Cloud Security White Paper

At TheraPro, we have built more than a digital platform; we have built a philosophy. Security and privacy are not bolt-ons or marketing slogans; they are the foundation of our design, development, and deployment lifecycle. In healthcare, every record is sacred, every byte of data represents not just information but the lived experiences of patients, and every clinic that entrusts us is placing their brand, their reputation, and their patients’ trust into our stewardship. Our mission is to ensure that no matter what threats emerge—from ransomware to insider misuse—patient data and clinic operations remain secure, resilient, and compliant.

This white paper describes our approach in detail, moving from philosophy to infrastructure, from regulatory frameworks to real-world case studies, from competitive analysis to forward-looking AI ethics. It blends technical specificity with business-level clarity. By the end, it will be clear that TheraPro is not simply another software vendor but a long-term security partner for clinics across the United States and beyond.

1. Trust as the Cornerstone of Patient Care

Healthcare is fundamentally dependent on trust. A therapist cannot build rapport with a patient if the patient doubts whether their disclosures will remain confidential. Similarly, a clinic cannot grow if patients worry that their records may be leaked, exposed, or mishandled. Trust is therefore both an emotional reality and a business necessity.

TheraPro places trust at the center of its platform by ensuring that every architectural decision is made with confidentiality, integrity, and availability in mind. These three principles, often called the CIA triad, underpin every line of code and every operational process in TheraPro. Confidentiality ensures that only authorized staff can view Protected Health Information (PHI). Integrity ensures that records cannot be tampered with undetected. Availability ensures that systems are online when patients and therapists need them.

2. The Healthcare Threat Landscape

Healthcare is now the number one target for cybercriminals, surpassing finance and retail. The reasons are clear: health records are comprehensive, permanent, and difficult to replace. They contain not only identifiers like name and Social Security number but also insurance information, diagnoses, treatment notes, and even biometric data.

Common threats that TheraPro’s architecture is designed to defend against include:

• Ransomware Attacks: Malicious actors encrypt clinic databases and demand payment. TheraPro's use of DynamoDB with Point-in-Time Recovery (PITR) and Wasabi object storage with redundant copies mitigates this risk by ensuring data can be quickly restored.
• Phishing Campaigns: These campaigns often target busy clinic staff with convincing, but malicious, emails. Our focus on secure, in-app messaging

inside TheraPro’s own AWS environment reduces the reliance on standard email, limiting a common entry vector.

• Insider Threats: A disgruntled employee or careless contractor can exfiltrate PHI. TheraPro mitigates this risk with fine-grained role-based access and

immutable audit logs in DynamoDB.

• IoT and Telehealth Vulnerabilities: Devices and applications can be exploited if not secured. TheraPro uses HIPAA-eligible APIs from

Amazon Chime SDK (AWS) for telehealth, Wasabi for secure storage of recordings, and encrypted mobile tokens to reduce this risk.

3. Hosting Infrastructure: Amazon Web Services (AWS)

TheraPro runs exclusively on Amazon Web Services (AWS), which is a highly secure and resilient cloud provider. AWS has earned certifications across ISO 27001, SOC 1/2/3, FedRAMP, and HIPAA eligibility, making it the gold standard for regulated workloads.

By using AWS, clinics inherit the same physical protections that secure global banks and governments. Services are distributed across multiple availability zones, ensuring redundancy. This allows TheraPro to focus on healthcare-specific application security, confident that the infrastructure foundation is among the most secure in the world.

4. Data Center Security and Physical Controls

Security is not only digital; it is also physical. AWS facilities apply defense-in-depth physical controls such as biometric access scanners, round-the-clock armed guards, CCTV, and strict visitor logging. Redundant power supplies and fire suppression systems ensure continuity during disasters. By choosing AWS, TheraPro avoids the risks of on-premises server rooms that may lack these protections, giving clinics enterprise-grade resilience without the IT overhead.

5. Resiliency, Availability, and Redundancy

Downtime in therapy means canceled appointments, lost revenue, and diminished patient satisfaction. TheraPro ensures high availability through multi-AZ deployments, automated failover, and quarterly disaster recovery drills. DynamoDB provides point-in-time recovery for 35 days, and Wasabi object storage ensures redundant copies of every telehealth recording. In disaster simulations, TheraPro consistently restores full operations within a four-hour Recovery Time Objective (RTO) and ensures data loss is limited to no more than fifteen minutes (Recovery Point Objective, RPO). Clinics therefore gain confidence not only that their systems are compliant but also that they will remain operational during crises.

6. Defense in Depth: A Layered Security Model

TheraPro uses a layered security model where multiple independent defenses protect against intrusion. This approach significantly raises the difficulty and cost of an attack.

• Perimeter Security: AWS WAF filters malicious traffic, blocking SQL injection and cross-site scripting attempts.
• Network Isolation: Virtual Private Clouds (VPCs) isolate environments, while private endpoints ensure sensitive services are never exposed publicly.
• Application Security: Input validation, role-based access control, and JWT authentication ensure requests are verified at the application layer.
• Compute Isolation: Lambda functions are scoped per clinic and per environment, ensuring no function has access to more than it requires.
• Auditability: Immutable DynamoDB audit logs capture every event, including file uploads, telehealth sessions, and staff access.

7. Data Encryption Standards and Key Management

Encryption is the cornerstone of healthcare compliance. TheraPro applies AES-256 encryption at rest for DynamoDB tables, Wasabi storage, and backups. All communications use TLS 1.2+ with modern ciphers such as ECDHE_RSA with AES-128-GCM.

Key management is performed via AWS KMS, ensuring that cryptographic material is rotated regularly and never exposed in plaintext. Each clinic benefits from logically separated keys, reducing the chance of cross-tenant exposure. This level of rigor ensures that even if data is intercepted, it remains unreadable and unusable.

8. Data Storage Architecture and Segregation

Each clinic operates in its own logically separated database schema, enforced at both the DynamoDB table level and the Wasabi bucket level. This separation ensures that no data from one clinic can be accessed by another, fulfilling HIPAA’s minimum necessary principle.

• Dedicated DynamoDB Tables: Each clinic has unique tables for patients, therapists, appointments, messages, and audit logs. This ensures that queries cannot inadvertently span multiple clinics.
• Wasabi Storage Segmentation: Each clinic has its own production bucket for PHI and recordings. Development environments share a dev bucket, but no PHI is ever stored there, only anonymized test data.
• IAM Isolation: Strict IAM policies ensure per-bucket/prefix access, preventing accidental or malicious cross-clinic access.

9. Backup, Recovery, and Disaster Preparedness

Data backups are not optional; they are life insurance for clinics. TheraPro backs up data daily, weekly, monthly, and annually across multiple availability zones. Backups are encrypted both in transit and at rest, and recovery procedures are tested regularly to ensure reliability. In addition, weekly encrypted backups are stored in a separate AWS region to ensure recoverability even in the event of a regional disaster.

10. Compliance Guardrails and Vendor Audits

TheraPro adheres to stringent compliance guardrails to protect patient data and meet regulatory requirements.

• HIPAA BAAs: We maintain HIPAA Business Associate Agreements with all relevant vendors, including AWS (which covers the Amazon Chime SDK used for telehealth) and Wasabi.
• Data Minimization: No PHI is ever stored in the dev or test environments. The shared dev Wasabi bucket has a lifecycle rule to automatically delete data within 90 days.
• Data Retention: Production data retention is set for a minimum of six years to meet jurisdictional requirements.

11. Why Clinics Choose TheraPro

TheraPro stands apart because it treats security not as an afterthought but as its identity. Clinics that adopt TheraPro receive more than branded apps; they receive an enterprise-grade, HIPAA-compliant infrastructure managed end-to-end.

• Managed Solution: The platform is fully managed, supported, and updated by SBC, so no IT staff is needed at the clinic.
• Fast ROI: Clinics can break even with less than 10% patient utilization.
• Competitive Advantage: Competitors often sell only administrative software, while TheraPro delivers a patient-first, clinic-branded experience with HIPAA-compliant telehealth, in-app messaging, and secure data storage.

TheraPro's edge is patient value—convenience, trust, security, and loyalty. Clinics realize fast ROI, while SBC sustains strong recurring margins of up to 60% over multi-year horizons.