Architecture

Cloud Health Office is a cloud-native multi-tenant SaaS platform that processes healthcare EDI transactions for unlimited health plans. Configuration-driven, backend-agnostic, and deployable to any Kubernetes cluster.

Overview

The platform runs on Kubernetes (AKS, EKS, or GKE) with Argo Workflows for orchestration. All payer-specific logic is defined in configuration files — no custom code per tenant. New payers can be onboarded in under 1 hour through the interactive CLI wizard or self-service portal.

Key Design Objectives

Principle	Implementation
Multi-Tenant SaaS	Single codebase serves unlimited payers with per-tenant isolation via X-Tenant-ID header routing
Zero-Code Onboarding	Add new payers through configuration — less than 1 hour to production
Backend Agnostic	Works with any claims admin system (QNXT, Facets, HealthEdge, Epic, custom) via ICoreAdminAdapter pattern
Cloud Agnostic	Deploy to Azure, AWS, GCP, or on-premises with Kubernetes and Helm charts
Standards-Based	X12 EDI (270/275/277/278/834/835/837), FHIR R4, Da Vinci IGs, HL7, USCDI

Platform Components

Microservices (36)

Member, Coverage, Claims, Eligibility, Authorization, Provider, Benefit Plan, Reference Data, Sponsor, Claims Scrubbing, Capitation, Payment, Pricing API, Terminology Service, Provider Verification, and more. Each service owns its domain data and communicates via Azure Service Bus messaging. The Terminology Service provides FHIR ConceptMap/$translate for SNOMED CT ↔ CPT/ICD-10-CM crosswalk — required for Da Vinci CRD, DTR, and PAS workflows. The Provider Verification Service aggregates NPPES, OIG/LEIE, PECOS, CMS Open Payments, and FSMB data into a composite integrity score per NPI.

Calculation Engines (9)

Benefit Engine (HDHP/HSA, aggregate family accumulators, DRG inpatient), Fee Schedule Engine (DRG lookup, Medicaid cross-schedule, multiple procedure ranking), NCCI Engine, COB Engine, Risk Adjustment Engine, Encounter Engine, Claims Scrub Engine, Capitation Engine, and Operating Mode Engine.

X12 Parsers (6)

837 Claims, 835 Remittance, 834 Enrollment, 276/277 Claim Status, 278 Prior Auth, and X12 Encoder. All written in C# (.NET 8) with zero external dependencies.

Claims Adjudication Pipeline

The 10-step claims adjudication pipeline processes an 837 from SFTP ingestion through Argo Workflows to real-time adjudication with full benefit calculation, completing in under 500ms end-to-end.

Pipeline Steps

The pipeline executes: get claim, validate codes, verify coverage, validate provider, check prior auth, get benefits, apply NCCI/MUE edits, calculate allowed amount, calculate cost-sharing (copay/coinsurance/deductible), and update claim status. Each step is individually testable and observable.

Multi-Tenant Design

Every API request carries an X-Tenant-ID header that determines data isolation, configuration routing, and audit logging. The configuration-driven approach means no code changes are required to onboard new payers — only a JSON configuration file defining clearinghouse mappings, benefit rules, and EDI trading partner details.

The Config-to-Workflow Generator takes a payer's configuration file and generates complete Argo Workflow YAML and Bicep infrastructure definitions, enabling automated environment provisioning.

Infrastructure

Component	Technology	Purpose
Orchestration	Argo Workflows	Kubernetes-native DAG workflow execution
Event Triggers	Argo Events	SFTP, webhook, and schedule-based triggers
Messaging	Azure Service Bus / Kafka	Async inter-service communication
Storage	Azure Storage Gen2	HIPAA-compliant EDI file data lake
Secrets	Key Vault / HashiCorp Vault	Secrets management, automated rotation
Monitoring	Prometheus + Grafana, App Insights	Metrics, dashboards, PHI-safe logging
Database	MongoDB / Cosmos DB	Document store with tenant partitioning
Cache	Redis	Accumulator service, session cache

HIPAA Security

The platform addresses HIPAA technical safeguards with private endpoints for complete network isolation of PHI, PHI masking in Application Insights using DCR-based redaction, customer-managed encryption keys (BYOK), 7-year data lifecycle management with automated tiering, and 18 automated CI/CD tests to prevent PHI exposure in logs and telemetry.