FedRAMP for Healthcare SaaS: Cloud Security Architecture and Authorization Considerations for VA and HHS

Healthcare SaaS vendors entering the US federal market need to consider more than application functionality and infrastructure availability. When a cloud service processes federal information on behalf of an agency, FedRAMP scope and authorization requirements may become relevant.

For engineering, cloud security, and compliance teams, the first challenge is understanding the service boundary and the agency's intended use.

FedRAMP establishes a standardised approach for assessing and authorising cloud computing services used by federal agencies. This article examines the main considerations for healthcare SaaS vendors targeting the Department of Veterans Affairs (VA) and the Department of Health and Human Services (HHS).

1. Determine Whether the Service Falls Within FedRAMP Scope

FedRAMP applies to qualifying cloud services that create, collect, process, store, or maintain federal information on behalf of federal agencies, subject to programme scope rules and exclusions.

The assessment should focus on the specific cloud service offering rather than the vendor's entire business.

Important questions include:

• What federal information will the service process?
• Which systems and environments are included?
• What is the authorization boundary?
• Which external systems and services are integrated?
• Where does information enter, move through, and leave the service?
• How will the federal agency use the service?

A vendor may operate several SaaS products or environments, but the assessed scope of one offering should not be represented as covering unrelated services.

2. Understand the VA and HHS Use Cases

VA Notice 25-07, issued in March 2025, amended VA Directive 6500 to connect cloud computing products and services undergoing VA Authorization to Operate with applicable FedRAMP requirements.

HHS also has policies addressing FedRAMP-certified cloud platforms and approval for their use in relevant circumstances.

However, the required certification path and security conditions depend on the agency, information, system, contract, and intended federal use.

Engineering teams should therefore review the actual procurement requirements before defining a target architecture or certification strategy.

3. Define the Cloud Service Boundary

A clear authorization boundary helps establish which components and responsibilities belong to the cloud service offering.

For a healthcare SaaS platform, relevant components may include:

• Application services and APIs
• Databases and storage systems
• Identity and access management services
• Cloud infrastructure
• Administrative interfaces
• Monitoring and logging components
• External integrations
• Supporting operational services

The boundary should accurately reflect the service being assessed. Unclear boundaries can create gaps in security documentation and misunderstandings about which systems are covered.

4. Maintain Security Evidence

FedRAMP requirements depend on the applicable programme path, impact level, and current rules.

The vendor generally needs to establish the service offering and boundary, address applicable security requirements, provide security information and evidence, complete assessment and verification activities, and maintain security information over time.

The programme is transitioning from the traditional Rev5 model towards FedRAMP 20x. The 2026 Consolidated Rules establish Class A, Class B, and Class C certification classes.

Depending on the class, the certification information may include:

• Certification Package Overview
• Security Decision Record
• Key Security Indicators
• Secure configuration information
• Ongoing certification data

The emphasis is increasingly on maintaining current security information rather than relying solely on static documentation.

5. Understand Certification Versus ATO

A common mistake is treating FedRAMP certification as equivalent to an agency Authorization to Operate.

Certification provides reusable security evidence for a defined cloud service offering.

The agency evaluates how the service will be used in its own information system and makes the relevant authorization decision. The resulting ATO applies to the agency system and its specific use of the service.

This distinction matters when a healthcare SaaS platform integrates with VA identity services, electronic health records, analytics platforms, or other federal systems.

6. Consider HIPAA Separately

FedRAMP and HIPAA address different requirements.

FedRAMP concerns federal cloud security and authorization. HIPAA establishes requirements applicable to covered entities, business associates, and protected health information within its scope.

A healthcare SaaS provider may need to address both depending on the information, customer relationship, and contract.

7. Plan for Continuous Security Activities

FedRAMP is not simply a one-time certification milestone.

Vendors need to maintain relevant security information, address vulnerabilities, support ongoing verification and validation, and evaluate changes affecting the service.

Changes to infrastructure, integrations, configurations, and the service boundary should be considered within the ongoing security management process.

Conclusion

Healthcare SaaS vendors targeting VA and HHS should understand FedRAMP scope, service boundaries, certification classes, agency authorisation, and ongoing security expectations before entering federal procurement.

A structured FedRAMP certification and cloud security assessment approach can help connect technical security work with the evidence and assessment activities expected in federal cloud environments.