HIPAA CI/CD overhaul for an AI SaaS vendor
A returning client. Third engagement after the FedRAMP boundary build and the Kubernetes migration. This time the HIPAA-side CI/CD pipeline was the long pole: legacy build chain, unsigned artifact promotion, manual security scanning, and an audit trail that did not survive its own deploys. We rebuilt the pipeline with signed promotion, OPA admission control on EKS, and audit-grade evidence emission. The team got faster and more compliant in the same engagement.
What this engagement did
- Rebuilt the HIPAA-side pipeline around signed artifact promotion, with Cosign keys in the KMS topology established during the prior FedRAMP engagement.
- Put OPA Gatekeeper at cluster admission, so an unsigned image cannot reach production.
- Emitted evidence from every pipeline stage and admission decision to a 7-year object-locked store, queryable in Athena.
- Published the pipeline as a reusable workflow, so each new service inherits the controls by calling it.
Result. Every production image signed with verifiable provenance, and a clean HITRUST i1 readiness review on pipeline-related controls.
Context
The client is the same AI SaaS vendor from the earlier FedRAMP Moderate boundary engagement. After the FedRAMP authorization architecture shipped and the Kubernetes migration brought the production workload onto EKS, the team turned its attention to a problem they had been deferring: the HIPAA-side CI/CD pipeline still ran on patterns inherited from before either of the previous engagements.
The pipeline produced container images, ran tests, and pushed to ECR. It did not sign artifacts. It did not enforce policy at admission time on the EKS cluster. Security scans ran but findings were emailed to a Slack channel that engineers had quietly muted. The audit trail consisted of GitHub Actions logs that aged out at 90 days, an interval shorter than the audit cycle they had to defend.
The team understood the gaps. They had passed audits previously because the FedRAMP environment was strict enough that the HIPAA-side pipeline did not produce failures the auditor could easily surface. But the boundary review had flagged the pipeline as a known risk, and the next HITRUST i1 cycle was on the calendar. The engagement scope was clear: rebuild the pipeline so the HIPAA controls are enforced structurally, not by human discipline, and produce evidence that survives the audit window.
Approach
Three architectural commitments shaped the rebuild. First, every artifact reaching production must carry a cryptographic provenance chain from source commit through admission. Second, the cluster itself must reject any workload that fails policy, with the rejection logged as evidence. Third, every gate decision, scan result, and admission verdict must emit to a write-once evidence store that outlives the deploy that produced it.
Four constraints drove the choices. Signing keys had to live in the KMS topology from the FedRAMP engagement, because two key hierarchies means two audit chains to defend. Signing had to be verified somewhere engineers could not route around, so enforcement sits at cluster admission rather than in the pipeline that produces the image. Evidence had to outlive the deploy that produced it, because the existing GitHub Actions logs aged out at 90 days against an audit cycle measured in years. And the pipeline had to be callable rather than copyable, so a new service inherits the controls instead of reimplementing them.
Inherited boundary
Because the FedRAMP boundary and the Kubernetes platform had already shipped from earlier engagements, this work inherited their identity, KMS topology, logging architecture, and network segmentation. The HIPAA CI/CD overhaul slotted into that infrastructure rather than introducing parallel patterns.
“Hired Lucas to overhaul our CI/CD pipelines in a HIPAA environment and he absolutely delivered. He rebuilt our pipelines with proper artifact promotion, added security scanning, and tightened up our deployment process so we're now both faster and more compliant. His background in healthcare infrastructure showed, he understood the constraints from day one and didn't need lengthy explanations about what we could and couldn't do with PHI. Deployment time dropped significantly and the audit trail is now clean. Highly recommend for anyone doing serious work in regulated industries.”
Conclusion
The pipeline rebuild closed every gap flagged during the prior FedRAMP boundary review related to CI/CD architecture. HITRUST i1 readiness review for the pipeline-affected control families came back clean. The client's engineering team operates the pipeline directly; Stonebridge remains available on a Managed Compliance Retainer for HIPAA Security Rule 2026 update work.
The team has since adopted the reusable workflow pattern across additional repos joining the platform, which means each new service inherits the controls by calling the workflow rather than rebuilding them. The pattern compounds rather than ages.
Contact us
Most discovery calls take 30 minutes. We come back with a written proposal within 48 hours. If HIPAA CI/CD is the work, we can scope from your current pipeline or build forward from your audit timeline.
Contact us →