Skip to main content

Case Study

How UTurn Helped Health Strategy Chart a BAA-Compliant Path to Secure AI on Amazon Bedrock

Health Strategy had rolled out Claude across the firm but kept it away from client PHI, since none of that work was covered under its AWS Business Associate Agreement. Through an Architect-in-Residence engagement and a Data & AI Assessment, UTurn mapped six AI patterns and a phased roadmap that brings BAA-covered AI, including Claude Cowork on self-hosted Amazon Bedrock, to the client data itself.

The Challenge

Health Strategy is a business services firm supporting the pharmacy benefit supply chain for employers of every size, which means managing sensitive member and claims data (PHI). Employees were already using Claude Enterprise, but every use case deliberately excluded client and PHI data, since none of it was covered under the firm's AWS BAA. Until PHI could be classified and guarded, AI stayed capped at non-sensitive, aggregate work, leaving the firm's highest-value data untouched.

The blocker wasn't appetite for AI. It was governance, and four gaps stood in the way:

  • No PHI classification. Nothing in the environment told the team which data could safely be exposed to a model.
  • No guardrails. There was no mechanism to enforce what AI could and couldn't touch.
  • No data catalog or active knowledge base. AI had nothing to ground it in the firm's own information.
  • Growth pressure. The business was projected to grow 25–50% over the next 12 months, adding pressure to modernize the data platform in parallel.


The Solution

Under an AI Assessment engagement, UTurn ran a structured Data & AI Assessment in four stages: Use Case Discovery, Pattern Identification, Data/AI Architecture & Design, and ROI Modeling with an Executive Readout. Rather than a generic governance mandate, the work delivered a target-state architecture and a phased roadmap matched to the tools Health Strategy already had in flight, Claude Enterprise and its existing AWS investment.

Pattern Identification mapped the firm's use cases to six data and AI patterns, each scored on a 1–5 maturity scale so leadership could see where to start and what each phase of the roadmap unlocks:

  • Governance. PHI classification, guardrails, and the data catalog that make everything else safe.
  • Semantic and knowledge layer. An active knowledge base that grounds AI in the firm's own information.
  • Agentic data transformation. Agents that prepare, move, and reshape data with human oversight.
  • Employee productivity. Assistants for the everyday work that eats analyst and operations hours.
  • Business process optimization. AI inside core workflows, from intake through claims support.
  • General agentic AI. A governed platform for new agents as the business grows.

The target-state architecture keeps every workload inside the AWS BAA boundary. Amazon Bedrock, self-hosted in the firm's own AWS account, provides model access, and Claude Cowork and Claude Code serve as the secure front end for employees, replacing the previous “no PHI” workaround. PHI and PII are scanned, classified, and cataloged, with guardrails enforced at the platform layer, so client data never leaves the VPC. Because the design builds on investments already in place, nothing had to be started over.

ROI Modeling put working estimates on the highest-value use cases, and the Executive Readout sequenced the six patterns into phases. Governance and the knowledge layer come first, so that every later phase, from agentic data transformation through general agentic AI, inherits a secure, well-classified foundation the firm can walk an auditor through.


Measurable Results

  • 6 Data & AI Patterns Identified and Scored
  • 20–30 Minute Security Log Investigations, Down From 3–4 Hours
  • ~35% Estimated Employee Productivity Gain
  • 100% Target PHI/PII Classification Coverage, From ~20% Today

A secure front-end template. Claude Cowork paired with Amazon Bedrock on the backend, so data never leaves the VPC, gives Health Strategy a repeatable pattern that satisfies its strict data privacy requirements.

Security log investigation time cut from 3–4 hours to 20–30 minutes with AI assistance, per early ROI modeling from the assessment.

A working estimate of ~35% employee productivity improvement across the use cases surfaced in Discovery.

PHI/PII footprint scanning expanded from ~20% of the environment to a 100% target under the target-state architecture, the prerequisite for putting AI to work on client data.

Efficiency figures are Discovery-phase estimates from the assessment's ROI modeling, pending fully defined KPIs post-implementation.


Tech Stack

  • Amazon Bedrock (self-hosted): model access inside the firm's VPC
  • Claude Cowork, Claude Code: secure front end
  • Claude Enterprise: existing deployment, non-PHI use
  • AWS Business Associate Agreement (BAA): compliance boundary for every workload
  • Amazon VPC: data residency


Why UTurn

Health Strategy needed a plan that matched the tools it already had in flight, Claude Enterprise and an existing investment in AWS infrastructure, rather than a generic governance mandate that would have meant starting over. UTurn's deep cloud expertise, especially in AWS, its AI expertise, especially with Anthropic, and its ability to move fast made it the right partner for an ambitious timeline.

Ready to bring AI to your most sensitive data, securely? UTurn designs BAA-covered AI and data platforms on AWS, from assessment through implementation. Email info@uturndata.com to start the conversation.