Enhancing Pediatric Health Data Security with a HIPAA-Compliant Architecture and Application Audit for ZERO TO THREE
| Client | Industry | Solution Provided | Technologies Used |
|---|---|---|---|
| ZERO TO THREE | Healthcare & Lifesciences | Cloud-native application architecture, serverless infrastructure, application-level security audit, vulnerability scanning, penetration testing, HIPAA compliance enablement | AWS Lambda, AWS API Gateway, PostgreSQL, Node.js, React, Redux, OWASP ZAP, SonarQube |
The Need
ZERO TO THREE’s HealthySteps program empowers families and caregivers to support early childhood development through digital tools that facilitate secure data sharing, assessments, and engagement outside the clinic. To scale this program nationally and meet rigorous HIPAA requirements, ZERO TO THREE needed to modernize and validate the security posture of its custom-built application, Welly.
Key challenges included:
- HIPAA Compliance Pressure: HealthySteps’ national data collection required stringent compliance with healthcare privacy regulations
- Manual Reporting Risk: Prior to Welly, reliance on spreadsheets and siloed systems introduced inefficiencies and increased the risk of human error and data breaches
- Cloud Security Confidence: The organization needed clear validation that the new AWS-based application infrastructure met compliance and threat resilience standards
The Solution
Gorilla Logic delivered a comprehensive HIPAA-aligned security audit and deployed a modern serverless cloud architecture to support secure, scalable operation of the Welly application.
Key solutions included:
- Serverless Application Architecture: Built Welly on AWS Lambda and API Gateway to eliminate server maintenance overhead, reduce cost, and support elastic scalability
- Infrastructure and Application Hardening: Guided AWS service selection to ensure HIPAA compliance and resilience against system faults
- Security Audit with Real-World Testing: Conducted a full codebase review using SonarQube, executed live penetration tests with OWASP ZAP, and identified critical and minor vulnerabilities prior to external validation
- Audit-Ready Reporting: Delivered detailed documentation and security posture assessments to help ZERO TO THREE pre-validate compliance readiness with external consultants
The Results
Validated HIPAA-Ready Architecture: Welly passed external security consultant review with minimal issues—one of the cleanest audits they’d seen.
Improved Data Security Confidence: Proactive testing uncovered and remediated vulnerabilities before go-live, reducing future risk.
Operational Efficiency at Scale: Serverless design allowed for secure growth and simplified management across HealthySteps’ 150+ locations.
Modern Digital Engagement: Enabled families to securely access pediatric development tools outside the clinic—replacing manual processes with a seamless, secure digital experience.
Positive Stakeholder Feedback: ZERO TO THREE IT leadership praised Gorilla Logic’s thoroughness, transparency, and ability to deliver without delay or compromise.
“There were no glitches or Plan B’s—only great teamwork in meeting deadlines and deliverables.”
— Prasad Kothembaka, IT Manager for HealthySteps, ZERO TO THREE
