Securing regional healthcare analytics at scale

MedModus worked with regional and local hospital management, IT teams, data protection officers and software suppliers to establish the requirements for securely integrating and reporting hospital information.

Before implementation, MedModus completed data protection and security assessments, including Data Protection Impact Assessments, security questionnaires and related governance requirements. These informed a rollout and architecture plan designed around the sensitivity of the information, the responsibilities of participating organisations and the access requirements of different user groups.

Implementation was phased hospital by hospital, allowing the necessary technical, data protection and access arrangements to be agreed with each organisation while progressively building an integrated regional view.

Security was considered across the complete information lifecycle: how information is transferred from national and hospital systems; where and how it is processed and stored; which users can access different levels of information; how administrative access is controlled; how activity, system health and security events are monitored; how changes are developed, tested, approved and released; and how information is retained, backed up and securely removed.

MedModus operates an ISO/IEC 27001:2022-certified information security management system and is Cyber Essentials certified. Regular security, access and configuration reviews form part of the ongoing management of the platform.

MedModus developed and manages a secure cloud environment supporting regional analytics, operational reporting and clinical data collection across HSE Dublin & Midlands. It brings together information from national and local HSE systems and voluntary hospital systems, underpinned by Microsoft Azure, Microsoft Fabric, Power BI and Power Platform, and delivered to users through a secure, custom web application.

Access is centrally managed using role-based permissions, multi-factor authentication and Conditional Access. Users are granted access according to their organisation and responsibilities, with formal processes covering new users, changes in role and leavers. Privileged administration is performed through separate, tightly controlled accounts, supported by regular access reviews.

Sensitive data is protected through encryption, private connectivity, network segmentation, restricted public access and secure management of credentials and secrets. Development, testing and production environments are separated so changes can be validated before release.

Logging, monitoring and automated alerts provide visibility of platform health and potential security issues, with documented incident-management processes for investigation and response. Resilience is supported through backup, recovery and business continuity arrangements, and retention and deletion controls ensure information is held only in line with agreed requirements.

All change requests are logged, assessed and tracked through the MedModus support service, with code and configuration held in managed repositories under full version control — giving traceability from original request through development, testing and release.

The governance model also covers resource ownership, configuration standards, cloud expenditure, budgets and alerts, keeping the environment secure, supportable and cost-conscious as it expands.

Over six years, the platform has grown into a core regional analytics service supporting approximately 400 users across seven hospitals, as well as regional management teams. Security and governance built into the service have enabled the region to expand regional analytics while maintaining controlled access to sensitive information from multiple organisations and systems.

The environment now incorporates over 20 source systems, over 100 datasets and hundreds of reports, providing hospital and regional teams with timely access to information that previously required significant manual effort to compile.

MedModus continues to manage and support the complete environment. A dedicated support desk operates during business hours, while automated monitoring notifies the technical team of issues arising outside these hours so they can be investigated and addressed.

The service has expanded significantly since its introduction, incorporating new hospitals, systems, datasets and user groups. Its governance model has evolved alongside the platform, allowing the region to extend its analytics capabilities without compromising the security, control, cost-efficiency or reliability of the service.