How Modern Health uses AWS to secure participant data and scale its enterprise mental health platform

Enterprise mental health care platform Modern Health has been architected in AWS since its launch in 2017, and now it is using the cloud platform to handle more complex and higher volumes of sensitive data. Modern Health partners with companies like Lyft, Postmates, and Udemy to provide benefits to their employees: Its entire user base consists of clients’ employees. The company has accordingly strategized to account for traffic across different time zones, integrate new product features for wellness, and posture its security to comply with data privacy laws for personal health records.

When new users join, Modern Health asks them to select their areas of concern; it then uses a simple triage model to recommend a digital care plan based in self-guided meditation programs, group therapy activities, and 1:1 personal counseling with licensed therapists. Modern Health collects data related their mental health and treatment plan starting from this initial intake. According to Jonathan Lloyd, Modern Health’s engineering lead, the platform’s security has been tailored to protect users’ personally identifiable information and health records from the start. Lloyd said AWS has remained central to this strategy.

“When we think about technology decisions, a lot of them exist at a point in time … [but] Amazon is a decision we’ve made since the beginning. …  [Amazon] continued to deliver features that match the needs that we have in the health care space, as the platform has grown as our user base expanded,” he said in an interview with VentureBeat.

Lloyd’s IT team uses several AWS services, such as the key management service that creates unique keys for protecting individual clients’ specific data. Lloyd said his team also applies added layers of security with PGP encryption to verify that any data exchanged is encrypted between the sender and receiver, and the team performs annual penetration testing to measure how protected the data is from cyberattacks. Legal requirements like the HIPAA Security Rule make these processes particularly critical.

The production web app consumes user data and pulls it through a de-identifying data lake in AWS. Within the data lake, ETLs like Step Functions and Simple Storage Service (Amazon S3) extract, track, and sanitize it via loading processes to match the validation shape. This stage integrates alerting and monitoring to help ensure the data pipelines are stable.

The resulting data is stored in an AWS POST rest database and used within internal BI tooling. Modern Health also sends some unspecified form of this data to enterprises. According to Lloyd, the data concerns how their employees are benefiting from Modern Health’s services.

Lloyd reported that since March 2020, Modern Health doubled its number of clients and tripled its own internal headcount. According to materials the company sent VentureBeat, 30% of Eventbrite‘s employees use the platform, and engagement rates have increased across companies. Modern Health also introduced integrations like therapist-led group sessions called Circles.

“Investments in things like load and stress testing [became] really strong investments. So toward the end of last year, we dedicated resources to really doing that extensive load testing to confirm that the platform would support the scale that we knew was coming,” said Lloyd.

These stress tests attempt to mirror and replicate traffic based on existing data. And in scaling its data capabilities to account for this growth in usage, Modern Health also adjusts for global demand surrounding when and how employees use modern health, including time differences and which languages live therapists speak.

Modern Health is fairly new: The company was founded in 2017 and accelerated with the Y Combinator in 2018, but has already made significant headlines, including a 2020 lawsuit from a cofounder alleging wrongful termination and company bribes to customers. Next week, Modern Health will announce its acquisition of Kip, another San Francisco-based digital mental health platform, which focuses on consumers rather than enterprises and their employees.

In the long term, Lloyd said Modern Health wants to expand its infrastructure, particularly by bringing on more engineers across the board to develop new platform features for monitoring and securing data.