Connected device cloud platforms
A glucose meter can sync to a phone app and a clinician portal, the way a monitor sends telemetry to a hospital system, or a therapeutic device reports usage and receives configuration. The cloud software has its own security, data, and validation requirements.
What the platform handles
Device provisioning and identity
Each device has its own identity, can be authenticated, and can be revoked.
Telemetry ingestion
Receives readings and device status, typically over MQTT or a similar protocol.
Data storage and access
Defines the patient data model, retention rules, and access permissions for the applicable regulatory requirements.
Clinician and patient interfaces
Web portals and mobile apps for patients, clinicians, and other users.
Fleet management
Manages firmware and configuration updates and monitors device health across the installed base.
Requirements
Privacy
In the US, device data tied to a patient is protected health information under HIPAA, which drives encryption in transit and at rest, access logging, least privilege, and a business associate agreement with the cloud provider. Other jurisdictions have their own regimes, and a device sold internationally has to satisfy all of them.
Cybersecurity
A connected device extends the attack surface beyond the device itself. Threat modeling covers the device, cloud services, interfaces, and systems they connect to. FDA premarket cybersecurity expectations apply to the platform as well as the device.
Availability
The platform needs to remain available when clinicians depend on it. That means redundancy, monitoring, and tested disaster recovery.
Traceability
Changes to the platform can affect a regulated system. Release management, change validation, and audit trails apply to the cloud software as they do to the device software.
Interoperability
Device data is more useful when it can be incorporated into the clinical record. HL7 FHIR provides a standard way to exchange that data. Publishing device observations as FHIR resources also avoids tying the hospital integration to a proprietary API.
HL7 FHIR Integration →SequoiaAT builds cloud software for connected medical devices alongside hardware and firmware engineering, using the same design controls and validation practices across the system.
Related work includes a HIPAA compliant AWS environment supporting real time HL7 FHIR R4 exchange across a multi site hospital network, along with embedded systems and IoT work for connected medical devices and wearables.
Case study →