PROD[Blob Storage Production]
CDN_PROD[Azure CDN Production]
end
end
subgraph "React Application"
COMPONENTS[React Components]
STATE[State Management]
ROUTING[React Router]
API_CLIENT[API Client]
subgraph "UI Components"
DASHBOARD[DRG Dashboard]
PATIENT_VIEW[Patient Details]
ANALYTICS[Analytics Views]
SETTINGS[Settings Panel]
end
end
subgraph "Frontend Authentication"
MSAL_AUTH[MSAL Auth]
AAD_SDK[Azure AD B2C SDK]
JWT_STORE[JWT Storage]
SESSION_MGT[Session Management]
end
%% DNS Flow
DNS --> HEALTH
DNS --> FD_GLOBAL
FD_GLOBAL --> EDGE
EDGE --> CACHE_POLICY
%% Security Flow
FD_GLOBAL --> WAF_LAYER
WAF_LAYER --> BOT_CONTROL
WAF_LAYER --> RATE_LIMIT
WAF_LAYER --> GEO_BLOCK
WAF_LAYER --> SSL_TERM
%% Environment Routing
SSL_TERM --> SWA_DEV
SSL_TERM --> SWA_STAGE
SSL_TERM --> SWA_PROD
SWA_DEV --> BLOB_DEV
SWA_STAGE --> BLOB_STAGE
SWA_PROD --> BLOB_PROD
BLOB_DEV --> CDN_DEV
BLOB_STAGE --> CDN_STAGE
BLOB_PROD --> CDN_PROD
%% Application Layer
CDN_DEV --> COMPONENTS
CDN_STAGE --> COMPONENTS
CDN_PROD --> COMPONENTS
COMPONENTS --> STATE
COMPONENTS --> ROUTING
COMPONENTS --> API_CLIENT
COMPONENTS --> DASHBOARD
COMPONENTS --> PATIENT_VIEW
COMPONENTS --> ANALYTICS
COMPONENTS --> SETTINGS
%% Authentication Integration
COMPONENTS --> MSAL_AUTH
MSAL_AUTH --> AAD_SDK
AAD_SDK --> JWT_STORE
JWT_STORE --> SESSION_MGT
%% Styling
classDef dns fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef cdn fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef security fill:#ffebee,stroke:#c62828,stroke-width:2px
classDef hosting fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef react fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef auth fill:#fff3e0,stroke:#f57c00,stroke-width:2px
class DNS,HEALTH dns
class FD_GLOBAL,EDGE,CACHE_POLICY cdn
class WAF_LAYER,BOT_CONTROL,RATE_LIMIT,GEO_BLOCK,SSL_TERM security
class SWA_DEV,SWA_STAGE,SWA_PROD,BLOB_DEV,BLOB_STAGE,BLOB_PROD,CDN_DEV,CDN_STAGE,CDN_PROD hosting
class COMPONENTS,STATE,ROUTING,API_CLIENT,DASHBOARD,PATIENT_VIEW,ANALYTICS,SETTINGS react
class MSAL_AUTH,AAD_SDK,JWT_STORE,SESSION_MGT auth
```
### Frontend Components Explained
**DNS & Global Distribution:**
- Azure DNS provides DNS management with health checks and failover
- Azure Front Door CDN ensures global content delivery with sub-100ms latency
- Edge locations cache static assets close to users worldwide
**Security Layer:**
- Azure WAF protects against common web exploits (OWASP Top 10)
- Bot control prevents automated attacks
- Rate limiting protects against DDoS
- Geo-blocking restricts access by location if needed
**Multi-Environment Strategy:**
- Separate environments for development, staging, and production
- Each environment has its own Static Web Apps instance, Blob storage, and CDN distribution
- Allows for safe testing and gradual rollouts
**React Application Features:**
- Modern React 18+ with hooks and functional components
- State management using Redux Toolkit or Zustand
- React Router for client-side routing
- Optimized API client with request/response interceptors
---
## Backend Services Architecture
The backend provides secure API services and integrates with both Snowflake and Azure ML services:
```mermaid
graph TB
subgraph "Load Balancing & Ingress"
ALB[Application Gateway]
TG_DEV[Target Pool Dev]
TG_STAGE[Target Pool Staging]
TG_PROD[Target Pool Production]
subgraph "Health Monitoring"
HC_DEV[Health Check Dev]
HC_STAGE[Health Check Staging]
HC_PROD[Health Check Production]
end
end
subgraph "VNet Network Architecture"
subgraph "Public Subnet"
NAT[NAT Gateway]
PIP[Public IP]
end
subgraph "Private Subnet AZ-1"
AS_DEV[App Service Dev]
INSTANCE_DEV1[VM Instance Dev-1]
INSTANCE_DEV2[VM Instance Dev-2]
end
subgraph "Private Subnet AZ-2"
AS_STAGE[App Service Staging]
INSTANCE_STAGE1[VM Instance Stage-1]
INSTANCE_STAGE2[VM Instance Stage-2]
end
subgraph "Private Subnet AZ-3"
AS_PROD[App Service Production]
INSTANCE_PROD1[VM Instance Prod-1]
INSTANCE_PROD2[VM Instance Prod-2]
INSTANCE_PROD3[VM Instance Prod-3]
end
end
subgraph "FastAPI Application Layer"
subgraph "API Endpoints"
AUTH_API[Authentication API]
PATIENT_API[Patient API]
DRG_API[DRG Analysis API]
ML_API[ML Inference API]
ADMIN_API[Admin API]
end
subgraph "Business Logic"
DRG_LOGIC[DRG Classification Logic]
RISK_LOGIC[Risk Scoring Logic]
REPORT_LOGIC[Report Generation]
AUDIT_LOGIC[Audit Logging]
end
subgraph "Data Connectors"
SF_CONNECTOR[Snowflake Connector]
CACHE_CONNECTOR[Redis Connector]
ML_CONNECTOR[ML Service Connector]
end
end
subgraph "Caching & Session Management"
REDIS_DEV[Azure Cache Dev]
REDIS_STAGE[Azure Cache Staging]
REDIS_PROD[Azure Cache Prod Cluster]
subgraph "Cache Strategies"
QUERY_CACHE[Query Result Cache]
SESSION_CACHE[Session Cache]
ML_CACHE[ML Prediction Cache]
end
end
subgraph "Network Security Groups"
NSG_ALB[ALB NSG]
NSG_APP[App Service NSG]
NSG_REDIS[Redis NSG]
end
%% Load Balancer Flow
ALB --> TG_DEV
ALB --> TG_STAGE
ALB --> TG_PROD
TG_DEV --> HC_DEV
TG_STAGE --> HC_STAGE
TG_PROD --> HC_PROD
%% Network Flow
PIP --> ALB
ALB --> NSG_ALB
NSG_ALB --> AS_DEV
NSG_ALB --> AS_STAGE
NSG_ALB --> AS_PROD
AS_DEV --> INSTANCE_DEV1
AS_DEV --> INSTANCE_DEV2
AS_STAGE --> INSTANCE_STAGE1
AS_STAGE --> INSTANCE_STAGE2
AS_PROD --> INSTANCE_PROD1
AS_PROD --> INSTANCE_PROD2
AS_PROD --> INSTANCE_PROD3
%% NAT Gateway for outbound
INSTANCE_DEV1 --> NAT
INSTANCE_STAGE1 --> NAT
INSTANCE_PROD1 --> NAT
%% FastAPI Layer
INSTANCE_DEV1 --> AUTH_API
INSTANCE_STAGE1 --> PATIENT_API
INSTANCE_PROD1 --> DRG_API
INSTANCE_PROD2 --> ML_API
INSTANCE_PROD3 --> ADMIN_API
AUTH_API --> DRG_LOGIC
PATIENT_API --> RISK_LOGIC
DRG_API --> REPORT_LOGIC
ML_API --> AUDIT_LOGIC
DRG_LOGIC --> SF_CONNECTOR
RISK_LOGIC --> CACHE_CONNECTOR
REPORT_LOGIC --> ML_CONNECTOR
%% Caching
CACHE_CONNECTOR --> REDIS_DEV
CACHE_CONNECTOR --> REDIS_STAGE
CACHE_CONNECTOR --> REDIS_PROD
REDIS_PROD --> QUERY_CACHE
REDIS_PROD --> SESSION_CACHE
REDIS_PROD --> ML_CACHE
%% Security
NSG_ALB --> NSG_APP
NSG_APP --> NSG_REDIS
%% Styling
classDef lb fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef network fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef compute fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef api fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef cache fill:#ffebee,stroke:#c62828,stroke-width:2px
classDef security fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
class ALB,TG_DEV,TG_STAGE,TG_PROD,HC_DEV,HC_STAGE,HC_PROD lb
class NAT,PIP network
class AS_DEV,AS_STAGE,AS_PROD,INSTANCE_DEV1,INSTANCE_DEV2,INSTANCE_STAGE1,INSTANCE_STAGE2,INSTANCE_PROD1,INSTANCE_PROD2,INSTANCE_PROD3 compute
class AUTH_API,PATIENT_API,DRG_API,ML_API,ADMIN_API,DRG_LOGIC,RISK_LOGIC,REPORT_LOGIC,AUDIT_LOGIC,SF_CONNECTOR,CACHE_CONNECTOR,ML_CONNECTOR api
class REDIS_DEV,REDIS_STAGE,REDIS_PROD,QUERY_CACHE,SESSION_CACHE,ML_CACHE cache
class NSG_ALB,NSG_APP,NSG_REDIS security
```
### Backend Architecture Explained
**Load Balancing & High Availability:**
- Application Gateway distributes traffic across multiple Availability Zones
- Health checks ensure only healthy instances receive traffic
- Auto-scaling maintains desired capacity and replaces unhealthy instances
**Network Security:**
- Private subnets ensure backend instances are not directly accessible from internet
- NAT Gateway provides secure outbound internet access for software updates
- Multiple layers of network security groups control traffic flow
**FastAPI Application Design:**
- RESTful API following OpenAPI 3.0 specification
- Async/await patterns for high-concurrency workloads
- Structured logging and comprehensive error handling
- JWT-based authentication with role-based access control
**Caching Strategy:**
- Azure Cache for Redis clusters for high-performance data caching
- Multi-tier caching: query results, session data, ML predictions
- Cache invalidation strategies for data consistency
---
## Data & ML Pipeline Architecture
This shows the complete data flow from Epic EMR through Snowflake ML and Azure backup services:
```mermaid
graph TB
subgraph "Healthcare Data Sources"
subgraph "Epic EMR System"
EPIC_PROD[Epic Production]
EPIC_TEST[Epic Test Environment]
EPIC_API[Epic FHIR APIs]
end
subgraph "Additional Sources"
HL7[HL7 Messages]
LAB_SYS[Laboratory Systems]
PHARMACY[Pharmacy Systems]
IMAGING[Medical Imaging]
end
end
subgraph "Data Ingestion Layer"
subgraph "Snowflake Ingestion"
SNOWPIPE[Snowpipe Auto-Ingestion]
STAGE_EXTERNAL[External Stages]
STAGE_INTERNAL[Internal Stages]
end
subgraph "Data Processing"
STREAMS[Snowflake Streams]
TASKS[Snowflake Tasks]
PROCEDURES[Stored Procedures]
end
end
subgraph "Snowflake Data Architecture"
subgraph "Raw Data Layer"
RAW_PATIENT[Raw Patient Data]
RAW_CLINICAL[Raw Clinical Data]
RAW_BILLING[Raw Billing Data]
RAW_LAB[Raw Lab Results]
end
subgraph "Cleansed Data Layer"
CLEAN_PATIENT[Cleansed Patient Data]
CLEAN_CLINICAL[Cleansed Clinical Data]
CLEAN_BILLING[Cleansed Billing Data]
CLEAN_LAB[Cleansed Lab Results]
end
subgraph "Analytics Layer"
DIM_PATIENT[Patient Dimension]
DIM_PROVIDER[Provider Dimension]
DIM_DIAGNOSIS[Diagnosis Dimension]
FACT_ENCOUNTER[Encounter Facts]
FACT_BILLING[Billing Facts]
end
end
subgraph "Primary ML Engine - Snowflake Cortex"
subgraph "Cortex AI Functions"
EXTRACT[EXTRACT_ANSWER]
CLASSIFY[CLASSIFY_TEXT]
SENTIMENT[SENTIMENT]
SUMMARIZE[SUMMARIZE]
TRANSLATE[TRANSLATE]
end
subgraph "Custom ML Models"
DRG_MODEL[DRG Classification Model]
RISK_MODEL[Risk Stratification Model]
LOS_MODEL[Length of Stay Prediction]
READMIT_MODEL[Readmission Risk Model]
end
subgraph "Feature Engineering"
FEATURE_STORE[Feature Store]
FEATURE_PIPELINE[Feature Pipelines]
FEATURE_MONITORING[Feature Monitoring]
end
end
subgraph "Backup ML Engine - Azure Services"
subgraph "Azure Machine Learning"
AML_STUDIO[AML Studio]
AML_TRAINING[Training Jobs]
AML_ENDPOINTS[Model Endpoints]
AML_PIPELINES[ML Pipelines]
end
subgraph "Text Analytics for Health"
NER[Named Entity Recognition]
ICD_MAPPING[ICD-10 Code Mapping]
CLINICAL_EXTRACT[Clinical Information Extraction]
end
subgraph "Azure OpenAI Service"
GPT4[GPT-4 Models]
CUSTOM_MODELS[Custom Fine-tuned Models]
PROMPT_FLOW[Prompt Flow]
end
subgraph "Azure Functions"
FUNC_INFERENCE[Real-time Inference]
FUNC_BATCH[Batch Processing]
FUNC_PREPROCESS[Data Preprocessing]
end
end
subgraph "ML Model Deployment & Serving"
subgraph "Model Registry"
MODEL_REGISTRY[Centralized Model Registry]
VERSION_CONTROL[Model Versioning]
A_B_TESTING[A/B Testing Framework]
end
subgraph "Model Serving"
REAL_TIME[Real-time Inference]
BATCH_SCORING[Batch Scoring]
STREAMING[Streaming Inference]
end
end
%% Data Source Flow
EPIC_PROD --> SNOWPIPE
EPIC_TEST --> SNOWPIPE
EPIC_API --> STAGE_EXTERNAL
HL7 --> STAGE_EXTERNAL
LAB_SYS --> STAGE_INTERNAL
PHARMACY --> STAGE_INTERNAL
IMAGING --> STAGE_EXTERNAL
%% Ingestion Flow
SNOWPIPE --> STREAMS
STAGE_EXTERNAL --> STREAMS
STAGE_INTERNAL --> STREAMS
STREAMS --> TASKS
TASKS --> PROCEDURES
%% Data Layer Flow
PROCEDURES --> RAW_PATIENT
PROCEDURES --> RAW_CLINICAL
PROCEDURES --> RAW_BILLING
PROCEDURES --> RAW_LAB
RAW_PATIENT --> CLEAN_PATIENT
RAW_CLINICAL --> CLEAN_CLINICAL
RAW_BILLING --> CLEAN_BILLING
RAW_LAB --> CLEAN_LAB
CLEAN_PATIENT --> DIM_PATIENT
CLEAN_CLINICAL --> DIM_PROVIDER
CLEAN_CLINICAL --> DIM_DIAGNOSIS
CLEAN_CLINICAL --> FACT_ENCOUNTER
CLEAN_BILLING --> FACT_BILLING
%% Primary ML Flow
FACT_ENCOUNTER --> EXTRACT
FACT_ENCOUNTER --> CLASSIFY
FACT_ENCOUNTER --> SENTIMENT
FACT_ENCOUNTER --> SUMMARIZE
FACT_ENCOUNTER --> TRANSLATE
EXTRACT --> DRG_MODEL
CLASSIFY --> RISK_MODEL
SENTIMENT --> LOS_MODEL
SUMMARIZE --> READMIT_MODEL
DRG_MODEL --> FEATURE_STORE
RISK_MODEL --> FEATURE_PIPELINE
LOS_MODEL --> FEATURE_MONITORING
%% Backup ML Flow (dotted lines)
FACT_ENCOUNTER -.-> AML_STUDIO
FACT_ENCOUNTER -.-> NER
FACT_ENCOUNTER -.-> GPT4
FACT_ENCOUNTER -.-> FUNC_INFERENCE
AML_STUDIO -.-> AML_TRAINING
AML_TRAINING -.-> AML_ENDPOINTS
AML_ENDPOINTS -.-> AML_PIPELINES
NER -.-> ICD_MAPPING
ICD_MAPPING -.-> CLINICAL_EXTRACT
GPT4 -.-> CUSTOM_MODELS
CUSTOM_MODELS -.-> PROMPT_FLOW
FUNC_INFERENCE -.-> FUNC_BATCH
FUNC_BATCH -.-> FUNC_PREPROCESS
%% Model Deployment
DRG_MODEL --> MODEL_REGISTRY
RISK_MODEL --> MODEL_REGISTRY
AML_ENDPOINTS -.-> MODEL_REGISTRY
MODEL_REGISTRY --> VERSION_CONTROL
VERSION_CONTROL --> A_B_TESTING
A_B_TESTING --> REAL_TIME
A_B_TESTING --> BATCH_SCORING
A_B_TESTING --> STREAMING
%% Styling
classDef sources fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef ingestion fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef data fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef snowflake_ml fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef azure_ml fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef deployment fill:#ffebee,stroke:#c62828,stroke-width:2px
class EPIC_PROD,EPIC_TEST,EPIC_API,HL7,LAB_SYS,PHARMACY,IMAGING sources
class SNOWPIPE,STAGE_EXTERNAL,STAGE_INTERNAL,STREAMS,TASKS,PROCEDURES ingestion
class RAW_PATIENT,RAW_CLINICAL,RAW_BILLING,RAW_LAB,CLEAN_PATIENT,CLEAN_CLINICAL,CLEAN_BILLING,CLEAN_LAB,DIM_PATIENT,DIM_PROVIDER,DIM_DIAGNOSIS,FACT_ENCOUNTER,FACT_BILLING data
class EXTRACT,CLASSIFY,SENTIMENT,SUMMARIZE,TRANSLATE,DRG_MODEL,RISK_MODEL,LOS_MODEL,READMIT_MODEL,FEATURE_STORE,FEATURE_PIPELINE,FEATURE_MONITORING snowflake_ml
class AML_STUDIO,AML_TRAINING,AML_ENDPOINTS,AML_PIPELINES,NER,ICD_MAPPING,CLINICAL_EXTRACT,GPT4,CUSTOM_MODELS,PROMPT_FLOW,FUNC_INFERENCE,FUNC_BATCH,FUNC_PREPROCESS azure_ml
class MODEL_REGISTRY,VERSION_CONTROL,A_B_TESTING,REAL_TIME,BATCH_SCORING,STREAMING deployment
```
### ML/AI Strategy Explained
**Primary Path - Snowflake Cortex AI:**
- **Built-in AI Functions**: Pre-trained models for common ML tasks
- **Custom Model Training**: Using Snowflake ML for domain-specific models
- **Feature Engineering**: Leverage SQL and Python for feature creation
- **Real-time Scoring**: Low-latency inference directly in Snowflake
**Backup Path - Azure ML Services:**
- **Azure Machine Learning**: For custom model development when Snowflake capabilities are insufficient
- **Text Analytics for Health**: Medical-specific NLP for clinical text processing
- **Azure OpenAI Service**: Large language models for advanced text generation and analysis
- **Azure Functions**: Lightweight ML functions for simple inference tasks
**Model Deployment Strategy:**
- A/B testing framework for comparing model performance
- Centralized model registry for version control and governance
- Multiple serving patterns: real-time, batch, and streaming inference
---
## Infrastructure & Networking
This diagram shows the complete Azure infrastructure setup with security zones:
```mermaid
graph TB
subgraph "Global Infrastructure"
subgraph "DNS & CDN"
DNS[Azure DNS Hosted Zone]
FD_GLOBAL[Azure Front Door Global Distribution]
EDGE_CACHE[Edge Location Cache]
end
subgraph "Certificate Management"
KV_CERTS[Key Vault Certificates]
MANAGED_CERTS[Managed Certificates]
end
end
subgraph "Azure Region: East US"
subgraph "VNet: 10.10.0.0/16"
subgraph "Public Subnets"
PUB_1[Public Subnet 1<br/>10.10.10.0/24]
PUB_2[Public Subnet 2<br/>10.10.20.0/24]
PUB_3[Public Subnet 3<br/>10.10.30.0/24]
PIP[Public IPs]
NAT_1[NAT Gateway 1]
NAT_2[NAT Gateway 2]
NAT_3[NAT Gateway 3]
end
subgraph "Private Application Subnets"
APP_1[App Subnet 1<br/>10.10.110.0/24]
APP_2[App Subnet 2<br/>10.10.120.0/24]
APP_3[App Subnet 3<br/>10.10.130.0/24]
AS_DEV[App Service Dev]
AS_STAGE[App Service Staging]
AS_PROD[App Service Production]
end
subgraph "Private Database Subnets"
DB_1[DB Subnet 1<br/>10.10.210.0/24]
DB_2[DB Subnet 2<br/>10.10.220.0/24]
DB_3[DB Subnet 3<br/>10.10.230.0/24]
REDIS_CLUSTER[Azure Cache for Redis]
POSTGRES[Azure Database for PostgreSQL]
end
end
subgraph "Network Security Groups"
NSG_ALB[ALB NSG<br/>Port 80, 443]
NSG_APP[App Service NSG<br/>Port 5000]
NSG_REDIS[Redis NSG<br/>Port 6379]
NSG_DB[Database NSG<br/>Port 5432]
end
end
subgraph "Load Balancing Layer"
ALB[Application Gateway]
TG_DEV[Backend Pool Dev]
TG_STAGE[Backend Pool Staging]
TG_PROD[Backend Pool Production]
subgraph "Health Checks"
HC_DEV[/health endpoint Dev/]
HC_STAGE[/health endpoint Staging/]
HC_PROD[/health endpoint Production/]
end
end
subgraph "Auto Scaling"
subgraph "Scaling Policies"
SCALE_DEV[Scale Set Dev<br/>Min: 1, Max: 2]
SCALE_STAGE[Scale Set Staging<br/>Min: 1, Max: 3]
SCALE_PROD[Scale Set Production<br/>Min: 2, Max: 10]
end
subgraph "Azure Monitor Metrics"
MON_CPU[CPU Utilization]
MON_MEMORY[Memory Utilization]
MON_REQUEST[Request Count]
MON_LATENCY[Response Latency]
end
end
subgraph "Infrastructure as Code"
subgraph "Terraform Modules"
TF_VNET[VNet Module]
TF_SECURITY[Security Module]
TF_COMPUTE[Compute Module]
TF_DATABASE[Database Module]
TF_MONITORING[Monitoring Module]
end
subgraph "State Management"
TF_STATE[Terraform State]
TF_LOCK[State Locking]
STORAGE_BACKEND[Storage Account Backend]
TABLE_LOCK[Table Storage Lock]
end
end
%% Global Infrastructure Flow
DNS --> FD_GLOBAL
FD_GLOBAL --> EDGE_CACHE
FD_GLOBAL --> KV_CERTS
KV_CERTS --> MANAGED_CERTS
%% VNet Network Flow
PIP --> PUB_1
PIP --> PUB_2
PIP --> PUB_3
PUB_1 --> NAT_1
PUB_2 --> NAT_2
PUB_3 --> NAT_3
NAT_1 --> APP_1
NAT_2 --> APP_2
NAT_3 --> APP_3
%% Application Deployment
APP_1 --> AS_DEV
APP_2 --> AS_STAGE
APP_3 --> AS_PROD
%% Database Layer
APP_1 --> DB_1
APP_2 --> DB_2
APP_3 --> DB_3
DB_1 --> REDIS_CLUSTER
DB_2 --> REDIS_CLUSTER
DB_3 --> POSTGRES
%% Load Balancer Flow
FD_GLOBAL --> ALB
ALB --> TG_DEV
ALB --> TG_STAGE
ALB --> TG_PROD
TG_DEV --> HC_DEV
TG_STAGE --> HC_STAGE
TG_PROD --> HC_PROD
TG_DEV --> AS_DEV
TG_STAGE --> AS_STAGE
TG_PROD --> AS_PROD
%% Network Security Groups
ALB --> NSG_ALB
AS_DEV --> NSG_APP
AS_STAGE --> NSG_APP
AS_PROD --> NSG_APP
REDIS_CLUSTER --> NSG_REDIS
POSTGRES --> NSG_DB
%% Auto Scaling
AS_DEV --> SCALE_DEV
AS_STAGE --> SCALE_STAGE
AS_PROD --> SCALE_PROD
SCALE_DEV --> MON_CPU
SCALE_STAGE --> MON_MEMORY
SCALE_PROD --> MON_REQUEST
SCALE_PROD --> MON_LATENCY
%% Terraform Management
TF_VNET --> TF_STATE
TF_SECURITY --> TF_STATE
TF_COMPUTE --> TF_STATE
TF_DATABASE --> TF_STATE
TF_MONITORING --> TF_STATE
TF_STATE --> TF_LOCK
TF_LOCK --> STORAGE_BACKEND
TF_LOCK --> TABLE_LOCK
%% Styling
classDef global fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef public fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef private fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef database fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef security fill:#ffebee,stroke:#c62828,stroke-width:2px
classDef lb fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef scaling fill:#fce4ec,stroke:#ad1457,stroke-width:2px
classDef terraform fill:#f1f8e9,stroke:#689f38,stroke-width:2px
class DNS,FD_GLOBAL,EDGE_CACHE,KV_CERTS,MANAGED_CERTS global
class PUB_1,PUB_2,PUB_3,PIP,NAT_1,NAT_2,NAT_3 public
class APP_1,APP_2,APP_3,AS_DEV,AS_STAGE,AS_PROD private
class DB_1,DB_2,DB_3,REDIS_CLUSTER,POSTGRES database
class NSG_ALB,NSG_APP,NSG_REDIS,NSG_DB security
class ALB,TG_DEV,TG_STAGE,TG_PROD,HC_DEV,HC_STAGE,HC_PROD lb
class SCALE_DEV,SCALE_STAGE,SCALE_PROD,MON_CPU,MON_MEMORY,MON_REQUEST,MON_LATENCY scaling
class TF_VNET,TF_SECURITY,TF_COMPUTE,TF_DATABASE,TF_MONITORING,TF_STATE,TF_LOCK,STORAGE_BACKEND,TABLE_LOCK terraform
```
### Infrastructure Features
**Multi-Zone Deployment:**
- Resources distributed across multiple Availability Zones for high availability
- Automatic failover in case of zone outages
- Cross-zone load balancing for optimal performance
**Network Security:**
- Three-tier subnet architecture (public, application, database)
- Network Security Groups act as virtual firewalls at subnet and instance level
- Private Endpoints for secure service connectivity
**Auto Scaling:**
- Environment-specific scaling policies
- Azure Monitor metrics-based scaling decisions
- Automatic health checks and instance replacement
---
## Security & Compliance Architecture
Comprehensive security framework for HIPAA compliance and data protection:
```mermaid
graph TB
subgraph "Identity & Access Management"
subgraph "User Authentication"
AAD_POOL[Azure AD B2C Tenant]
HOSPITAL_SSO[Hospital SSO/SAML]
MFA_CONFIG[Multi-Factor Authentication]
PASSWORD_POLICY[Password Policy]
end
subgraph "Authorization & RBAC"
RBAC_ROLES[Azure RBAC Roles]
RBAC_MATRIX[Role-Based Access Control]
PERMISSION_SETS[Permission Sets]
LEAST_PRIVILEGE[Least Privilege Principle]
end
subgraph "Token Management"
JWT_TOKENS[JWT Tokens]
TOKEN_ROTATION[Token Rotation]
SESSION_MGT[Session Management]
REFRESH_TOKENS[Refresh Tokens]
end
end
subgraph "Network Security"
subgraph "Perimeter Security"
WAF_RULES[WAF Rules Engine]
DDOS_PROTECTION[DDoS Protection]
BOT_CONTROL[Bot Control]
RATE_LIMITING[Rate Limiting]
end
subgraph "Network Isolation"
VNET_ISOLATION[VNet Isolation]
PRIVATE_SUBNETS[Private Subnets]
NSG_GROUPS[Network Security Groups]
PRIVATE_ENDPOINTS[Private Endpoints]
end
subgraph "Traffic Encryption"
TLS_TERMINATION[TLS Termination]
END_TO_END_TLS[End-to-End TLS]
CERT_MANAGEMENT[Certificate Management]
CIPHER_SUITES[Strong Cipher Suites]
end
end
subgraph "Data Protection"
subgraph "Encryption at Rest"
KV_KEYS[Key Vault Keys]
BLOB_ENCRYPTION[Blob Storage Encryption]
DISK_ENCRYPTION[Disk Encryption]
DB_ENCRYPTION[Database Encryption]
end
subgraph "Encryption in Transit"
HTTPS_ONLY[HTTPS Only]
TLS_1_3[TLS 1.3]
SNOWFLAKE_TLS[Snowflake TLS]
INTERNAL_TLS[Internal Service TLS]
end
subgraph "Key Management"
CMK_ROTATION[Customer Managed Key Rotation]
KEY_POLICIES[Key Policies]
HSM_KEYS[HSM-backed Keys]
PURGE_PROTECTION[Purge Protection]
end
end
subgraph "Security Monitoring"
subgraph "Logging & Auditing"
ACTIVITY_LOG[Activity Log]
RESOURCE_LOGS[Resource Logs]
APPLICATION_LOGS[Application Logs]
SECURITY_LOGS[Security Event Logs]
end
subgraph "Threat Detection"
SENTINEL[Microsoft Sentinel]
DEFENDER[Microsoft Defender for Cloud]
THREAT_INTEL[Threat Intelligence]
PURVIEW[Microsoft Purview]
end
subgraph "Monitoring & Alerting"
MONITOR[Azure Monitor]
EVENT_GRID[Event Grid Alerts]
FUNCTIONS_RESPONSE[Functions Auto-response]
INCIDENT_MGT[Incident Management]
end
end
subgraph "HIPAA Compliance"
subgraph "Administrative Safeguards"
SECURITY_OFFICER[Security Officer]
WORKFORCE_TRAINING[Workforce Training]
ACCESS_MANAGEMENT[Access Management]
INCIDENT_PROCEDURES[Incident Procedures]
end
subgraph "Physical Safeguards"
AZURE_FACILITIES[Azure Data Center Security]
DEVICE_CONTROLS[Device Controls]
WORKSTATION_SECURITY[Workstation Security]
MEDIA_CONTROLS[Media Controls]
end
subgraph "Technical Safeguards"
ACCESS_CONTROL[Access Control]
AUDIT_CONTROLS[Audit Controls]
INTEGRITY_CONTROLS[Integrity Controls]
TRANSMISSION_SECURITY[Transmission Security]
end
end
subgraph "Backup & Recovery"
subgraph "Data Backup"
AUTOMATED_BACKUPS[Automated Backups]
POINT_IN_TIME[Point-in-Time Recovery]
GEO_REDUNDANT[Geo-Redundant Backup]
BACKUP_ENCRYPTION[Backup Encryption]
end
subgraph "Disaster Recovery"
DR_PLAN[Disaster Recovery Plan]
RTO_RPO[RTO/RPO Targets]
FAILOVER_TESTING[Failover Testing]
BUSINESS_CONTINUITY[Business Continuity]
end
end
subgraph "Compliance Validation"
subgraph "Security Assessments"
PENETRATION_TESTING[Penetration Testing]
VULNERABILITY_SCANS[Vulnerability Scanning]
SECURITY_REVIEWS[Security Reviews]
COMPLIANCE_AUDITS[Compliance Audits]
end
subgraph "Reporting & Documentation"
COMPLIANCE_REPORTS[Compliance Reports]
SECURITY_METRICS[Security Metrics]
RISK_ASSESSMENTS[Risk Assessments]
DOCUMENTATION[Security Documentation]
end
end
%% Identity Flow
AAD_POOL --> HOSPITAL_SSO
HOSPITAL_SSO --> MFA_CONFIG
MFA_CONFIG --> PASSWORD_POLICY
AAD_POOL --> RBAC_ROLES
RBAC_ROLES --> RBAC_MATRIX
RBAC_MATRIX --> PERMISSION_SETS
PERMISSION_SETS --> LEAST_PRIVILEGE
AAD_POOL --> JWT_TOKENS
JWT_TOKENS --> TOKEN_ROTATION
TOKEN_ROTATION --> SESSION_MGT
SESSION_MGT --> REFRESH_TOKENS
%% Network Security Flow
WAF_RULES --> DDOS_PROTECTION
DDOS_PROTECTION --> BOT_CONTROL
BOT_CONTROL --> RATE_LIMITING
VNET_ISOLATION --> PRIVATE_SUBNETS
PRIVATE_SUBNETS --> NSG_GROUPS
NSG_GROUPS --> PRIVATE_ENDPOINTS
TLS_TERMINATION --> END_TO_END_TLS
END_TO_END_TLS --> CERT_MANAGEMENT
CERT_MANAGEMENT --> CIPHER_SUITES
%% Data Protection Flow
KV_KEYS --> BLOB_ENCRYPTION
KV_KEYS --> DISK_ENCRYPTION
KV_KEYS --> DB_ENCRYPTION
HTTPS_ONLY --> TLS_1_3
TLS_1_3 --> SNOWFLAKE_TLS
SNOWFLAKE_TLS --> INTERNAL_TLS
KV_KEYS --> CMK_ROTATION
CMK_ROTATION --> KEY_POLICIES
KEY_POLICIES --> HSM_KEYS
HSM_KEYS --> PURGE_PROTECTION
%% Monitoring Flow
ACTIVITY_LOG --> RESOURCE_LOGS
RESOURCE_LOGS --> APPLICATION_LOGS
APPLICATION_LOGS --> SECURITY_LOGS
SENTINEL --> DEFENDER
DEFENDER --> THREAT_INTEL
THREAT_INTEL --> PURVIEW
MONITOR --> EVENT_GRID
EVENT_GRID --> FUNCTIONS_RESPONSE
FUNCTIONS_RESPONSE --> INCIDENT_MGT
%% HIPAA Compliance
SECURITY_OFFICER --> WORKFORCE_TRAINING
WORKFORCE_TRAINING --> ACCESS_MANAGEMENT
ACCESS_MANAGEMENT --> INCIDENT_PROCEDURES
AZURE_FACILITIES --> DEVICE_CONTROLS
DEVICE_CONTROLS --> WORKSTATION_SECURITY
WORKSTATION_SECURITY --> MEDIA_CONTROLS
ACCESS_CONTROL --> AUDIT_CONTROLS
AUDIT_CONTROLS --> INTEGRITY_CONTROLS
INTEGRITY_CONTROLS --> TRANSMISSION_SECURITY
%% Backup & Recovery
AUTOMATED_BACKUPS --> POINT_IN_TIME
POINT_IN_TIME --> GEO_REDUNDANT
GEO_REDUNDANT --> BACKUP_ENCRYPTION
DR_PLAN --> RTO_RPO
RTO_RPO --> FAILOVER_TESTING
FAILOVER_TESTING --> BUSINESS_CONTINUITY
%% Compliance Validation
PENETRATION_TESTING --> VULNERABILITY_SCANS
VULNERABILITY_SCANS --> SECURITY_REVIEWS
SECURITY_REVIEWS --> COMPLIANCE_AUDITS
COMPLIANCE_REPORTS --> SECURITY_METRICS
SECURITY_METRICS --> RISK_ASSESSMENTS
RISK_ASSESSMENTS --> DOCUMENTATION
%% Styling
classDef identity fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef network fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef data fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef monitoring fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef hipaa fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef backup fill:#ffebee,stroke:#c62828,stroke-width:2px
classDef compliance fill:#fce4ec,stroke:#ad1457,stroke-width:2px
class AAD_POOL,HOSPITAL_SSO,MFA_CONFIG,PASSWORD_POLICY,RBAC_ROLES,RBAC_MATRIX,PERMISSION_SETS,LEAST_PRIVILEGE,JWT_TOKENS,TOKEN_ROTATION,SESSION_MGT,REFRESH_TOKENS identity
class WAF_RULES,DDOS_PROTECTION,BOT_CONTROL,RATE_LIMITING,VNET_ISOLATION,PRIVATE_SUBNETS,NSG_GROUPS,PRIVATE_ENDPOINTS,TLS_TERMINATION,END_TO_END_TLS,CERT_MANAGEMENT,CIPHER_SUITES network
class KV_KEYS,BLOB_ENCRYPTION,DISK_ENCRYPTION,DB_ENCRYPTION,HTTPS_ONLY,TLS_1_3,SNOWFLAKE_TLS,INTERNAL_TLS,CMK_ROTATION,KEY_POLICIES,HSM_KEYS,PURGE_PROTECTION data
class ACTIVITY_LOG,RESOURCE_LOGS,APPLICATION_LOGS,SECURITY_LOGS,SENTINEL,DEFENDER,THREAT_INTEL,PURVIEW,MONITOR,EVENT_GRID,FUNCTIONS_RESPONSE,INCIDENT_MGT monitoring
class SECURITY_OFFICER,WORKFORCE_TRAINING,ACCESS_MANAGEMENT,INCIDENT_PROCEDURES,AZURE_FACILITIES,DEVICE_CONTROLS,WORKSTATION_SECURITY,MEDIA_CONTROLS,ACCESS_CONTROL,AUDIT_CONTROLS,INTEGRITY_CONTROLS,TRANSMISSION_SECURITY hipaa
class AUTOMATED_BACKUPS,POINT_IN_TIME,GEO_REDUNDANT,BACKUP_ENCRYPTION,DR_PLAN,RTO_RPO,FAILOVER_TESTING,BUSINESS_CONTINUITY backup
class PENETRATION_TESTING,VULNERABILITY_SCANS,SECURITY_REVIEWS,COMPLIANCE_AUDITS,COMPLIANCE_REPORTS,SECURITY_METRICS,RISK_ASSESSMENTS,DOCUMENTATION compliance
```
### Security Features Explained
**Defense in Depth:**
- Multiple layers of security controls from network to application level
- No single point of failure in security architecture
- Comprehensive monitoring and alerting at every layer
**HIPAA Compliance:**
- Administrative, physical, and technical safeguards implemented
- Audit trails for all data access and modifications
- Encryption at rest and in transit for all PHI data
**Zero Trust Architecture:**
- Never trust, always verify approach
- Principle of least privilege access
- Continuous validation of security posture
---
## CI/CD & Deployment Pipeline
Complete automation pipeline for consistent, secure deployments:
```mermaid
graph TB
subgraph "Development Workflow"
subgraph "Source Control"
DEV_BRANCH[Feature Branches]
STAGING_BRANCH[Staging Branch]
MAIN_BRANCH[Main Branch]
TAG_RELEASE[Release Tags]
end
subgraph "Git Workflow"
FEATURE_PR[Feature Pull Request]
CODE_REVIEW[Code Review]
BRANCH_PROTECTION[Branch Protection]
MERGE_APPROVAL[Merge Approval]
end
end
subgraph "CI/CD Pipeline"
subgraph "Continuous Integration"
TRIGGER[GitHub Webhook Trigger]
CHECKOUT[Code Checkout]
ENV_SETUP[Environment Setup]
DEP_INSTALL[Dependency Installation]
end
subgraph "Testing & Quality"
LINT_CHECK[Linting & Code Style]
UNIT_TESTS[Unit Tests]
INTEGRATION_TESTS[Integration Tests]
SECURITY_SCAN[Security Scanning]
COVERAGE_REPORT[Coverage Report]
end
subgraph "Build Process"
FRONTEND_BUILD[React Build]
BACKEND_BUILD[FastAPI Build]
DOCKER_BUILD[Docker Build]
ARTIFACT_UPLOAD[Artifact Upload]
end
end
subgraph "Infrastructure Deployment"
subgraph "Terraform Workflow"
TF_INIT[Terraform Init]
TF_PLAN[Terraform Plan]
TF_APPLY[Terraform Apply]
TF_STATE_LOCK[State Locking]
end
subgraph "Environment Provisioning"
VNET_DEPLOY[VNet Deployment]
SECURITY_DEPLOY[Security Groups]
COMPUTE_DEPLOY[Compute Resources]
MONITORING_DEPLOY[Monitoring Setup]
end
end
subgraph "Application Deployment"
subgraph "Frontend Deployment"
BLOB_UPLOAD[Blob Storage Upload]
CDN_INVALIDATION[CDN Invalidation]
SWA_DEPLOY[Static Web Apps Deployment]
DNS_UPDATE[DNS Updates]
end
subgraph "Backend Deployment"
AS_DEPLOY[App Service Deploy]
HEALTH_CHECK[Health Check]
BLUE_GREEN[Blue-Green Deployment]
ROLLBACK_READY[Rollback Preparation]
end
end
subgraph "Post-Deployment"
subgraph "Validation"
SMOKE_TESTS[Smoke Tests]
E2E_TESTS[End-to-End Tests]
PERFORMANCE_TESTS[Performance Tests]
SECURITY_VALIDATION[Security Validation]
end
subgraph "Monitoring Setup"
METRIC_SETUP[Metrics Collection]
ALERT_CONFIG[Alert Configuration]
DASHBOARD_UPDATE[Dashboard Updates]
LOG_AGGREGATION[Log Aggregation]
end
subgraph "Notifications"
TEAMS_NOTIFY[Teams Notifications]
EMAIL_NOTIFY[Email Notifications]
STATUS_UPDATE[Status Dashboard]
DEPLOYMENT_LOG[Deployment Logs]
end
end
subgraph "Environment-Specific Flows"
subgraph "Development Flow"
DEV_TRIGGER[Dev Branch Push]
DEV_TESTS[Dev Testing]
DEV_DEPLOY[Dev Deployment]
DEV_VALIDATION[Dev Validation]
end
subgraph "Staging Flow"
STAGE_TRIGGER[Staging Branch Merge]
STAGE_TESTS[Staging Testing]
STAGE_DEPLOY[Staging Deployment]
STAGE_VALIDATION[Staging Validation]
end
subgraph "Production Flow"
PROD_TRIGGER[Production Tag]
PROD_APPROVAL[Manual Approval]
PROD_DEPLOY[Production Deployment]
PROD_VALIDATION[Production Validation]
end
end
%% Development Workflow
DEV_BRANCH --> FEATURE_PR
FEATURE_PR --> CODE_REVIEW
CODE_REVIEW --> BRANCH_PROTECTION
BRANCH_PROTECTION --> MERGE_APPROVAL
MERGE_APPROVAL --> STAGING_BRANCH
STAGING_BRANCH --> MAIN_BRANCH
MAIN_BRANCH --> TAG_RELEASE
%% CI/CD Pipeline Flow
TAG_RELEASE --> TRIGGER
TRIGGER --> CHECKOUT
CHECKOUT --> ENV_SETUP
ENV_SETUP --> DEP_INSTALL
DEP_INSTALL --> LINT_CHECK
LINT_CHECK --> UNIT_TESTS
UNIT_TESTS --> INTEGRATION_TESTS
INTEGRATION_TESTS --> SECURITY_SCAN
SECURITY_SCAN --> COVERAGE_REPORT
COVERAGE_REPORT --> FRONTEND_BUILD
COVERAGE_REPORT --> BACKEND_BUILD
FRONTEND_BUILD --> DOCKER_BUILD
BACKEND_BUILD --> DOCKER_BUILD
DOCKER_BUILD --> ARTIFACT_UPLOAD
%% Infrastructure Deployment
ARTIFACT_UPLOAD --> TF_INIT
TF_INIT --> TF_PLAN
TF_PLAN --> TF_APPLY
TF_APPLY --> TF_STATE_LOCK
TF_APPLY --> VNET_DEPLOY
VNET_DEPLOY --> SECURITY_DEPLOY
SECURITY_DEPLOY --> COMPUTE_DEPLOY
COMPUTE_DEPLOY --> MONITORING_DEPLOY
%% Application Deployment
MONITORING_DEPLOY --> BLOB_UPLOAD
MONITORING_DEPLOY --> AS_DEPLOY
BLOB_UPLOAD --> CDN_INVALIDATION
CDN_INVALIDATION --> SWA_DEPLOY
SWA_DEPLOY --> DNS_UPDATE
AS_DEPLOY --> HEALTH_CHECK
HEALTH_CHECK --> BLUE_GREEN
BLUE_GREEN --> ROLLBACK_READY
%% Post-Deployment
DNS_UPDATE --> SMOKE_TESTS
ROLLBACK_READY --> SMOKE_TESTS
SMOKE_TESTS --> E2E_TESTS
E2E_TESTS --> PERFORMANCE_TESTS
PERFORMANCE_TESTS --> SECURITY_VALIDATION
SECURITY_VALIDATION --> METRIC_SETUP
METRIC_SETUP --> ALERT_CONFIG
ALERT_CONFIG --> DASHBOARD_UPDATE
DASHBOARD_UPDATE --> LOG_AGGREGATION
LOG_AGGREGATION --> TEAMS_NOTIFY
TEAMS_NOTIFY --> EMAIL_NOTIFY
EMAIL_NOTIFY --> STATUS_UPDATE
STATUS_UPDATE --> DEPLOYMENT_LOG
%% Environment-Specific Flows
DEV_BRANCH --> DEV_TRIGGER
DEV_TRIGGER --> DEV_TESTS
DEV_TESTS --> DEV_DEPLOY
DEV_DEPLOY --> DEV_VALIDATION
STAGING_BRANCH --> STAGE_TRIGGER
STAGE_TRIGGER --> STAGE_TESTS
STAGE_TESTS --> STAGE_DEPLOY
STAGE_DEPLOY --> STAGE_VALIDATION
TAG_RELEASE --> PROD_TRIGGER
PROD_TRIGGER --> PROD_APPROVAL
PROD_APPROVAL --> PROD_DEPLOY
PROD_DEPLOY --> PROD_VALIDATION
%% Styling
classDef development fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef pipeline fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef infrastructure fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef deployment fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef validation fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef environment fill:#ffebee,stroke:#c62828,stroke-width:2px
class DEV_BRANCH,STAGING_BRANCH,MAIN_BRANCH,TAG_RELEASE,FEATURE_PR,CODE_REVIEW,BRANCH_PROTECTION,MERGE_APPROVAL development
class TRIGGER,CHECKOUT,ENV_SETUP,DEP_INSTALL,LINT_CHECK,UNIT_TESTS,INTEGRATION_TESTS,SECURITY_SCAN,COVERAGE_REPORT,FRONTEND_BUILD,BACKEND_BUILD,DOCKER_BUILD,ARTIFACT_UPLOAD pipeline
class TF_INIT,TF_PLAN,TF_APPLY,TF_STATE_LOCK,VNET_DEPLOY,SECURITY_DEPLOY,COMPUTE_DEPLOY,MONITORING_DEPLOY infrastructure
class BLOB_UPLOAD,CDN_INVALIDATION,SWA_DEPLOY,DNS_UPDATE,AS_DEPLOY,HEALTH_CHECK,BLUE_GREEN,ROLLBACK_READY deployment
class SMOKE_TESTS,E2E_TESTS,PERFORMANCE_TESTS,SECURITY_VALIDATION,METRIC_SETUP,ALERT_CONFIG,DASHBOARD_UPDATE,LOG_AGGREGATION,TEAMS_NOTIFY,EMAIL_NOTIFY,STATUS_UPDATE,DEPLOYMENT_LOG validation
class DEV_TRIGGER,DEV_TESTS,DEV_DEPLOY,DEV_VALIDATION,STAGE_TRIGGER,STAGE_TESTS,STAGE_DEPLOY,STAGE_VALIDATION,PROD_TRIGGER,PROD_APPROVAL,PROD_DEPLOY,PROD_VALIDATION environment
```
### CI/CD Features Explained
**Automated Testing:**
- Comprehensive test suite at multiple levels
- Security scanning integrated into pipeline
- Performance and load testing for critical paths
**Infrastructure as Code:**
- All infrastructure managed through Terraform
- Version controlled infrastructure changes
- Automated provisioning and updates
**Environment Promotion:**
- Automated deployment to development
- Manual approval gates for production
- Blue-green deployment strategy for zero downtime
---
## Monitoring & Observability
Comprehensive monitoring and alerting for operational excellence:
```mermaid
graph TB
subgraph "Application Monitoring"
subgraph "Frontend Metrics"
FE_PERFORMANCE[Page Load Times]
FE_ERRORS[JavaScript Errors]
FE_USER_ACTIONS[User Interactions]
FE_CONVERSION[Conversion Funnel]
end
subgraph "Backend Metrics"
BE_RESPONSE_TIME[API Response Times]
BE_THROUGHPUT[Request Throughput]
BE_ERROR_RATE[Error Rates]
BE_CONCURRENT_USERS[Concurrent Users]
end
subgraph "ML Model Metrics"
ML_ACCURACY[Model Accuracy]
ML_LATENCY[Inference Latency]
ML_DRIFT[Model Drift]
ML_FEATURE_IMPORTANCE[Feature Importance]
end
end
subgraph "Infrastructure Monitoring"
subgraph "Compute Metrics"
CPU_UTILIZATION[CPU Utilization]
MEMORY_USAGE[Memory Usage]
DISK_IO[Disk I/O]
NETWORK_IO[Network I/O]
end
subgraph "Load Balancer Metrics"
LB_REQUEST_COUNT[Request Count]
LB_TARGET_HEALTH[Target Health]
LB_RESPONSE_TIME[Response Times]
LB_ERROR_RATE[Error Rates]
end
subgraph "Database Metrics"
DB_CONNECTIONS[Connection Pool]
DB_QUERY_TIME[Query Performance]
DB_DEADLOCKS[Deadlocks]
DB_REPLICATION_LAG[Replication Lag]
end
end
subgraph "Snowflake Monitoring"
subgraph "Warehouse Metrics"
SF_COMPUTE_USAGE[Compute Usage]
SF_STORAGE_USAGE[Storage Usage]
SF_CREDIT_CONSUMPTION[Credit Consumption]
SF_QUERY_HISTORY[Query History]
end
subgraph "ML Workload Metrics"
SF_MODEL_TRAINING[Model Training Jobs]
SF_INFERENCE_CALLS[Inference API Calls]
SF_CORTEX_USAGE[Cortex AI Usage]
SF_FEATURE_ENGINEERING[Feature Engineering Jobs]
end
end
subgraph "Logging & Observability"
subgraph "Log Aggregation"
APP_LOGS[Application Logs]
ACCESS_LOGS[Access Logs]
ERROR_LOGS[Error Logs]
AUDIT_LOGS[Audit Logs]
end
subgraph "Distributed Tracing"
REQUEST_TRACING[Request Tracing]
SERVICE_MAP[Service Dependency Map]
LATENCY_BREAKDOWN[Latency Breakdown]
ERROR_CORRELATION[Error Correlation]
end
subgraph "Log Analytics"
LOG_SEARCH[Log Search & Query]
LOG_PATTERNS[Pattern Recognition]
ANOMALY_DETECTION[Anomaly Detection]
CORRELATION_ANALYSIS[Correlation Analysis]
end
end
subgraph "Alerting & Incident Management"
subgraph "Alert Rules"
THRESHOLD_ALERTS[Threshold-based Alerts]
ANOMALY_ALERTS[Anomaly-based Alerts]
COMPOSITE_ALERTS[Composite Conditions]
PREDICTIVE_ALERTS[Predictive Alerts]
end
subgraph "Notification Channels"
TEAMS_ALERTS[Teams Notifications]
EMAIL_ALERTS[Email Notifications]
SMS_ALERTS[SMS Alerts]
PAGERDUTY[PagerDuty Integration]
end
subgraph "Incident Response"
AUTO_REMEDIATION[Auto-remediation]
ESCALATION_POLICIES[Escalation Policies]
RUNBOOKS[Automated Runbooks]
POST_INCIDENT[Post-incident Analysis]
end
end
subgraph "Healthcare-Specific Monitoring"
subgraph "Clinical Metrics"
DRG_ACCURACY[DRG Classification Accuracy]
PATIENT_RISK_SCORES[Patient Risk Score Distribution]
ALERT_RESPONSE_TIME[Clinical Alert Response Time]
SYSTEM_AVAILABILITY[System Availability]
end
subgraph "Compliance Monitoring"
HIPAA_VIOLATIONS[HIPAA Violation Alerts]
ACCESS_PATTERNS[Unusual Access Patterns]
DATA_EXPORT_TRACKING[Data Export Tracking]
AUDIT_TRAIL_INTEGRITY[Audit Trail Integrity]
end
subgraph "User Experience"
CLINICIAN_SATISFACTION[Clinician Satisfaction]
WORKFLOW_EFFICIENCY[Workflow Efficiency]
ERROR_IMPACT[Error Impact on Patient Care]
ADOPTION_METRICS[Feature Adoption]
end
end
subgraph "Business Intelligence Dashboards"
subgraph "Executive Dashboard"
SYSTEM_HEALTH[Overall System Health]
COST_OPTIMIZATION[Cost Metrics]
SECURITY_POSTURE[Security Posture]
COMPLIANCE_STATUS[Compliance Status]
end
subgraph "Operations Dashboard"
REAL_TIME_METRICS[Real-time Metrics]
INCIDENT_STATUS[Incident Status]
DEPLOYMENT_STATUS[Deployment Pipeline]
RESOURCE_UTILIZATION[Resource Utilization]
end
subgraph "Development Dashboard"
BUILD_SUCCESS_RATE[Build Success Rate]
DEPLOYMENT_FREQUENCY[Deployment Frequency]
LEAD_TIME[Lead Time]
MTTR[Mean Time to Recovery]
end
end
%% Application Monitoring Flow
FE_PERFORMANCE --> BE_RESPONSE_TIME
FE_ERRORS --> BE_ERROR_RATE
FE_USER_ACTIONS --> BE_CONCURRENT_USERS
FE_CONVERSION --> ML_ACCURACY
BE_RESPONSE_TIME --> ML_LATENCY
BE_THROUGHPUT --> ML_DRIFT
BE_ERROR_RATE --> ML_FEATURE_IMPORTANCE
%% Infrastructure Monitoring Flow
CPU_UTILIZATION --> LB_REQUEST_COUNT
MEMORY_USAGE --> LB_TARGET_HEALTH
DISK_IO --> LB_RESPONSE_TIME
NETWORK_IO --> LB_ERROR_RATE
LB_REQUEST_COUNT --> DB_CONNECTIONS
LB_TARGET_HEALTH --> DB_QUERY_TIME
LB_RESPONSE_TIME --> DB_DEADLOCKS
LB_ERROR_RATE --> DB_REPLICATION_LAG
%% Snowflake Monitoring Flow
SF_COMPUTE_USAGE --> SF_MODEL_TRAINING
SF_STORAGE_USAGE --> SF_INFERENCE_CALLS
SF_CREDIT_CONSUMPTION --> SF_CORTEX_USAGE
SF_QUERY_HISTORY --> SF_FEATURE_ENGINEERING
%% Logging Flow
APP_LOGS --> REQUEST_TRACING
ACCESS_LOGS --> SERVICE_MAP
ERROR_LOGS --> LATENCY_BREAKDOWN
AUDIT_LOGS --> ERROR_CORRELATION
REQUEST_TRACING --> LOG_SEARCH
SERVICE_MAP --> LOG_PATTERNS
LATENCY_BREAKDOWN --> ANOMALY_DETECTION
ERROR_CORRELATION --> CORRELATION_ANALYSIS
%% Alerting Flow
LOG_PATTERNS --> THRESHOLD_ALERTS
ANOMALY_DETECTION --> ANOMALY_ALERTS
CORRELATION_ANALYSIS --> COMPOSITE_ALERTS
THRESHOLD_ALERTS --> TEAMS_ALERTS
ANOMALY_ALERTS --> EMAIL_ALERTS
COMPOSITE_ALERTS --> SMS_ALERTS
PREDICTIVE_ALERTS --> PAGERDUTY
TEAMS_ALERTS --> AUTO_REMEDIATION
EMAIL_ALERTS --> ESCALATION_POLICIES
SMS_ALERTS --> RUNBOOKS
PAGERDUTY --> POST_INCIDENT
%% Healthcare Monitoring Flow
DRG_ACCURACY --> HIPAA_VIOLATIONS
PATIENT_RISK_SCORES --> ACCESS_PATTERNS
ALERT_RESPONSE_TIME --> DATA_EXPORT_TRACKING
SYSTEM_AVAILABILITY --> AUDIT_TRAIL_INTEGRITY
HIPAA_VIOLATIONS --> CLINICIAN_SATISFACTION
ACCESS_PATTERNS --> WORKFLOW_EFFICIENCY
DATA_EXPORT_TRACKING --> ERROR_IMPACT
AUDIT_TRAIL_INTEGRITY --> ADOPTION_METRICS
%% Dashboard Flow
CLINICIAN_SATISFACTION --> SYSTEM_HEALTH
WORKFLOW_EFFICIENCY --> COST_OPTIMIZATION
ERROR_IMPACT --> SECURITY_POSTURE
ADOPTION_METRICS --> COMPLIANCE_STATUS
SYSTEM_HEALTH --> REAL_TIME_METRICS
COST_OPTIMIZATION --> INCIDENT_STATUS
SECURITY_POSTURE --> DEPLOYMENT_STATUS
COMPLIANCE_STATUS --> RESOURCE_UTILIZATION
REAL_TIME_METRICS --> BUILD_SUCCESS_RATE
INCIDENT_STATUS --> DEPLOYMENT_FREQUENCY
DEPLOYMENT_STATUS --> LEAD_TIME
RESOURCE_UTILIZATION --> MTTR
%% Styling
classDef application fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
classDef infrastructure fill:#e3f2fd,stroke:#1565c0,stroke-width:2px
classDef snowflake fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef logging fill:#e0f2f1,stroke:#00695c,stroke-width:2px
classDef alerting fill:#fff3e0,stroke:#f57c00,stroke-width:2px
classDef healthcare fill:#ffebee,stroke:#c62828,stroke-width:2px
classDef dashboards fill:#fce4ec,stroke:#ad1457,stroke-width:2px
class FE_PERFORMANCE,FE_ERRORS,FE_USER_ACTIONS,FE_CONVERSION,BE_RESPONSE_TIME,BE_THROUGHPUT,BE_ERROR_RATE,BE_CONCURRENT_USERS,ML_ACCURACY,ML_LATENCY,ML_DRIFT,ML_FEATURE_IMPORTANCE application
class CPU_UTILIZATION,MEMORY_USAGE,DISK_IO,NETWORK_IO,LB_REQUEST_COUNT,LB_TARGET_HEALTH,LB_RESPONSE_TIME,LB_ERROR_RATE,DB_CONNECTIONS,DB_QUERY_TIME,DB_DEADLOCKS,DB_REPLICATION_LAG infrastructure
class SF_COMPUTE_USAGE,SF_STORAGE_USAGE,SF_CREDIT_CONSUMPTION,SF_QUERY_HISTORY,SF_MODEL_TRAINING,SF_INFERENCE_CALLS,SF_CORTEX_USAGE,SF_FEATURE_ENGINEERING snowflake
class APP_LOGS,ACCESS_LOGS,ERROR_LOGS,AUDIT_LOGS,REQUEST_TRACING,SERVICE_MAP,LATENCY_BREAKDOWN,ERROR_CORRELATION,LOG_SEARCH,LOG_PATTERNS,ANOMALY_DETECTION,CORRELATION_ANALYSIS logging
class THRESHOLD_ALERTS,ANOMALY_ALERTS,COMPOSITE_ALERTS,PREDICTIVE_ALERTS,TEAMS_ALERTS,EMAIL_ALERTS,SMS_ALERTS,PAGERDUTY,AUTO_REMEDIATION,ESCALATION_POLICIES,RUNBOOKS,POST_INCIDENT alerting
class DRG_ACCURACY,PATIENT_RISK_SCORES,ALERT_RESPONSE_TIME,SYSTEM_AVAILABILITY,HIPAA_VIOLATIONS,ACCESS_PATTERNS,DATA_EXPORT_TRACKING,AUDIT_TRAIL_INTEGRITY,CLINICIAN_SATISFACTION,WORKFLOW_EFFICIENCY,ERROR_IMPACT,ADOPTION_METRICS healthcare
class SYSTEM_HEALTH,COST_OPTIMIZATION,SECURITY_POSTURE,COMPLIANCE_STATUS,REAL_TIME_METRICS,INCIDENT_STATUS,DEPLOYMENT_STATUS,RESOURCE_UTILIZATION,BUILD_SUCCESS_RATE,DEPLOYMENT_FREQUENCY,LEAD_TIME,MTTR dashboards
```
### Monitoring Strategy Explained
**Proactive Monitoring:**
- Real-time metrics collection and analysis
- Predictive alerting based on trends and patterns
- Automated incident response and remediation
**Healthcare-Specific Metrics:**
- Clinical accuracy and safety metrics
- HIPAA compliance monitoring
- Patient care impact measurement
**Cost Optimization:**
- Resource utilization tracking
- Snowflake credit consumption monitoring
- Right-sizing recommendations
---
## Implementation Details
### Key Technologies and Versions
**Frontend Stack:**
- React 18.2+ with TypeScript
- Material-UI or Tailwind CSS for styling
- React Query for state management
- React Router v6 for navigation
**Backend Stack:**
- FastAPI 0.100+ with Python 3.11
- Pydantic for data validation
- SQLAlchemy for database ORM
- Pytest for testing
**Infrastructure:**
- Terraform 1.5+ for infrastructure as code
- Azure CLI for deployments
- Docker for containerization
- GitHub Actions for CI/CD
**Database & ML:**
- Snowflake Cortex AI for primary ML workloads
- Azure Machine Learning for backup ML capabilities
- Azure Cache for Redis 7.0+ for caching
- Azure Database for PostgreSQL for operational data (if needed)
### Environment Configuration
**Development Environment:**
```yaml
# terraform/environments/dev/terraform.tfvars
environment = "development"
vm_size = "Standard_B1s"
min_instances = 1
max_instances = 2
enable_deletion_protection = false
backup_retention_days = 7
```
**Staging Environment:**
```yaml
# terraform/environments/staging/terraform.tfvars
environment = "staging"
vm_size = "Standard_B2s"
min_instances = 1
max_instances = 3
enable_deletion_protection = true
backup_retention_days = 14
```
**Production Environment:**
```yaml
# terraform/environments/prod/terraform.tfvars
environment = "production"
vm_size = "Standard_D4s_v3"
min_instances = 2
max_instances = 10
enable_deletion_protection = true
backup_retention_days = 30
zone_redundant = true
```
### Security Configuration
**Azure RBAC Policies:**
```json
{
"Name": "EmpowerHealth-KeyVault-Reader",
"IsCustom": true,
"Description": "Read secrets from Key Vault",
"Actions": [
"Microsoft.KeyVault/vaults/secrets/read"
],
"DataActions": [
"Microsoft.KeyVault/vaults/secrets/getSecret/action"
],
"AssignableScopes": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group}"
]
}
```
**Network Security Group Rules:**
```hcl
# Allow HTTPS traffic from Azure Front Door
resource "azurerm_network_security_rule" "alb_https_ingress" {
name = "HTTPS-Inbound"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "443"
source_address_prefix = "AzureFrontDoor.Backend"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.main.name
network_security_group_name = azurerm_network_security_group.alb.name
}
# Allow backend traffic from Application Gateway only
resource "azurerm_network_security_rule" "app_service_ingress" {
name = "AppService-Inbound"
priority = 110
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "5000"
source_address_prefix = "10.10.10.0/24"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.main.name
network_security_group_name = azurerm_network_security_group.app.name
}
```
---
## Cost Optimization Strategy
### Resource Right-Sizing
**Environment-Based Scaling:**
- **Development**: Single zone, minimal instances
- **Staging**: Limited auto-scaling for testing
- **Production**: Zone-redundant with aggressive auto-scaling
### Snowflake Cost Management
**Warehouse Sizing:**
```sql
-- Auto-suspend and resume for cost optimization
ALTER WAREHOUSE COMPUTE_WH SET
AUTO_SUSPEND = 60
AUTO_RESUME = TRUE
INITIALLY_SUSPENDED = TRUE;
-- Scale warehouse based on workload
ALTER WAREHOUSE COMPUTE_WH SET WAREHOUSE_SIZE = 'SMALL';
```
**Query Optimization:**
- Use clustering keys for large tables
- Implement result caching strategies
- Monitor and optimize expensive queries
### Azure Cost Controls
**Reserved Instances:**
- Purchase Azure Reserved Virtual Machine Instances for production workloads with predictable usage
- Use Azure Savings Plans for flexible compute discounts
**Auto Scaling Policies:**
```hcl
resource "azurerm_monitor_autoscale_setting" "app_service" {
name = "autoscale-appservice"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
target_resource_id = azurerm_app_service_plan.main.id
profile {
name = "defaultProfile"
capacity {
default = 2
minimum = 1
maximum = 10
}
rule {
metric_trigger {
metric_name = "CpuPercentage"
metric_resource_id = azurerm_app_service_plan.main.id
time_grain = "PT1M"
statistic = "Average"
time_window = "PT5M"
time_aggregation = "Average"
operator = "GreaterThan"
threshold = 75
}
scale_action {
direction = "Increase"
type = "ChangeCount"
value = 1
cooldown = "PT10M"
}
}
}
}
```
### Monthly Cost Estimates
**Development Environment:**
- Virtual Machines: $25/month
- Application Gateway: $18/month
- Data transfer: $10/month
- **Total: ~$53/month**
**Production Environment:**
- App Service/VMs: $180/month
- Application Gateway: $25/month
- Data transfer: $50/month
- Azure Front Door: $35/month
- Snowflake: $500/month (estimated)
- **Total: ~$790/month**
---
## Conclusion
This comprehensive architecture provides a robust, scalable, and secure foundation for the EmpowerHealth healthcare analytics platform. The design incorporates:
1. **Multi-layered Security** - From network isolation to application-level authentication
2. **High Availability** - Multi-zone deployment with auto-scaling and failover
3. **Dual ML Strategy** - Primary Snowflake ML with Azure backup capabilities
4. **Complete Automation** - Infrastructure as code and CI/CD pipelines
5. **Comprehensive Monitoring** - Full observability stack with healthcare-specific metrics
6. **Cost Optimization** - Environment-specific resource allocation and scaling
The architecture is designed to handle the sensitive nature of healthcare data while providing the performance and reliability required for clinical decision support systems. The dual ML approach ensures that you can leverage Snowflake's powerful Cortex AI capabilities while maintaining flexibility to use Azure ML services when needed.
**Next Steps:**
1. Implement Terraform modules for infrastructure provisioning
2. Set up GitHub Actions workflows for CI/CD
3. Configure Snowflake data ingestion from Epic systems
4. Develop and deploy ML models for DRG classification
5. Implement comprehensive monitoring and alerting
6. Conduct security assessments and penetration testing
7. Train healthcare staff on the new system
8. Plan phased rollout strategy
Google Drive
Gist
Clipboard
Sign in with Wallet
