Private Clinical Records Processing

A hospital group runs a document-processing application on EC2 instances that turn scanned clinical letters into structured records. Its compliance policy says the instances must sit in private subnets with no inbound access from the internet, and patient documents read from and written to S3 must never cross the public internet, even encrypted. The instances still need to download operating-system patches from the internet each week. Every document must be encrypted at rest with a key the hospital controls and can revoke, and each use of that key must be auditable. The team also wants to avoid per-gigabyte internet processing charges on the heavy S3 traffic.