Azure for healthcare: clinical data protected for what it is.

Arcetec is a Microsoft Partner that implements Microsoft Azure for healthcare organizations in Colombia: care providers (IPS), health plans (EPS), clinics, insurers and companies with an in-house medical service. The information a healthcare organization handles is not ordinary information. Medical records and lab results are sensitive data under Article 5 of Law 1581 of 2012, and processing them is prohibited without the explicit authorization of the data subject; a breach is not an IT incident but a legal and reputational problem that cannot be undone. On Azure, that information is protected in layers: identity and multi-factor authentication with Microsoft Entra ID, least-privilege, time-bound role-based access, private networks with no internet exposure, encryption in transit and at rest with keys in Key Vault, continuous threat detection, an audit trail of who accessed what, and backup with retention to restore to an earlier point in time. The platform comes certified under ISO 27001, SOC and HITRUST CSF, so the organization inherits those controls instead of rebuilding them. Azure Health Data Services adds a managed FHIR server for the interoperability required by Resolution 1888 of 2025 of Colombia's Ministry of Health. Arcetec supports the assessment, the landing zone deployment, the migration in waves without interrupting patient care, and ongoing support from Cajicá, Cundinamarca.

Medical records and test results are sensitive data under Article 5 of Law 1581: processing them is prohibited without the explicit authorization of the data subject. On Azure they are protected in layers, and each layer stays standing when the one before it fails.

Runs in your organization's subscription, not on a platform of ours.
An audit trail of who accessed which record and when.
Backup with retention: what an attacker encrypts comes back.

Inventario de la información que maneja una organización del Healthcare organization, clasificada entre datos sensibles, datos personales e información de negocio, y con el control que protege a cada categoría. No contiene ningún dato real ni simulado.

Three reasons that matter in a healthcare organization.

They are not the ones from a cloud brochure: they are the three things you ask a provider when what is at stake is someone's medical record.

Controls already audited — The infrastructure comes certified under ISO 27001, SOC and HITRUST CSF. Your team is responsible for its configuration and its data, not for rebuilding and maintaining controls that have already passed third-party audits.
You know who saw what — Every access to clinical information leaves a trace. It is the first thing an audit asks for, what a disciplinary process requires, and the one thing that cannot be reconstructed later if nobody logged it from the start.
Patient care doesn't stop — Point-in-time recovery and deployment in waves. An organization that treats patients cannot shut down systems to modernize, and that constraint is designed in from the start.

What happens the day it fails

The question is not whether the information is important. It is exactly what happens when it is lost, leaked or becomes inaccessible.

If the medical record becomes inaccessible, care stops: no one can check a patient's history, an allergy, or what was prescribed last week. In the emergency room, that is not an operational inconvenience. If it leaks, the problem is not an IT problem. It is sensitive data under Article 5 of Law 1581, with its own legal regime and a Superintendency that investigates. And a breach of clinical data is not fixed with a press release. If it is encrypted in an attack, the only real way out is the backup. Not the one that exists: the one someone tested by restoring it. It is the difference between a bad day and an organization that never operates the same way again.

Inaccessible: patient care stops, not just administration
Leaked: a sensitive-data regime and a Superintendency that investigates
Encrypted in an attack: only a tested backup brings it back
Altered without a trace: without an audit trail there is no way to know what happened

A backup that was never restored is an assumption — In the assessment we don't check whether you have a backup, but whether it works: how long it takes to come back, how far back in time, and who has tested it.

Layers that hold each other up

No layer is infallible. The right question is not which one is best, but what is still standing when one gives way.

Las capas de defensa de una implementación en Azure —identidad, acceso mínimo, red privada, cifrado del dato, detección continua y respaldo— cada una con lo que sostiene cuando la anterior cede.

Most real incidents don't start with a sophisticated attack: they start with a reused credential, a permission nobody revoked when someone changed departments, or an exposed server that had gone unpatched for months. Against that, a single control is not enough; order is what works. Multi-factor authentication stops the stolen credential; if attackers still get in, least-privilege access limits what that account can reach; the private network removes any door from the outside; encryption makes copied data unreadable; the audit trail shows exactly what happened; and the backup brings back what was lost. None of those layers is turned on by default in a new subscription. Configuring them is the work.

From assessment to monitored operations.

The platform brings the controls. Turning them on in the right order, connecting them to what you already have and keeping them running is the work.

Security assessment — What is exposed today, who has access to what, whether the backup actually works, and where the gaps are. It ends in a document with scope, effort and cost, which is yours even if you decide to work with someone else.
Entra ID and Conditional Access — Multi-factor authentication, least-privilege access by clinical role, and elevated permissions that expire on their own. With the same corporate accounts you already manage, without introducing a second directory.
From your server to Azure — Inventory, sizing and migration in waves of what runs in your data center today. Patient care doesn't stop, and each wave has its rollback tested before it is executed.
Azure Health Data Services — The managed FHIR server for the data exchange required by Resolution 1888 of 2025, with the mapping from your clinical system and conformance testing against the national mechanism.
Backup and recovery — Backup with defined retention, point-in-time recovery and—what almost nobody does—periodic restore tests so the backup stops being an assumption.
Managed support — Monitoring, alerts and incident response with response times committed in writing. In Spanish and in your own time zone, which at two in the morning stops being a detail.

What the platform brings

None of these is our achievement: they are controls Azure has already had audited and that your organization inherits.

AES-256 — Encryption at rest, with TLS in transit, on by default
HITRUST — Azure Health Data Services certification for clinical information
24/7 — Continuous threat detection, not an annual audit
Point-in-time — Recovery to an earlier point in time, with retention

Sensitive data, with everything that implies.

Article 5 of Law 1581 of 2012 prohibits processing health data without the explicit authorization of the data subject. It is not a best-practice recommendation: it is the legal regime, and everything else is designed around that sentence.

End-to-end encryption — In transit and at rest, with keys managed in Key Vault. The organization can manage its own keys if its policy requires it, and a copied disk cannot be read.
Least privilege and multi-factor authentication — With Entra ID, the same corporate accounts you already manage. Who gets in, with what role and for how long, reviewable at any time and revocable in one click.
An audit trail of every access — There is a record of who accessed which medical record and when. Without that trail, improper access can be neither proven nor disproven, and you need to be able to do both.
Isolation per instance — Clinical information lives in a dedicated database per service instance, not in a space shared with another organization's data.
Data residency, stated up front — Azure has no region in Colombia. The data stays in the region you choose—Brazil, with Chile and Mexico opening—and that decision is documented before anything is moved, not after signing.
Authorization is yours — No provider can take care of the data subject's authorization to process their sensitive data for you. We help you put it in place and keep a record of it, but the responsibility lies with the organization.

What gets deployed, exactly

The reference architecture we start from, which the assessment adapts to your case.

Everything runs in the organization's own subscription, not on a platform of ours. That difference matters the day you decide to run it with your own team, or to switch providers. Clinical data lives in the managed service, with its database isolated per instance. Around it: what comes in from the clinical system, identity and keys, the management analytics that work without touching identifiable data, and the observability that leaves a trail. Traffic does not go out to the public internet: it is routed over a private network, which is the first thing a security officer asks about.

Runs in your subscription, with your billing and your keys
Clinical data isolated per service instance
Private network: no exposure to the public internet
Analytics on management data, not on identifiable data

Arquitectura de referencia de una Zona de aterrizaje de Azure para una institución de salud: la capa que recibe lo que envía el sistema asistencial, el servicio administrado donde vive el dato clínico, la identidad y las llaves, la analítica de gestión y la observabilidad.

Who is responsible for what

In the cloud, compliance is shared, and almost nobody says so clearly before signing.

Reparto del cumplimiento normativo entre lo que Azure ya trae certificado, lo que se configura durante el proyecto y lo que sigue siendo responsabilidad de la institución de salud, como la autorización del titular para tratar sus datos.

The same obligation has three different owners, and confusing them is what produces surprises at the first audit. Azure comes certified for what is its own: the audited infrastructure and encryption. The project configures what depends on your case: roles, the audit trail, the backup and its testing. And some things remain the organization's responsibility no matter what. The data subject's authorization to process their sensitive data is the clearest example: no provider takes care of it, not ours and not anyone else's. We would rather say so on this page than have it come up in the closing meeting.

Questions we get asked before signing.

Including whether we have healthcare clients, which we answer just as directly.

Is Azure more secure than our own server?

Not automatically, and anyone who says yes without asking anything else is selling you something. A well-managed, up-to-date on-premises server with a tested backup and controlled access can be perfectly secure. What almost no mid-sized healthcare organization can sustain on its own is continuous monitoring, ongoing patching, redundancy and third-party audits, because that requires a dedicated full-time team. With Azure, that part is already paid for and audited, and your team focuses on configuration and data. Misconfigured, Azure is as insecure as anything else.

Do you have clients in the healthcare sector?

We do not yet have a healthcare project delivered and in production, and we would rather say so here than have it come out in the third meeting. What we do have is sustained experience with the pieces this project needs: Azure migrations, Microsoft 365 deployments in several countries, corporate identity with Entra ID, analytics with Power BI, and document automation with optical character recognition and artificial intelligence. We have also designed the architecture for capturing and classifying medical records. If a healthcare case in production is essential for your committee, say so from the start and we will save you the process.

Are you ISO 27001 certified?

No, and in this market it is common to come across the badge without the certificate behind it. What is true and verifiable is that the Azure infrastructure we deploy on is certified under ISO 27001, SOC and HITRUST CSF, and that this certification covers the platform, not the configuration built on top of it. We are a Microsoft Partner, with a public profile in Microsoft's directory. If we obtain our own certification, it will appear with the certifying body, the scope and the number, which is the only thing that makes it verifiable.

Who can see medical records?

Only those with a role that allows it, and every access is logged. Access is defined by clinical profile—a treating physician is not the same as billing or an accounts auditor—and temporary elevations expire on their own instead of piling up. Being a platform administrator does not mean being able to read medical records: they are two separate permissions and are kept apart on purpose. The audit trail is not optional in the design, because without it improper access can be neither proven nor disproven.

What happens if we're hit by ransomware?

The only defense that really works against an attacker encrypting your files is the backup, and someone having tested it by restoring it. That is why backup with retention and point-in-time recovery are part of the base scope, not an add-on. The other layers exist so the attack doesn't get through; the backup exists for the day one of them fails. In the assessment we check whether your current backup works, which is different from whether it exists: one that was never restored is an assumption.

Does this make us compliant with Resolution 1888?

It gives you the technical capability to comply, which is not the same thing. Resolution 1888 of 2025 made the Digital Care Summary mandatory, with data exchange under the HL7 FHIR standard and encrypted transmission to the national mechanism. The project deploys the FHIR service, maps the information from your clinical system and tests the exchange until it passes cleanly. What does not depend on us is the part the regulation assigns to the organization: the data subject's authorization and the quality of the data each professional produces during care.

Does patient care stop during the migration?

No. It is planned in waves: a limited set of workloads is moved, verified, and then the next one follows. Each wave has a rollback plan tested before it is executed, not written just in case. In an organization that treats patients, that is not a methodological preference: it is the condition for being able to start at all. The assessment defines what moves in each wave and in what order, which is where it is decided whether the migration will hurt.

A partner that tells you where its limits are.

We are a Microsoft Partner, we work on Azure every day, and we would rather lose a sale than promise a certification we don't have or compliance we don't control.

Microsoft partner — The profile can be looked up in the official directory. And when a certification belongs to the platform and not to us, we say so.
Nothing stays on our side — Everything is deployed in the organization's own cloud. The day you want to run it yourselves, there is nothing to recover from us.
We quote after we understand — First the assessment, then the proposal with fixed scope and price. Whoever quotes a medical records migration over the phone ends up charging you the difference.
Getting started is inexpensive — The assessment is limited in scope and ends in a document that is useful even if you decide to work with someone else. It is the most honest way for both sides to get to know each other.
Support in Spanish, Colombia time — A team in Cundinamarca that responds in your own time zone, with response times committed in writing.
No dependence on us — The deployment is written down and versioned, not stored in a consultant's head. That is what allows your team to understand it and maintain it.

Other pages in this series.

The other pages in this series, so you can continue wherever makes sense.

Microsoft Azure for Business — Transform your company with Microsoft Azure. We design and implement cloud, data and artificial intelligence solutions tailored to your industry.
Azure Migration — Design, migration, and operations on Azure, with consumption billed in pesos.
Cloud servers — Managed virtual machines and dedicated servers on Azure.
Azure for healthcare — Learn how Microsoft Azure protects sensitive healthcare data in Colombia, ensuring security and regulatory compliance.
Azure for logistics and foreign trade — Azure for logistics operators, customs brokers and transportation.
Microsoft Licensing — Microsoft 365, Copilot and Azure through CSP, invoiced in pesos.

The first step is knowing what is exposed

A two- to four-week assessment tells you who has access to what, whether the backup actually works and how much it costs to close the gap. The document is yours even if you decide to work with someone else.

Schedule your security assessment

Tell us which system you use today and where it runs. We will contact you within one business day.

Two ways to work with us

We work in two ways, and this is one of them. Azure projects are deployed in the client's subscription, with their billing and their keys: the infrastructure is theirs, and we design it, migrate it and keep it running. Our own products— CataAI, Cowork Arcetec with Microsoft 365 and Lienzo de Arcetec —work the other way around: they are a service Arcetec operates on its own cloud, with a dedicated instance per client. There is nothing to manage.

Artículos sobre Microsoft Azure

Topic:Microsoft Azure