Oncology treatment platform

Context

Our customer is a US-based provider of health information solutions for practicing oncologists. They wanted to develop a HIPAA-compliant platform that would help doctors make timely and evidence-based patient treatment decisions.

The customer had a working prototype software that allowed them to collect disease reports and research from relevant sources and store them in their knowledge base. However, it did not meet all of their business requirements which included knowledge base management and reports generation. What is more, the company planned to develop a solution that would streamline patient case analysis and facilitate treatment selection through access to relevant research studies. 

The customer was searching for a software vendor for healthcare software development to build such a platform from the ground up. They chose Itransition due to our relevant expertise and a proven track record in the healthcare domain.

Technologies

We built the knowledge base and reporting modules using Java, Spring framework, and the MySQL database, and employed JavaScript and Angular framework to develop their frontend. To separate the knowledge base and reporting modules’ backend and frontend and implement changes separately, we shifted their architecture from JSP to SPA.

Initially, the customer planned to have the knowledge base and reporting modules for internal use, but after a while, they decided to go public and develop a precision medicine portal. This required the platform to be highly scalable, sustain high loads, and support multiple integrations and end-clients’ customizations. Considering these requirements, we chose a microservices architecture for portal implementation.

We utilized TypeScript, Angular framework, and Angular Material UI component library to develop the precision medicine portal’s frontend. We built the backend leveraging Java and Kotlin. We used PostgreSQL, MongoDB, and Redis as databases, with the Hibernate ORM tool enabling database access. 

The microservice architecture employs Spring Cloud Netflix, so each microservice acts as a Spring Boot application with its own database. In total, there are around 40 microservices, which communicate through Feign requests and AMQP messages, with RabbitMQ acting as a message broker for the AMQP protocol. 

The solution’s architecture allows for a number of entities to be configured according to the template that defines required and optional configurations. 

We carried out the release build using the Gradle build automation tool. We used Jenkins for building and delivering the project with all build configurations stored as Jenkins Pipelines in the Git version control system. We employed Prometheus to monitor the system’s state and service availability and used Graylog for logs analysis. Our team also utilized the Mirth engine for integrating the portal with the reporting module and connecting the solution with third-party systems. Beyond that, we used JUnit and Mockito to write and run unit and integration tests for the portal’s backend and applied Jasmine and Karma to write and run unit tests for the frontend.

We hosted the solution on AWS and employed the following range of Amazon services:

• Amazon VPC for launching environments in a logically isolated virtual network.
• Amazon EC2 as a virtual computer for deploying each environment.
• Amazon S3 for storing static frontend files, files generated and processed by the system, user attachments, server and PHI logs, and temporary backups. 
• Amazon Glacier for long-term storage of backups and logs. 
• Amazon CloudFront for quickly distributing static files, such as frontend files.
• AWS Lambda and Amazon SNS for managing notifications from an alert service monitoring the state of the servers. 
• AWS WAF for access control to the solution’s resources. 
• Amazon EFS for scalable, elastic, and concurrent storage for EC2 instances. 
• Amazon Route 53 as a DNS service for resolving the project domain name and redirecting to the required resource. 
• AWS KMS for creating and managing cryptographic keys. 
• Amazon CloudWatch for monitoring the state of AWS infrastructure. 
• AWS IAM for secure management of access to AWS services and resources. 
• AWS CodeDeploy for automating software deployments to EC2 instances within the CI/CD process.

DevOps

Our team established AWS DevOps architecture consisting of four separate environments for the knowledge base and reporting portals, namely for development, staging, testing, and production. They also set up five environments for the precision medicine portal with an extra environment for beta testing by the customer. Apart from that, the team set up two demo environments with slightly different portal configurations to demonstrate the solution to the customer’s future partners. 

To ensure a stable, predictable, and repeatable delivery, our DevOps team implemented CI/CD practices, including continuous code review and quality assurance. The team also performed delivery monitoring, events logging, and alerting, which allowed us to quickly react to issues in the early stages.

DevOps enablement helped us improve agility and accelerate delivery cycles up to 20-30 minutes. What is more, it allowed the customer to cut deployment costs by 50% due to optimized resource utilization. 

Currently, the DevOps team applies the Infrastructure-as-a-Code approach to the project using AWS Code Deploy, Terraform, and Kubernetes, which enables flexibility, scalability, load balancing and control, optimization of infrastructural resources, and automation of deployments and updates.

Testing

To test new platform features, our QA team wrote test cases and used Zephyr integrated with Jira to manage them and compose test runs for regression testing.  

Our QA activities on the project also encompassed defect validation, smoke testing, compatibility testing, and regression testing. Besides that, our team conducted beta testing with real users for pre-production feature checks.

We used Postman to verify some tasks that don’t have a user interface as well as the solution’s APIs. Our team also applied DevTools for reading logs and emulating user activities to measure various indicators. Apart from that, we used browser extensions to accelerate input fields testing.

HIPAA compliance

We developed the oncology treatment platform in line with HIPAA requirements and ensured comprehensive protection of sensitive health information within it. 

First, we made sure the access to patient information is available only to practicing oncologists and each session is logged and stored in the system for five years.

Second, we implemented Advanced Encryption Standard (AES-256) to ensure all patient data is encrypted and securely stored in the database. Additionally, our team applied Transport Layer Security (TLS) to encrypt data whilst in transit.

What is more, we made sure that all actions with PHI are logged separately, with logs encrypted by AWS Key Management Service and kept up for six years in AWS Glacier storage. 

Finally, the customer submitted the platform for the Service Organization Control 2 audit to a third-party company.

Results

Itransition delivered a custom oncology treatment platform that streamlines patient care by enabling doctors to make decisions based on relevant studies and prescribe appropriate therapy for each patient. The platform also greatly facilitates the work with tests and lab selection, as 90% of doctors accept the automatically recommended test sets without changes. 

The solution is currently used by 700+ employees from 30+ medical institutions across the US, with about 1,000 therapy orders created each month. Besides, several potential clients were interested in incorporating the Clinical Decisions Support API in their existing solutions to facilitate the selection of necessary genetic tests. 

The Itransition team keeps enhancing the platform and constantly adding new features and integrations with laboratories and insurance companies as more clinics adopt the system.