Source: helpnetsecurity.com. Original announcement published August 2019.
What Is ClearDATA Locate?
ClearDATA, a healthcare-focused cloud security and compliance vendor, announced ClearDATA Locate, a multi-cloud SaaS product designed to give healthcare organizations a traceable, continuously updated inventory of their Protected Health Information (PHI) as it moves through Kubernetes-based workloads.
The solution is available on the three major public cloud platforms: Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. It is built on ClearDATA’s proprietary Healthcare Aware Distributed Tracing technology, which was first unveiled at HIMSS 2019 earlier that year.
The Core Problem: PHI Visibility in Microservices Architectures
As healthcare organizations have migrated workloads to the public cloud, sensitive patient data — including names, addresses, Social Security numbers, payment details, and health records — is routinely distributed across containerized microservices. This architecture improves scalability and agility, but it also introduces a significant compliance challenge: it becomes difficult to know exactly where PHI resides at any given moment, whether in transit or at rest.
Traditional monitoring and logging approaches are not purpose-built to track healthcare data as it flows between containers and services within a Kubernetes cluster. Without fine-grained tracing, a single security incident can appear to affect every record in a system — even when only a small subset was actually exposed.
“We’ve come a long way since healthcare was at odds with the public cloud. However, the ability to track sensitive data as it moves from point A to Z was missing from the narrative and represented a huge vulnerability for healthcare organizations.”
— Matt Ferrari, Chief Technology Officer, ClearDATA
How ClearDATA Locate Works
ClearDATA Locate uses distributed tracing — a technique borrowed from general observability practices and adapted specifically for healthcare data compliance — combined with machine learning to identify and track PHI as it passes through Kubernetes applications.
Key capabilities described by the company include:
- PHI inventory tracking: Builds and maintains a continuously updated inventory of where patient data lives across multi-cloud Kubernetes environments.
- Data-in-transit and data-at-rest visibility: Observes sensitive data regardless of whether it is moving between services or stored within a container workload.
- Breach scoping: When a security incident occurs, enables teams to identify the precise records that were exposed rather than assuming all records in the system were compromised.
- Compliance support: Assists organizations in meeting requirements under HIPAA and frameworks such as GDPR, including the “Right to be Forgotten,” by providing an accurate map of where specific patient data has traveled.
- Audit readiness: Produces traceable data flow records that can support audits by regulators such as the HHS Office for Civil Rights (OCR).
The Compliance and Financial Case
Healthcare data breaches carry some of the highest per-record costs of any industry, and HHS OCR fines for HIPAA violations can be substantial. One of the most costly aspects of a breach notification response is over-notification: when an organization cannot determine exactly which records were accessed, it must notify every patient whose data could theoretically have been exposed.
“Today, if you routinely process tens of thousands of patient records through your application, you would have to notify all those patients of a suspected breach when, in reality, only 200 records may have been impacted. ClearDATA Locate can dramatically change the outcome for healthcare organizations and patients.”
— Matt Ferrari, CTO, ClearDATA
By narrowing the scope of affected records with precision, ClearDATA Locate aims to reduce both the direct costs of breach notification and the potential scale of regulatory penalties. It can also limit reputational damage to healthcare providers, payers, and life sciences organizations by demonstrating to regulators and patients that the organization has strong data governance controls in place.
Target Audience
ClearDATA Locate is aimed at three primary segments of the US healthcare industry that regularly handle large volumes of PHI within cloud-native applications:
- Healthcare providers (hospitals, health systems, clinics)
- Payers (insurance companies and managed care organizations)
- Life sciences organizations (pharmaceutical companies, clinical research organizations)
Technology Background: Healthcare Aware Distributed Tracing
The underlying Healthcare Aware Distributed Tracing technology was introduced by ClearDATA at the HIMSS 2019 conference. The approach adapts distributed tracing concepts — well established in DevOps and site reliability engineering for performance monitoring — to the specific requirements of healthcare data governance. By tagging and following PHI through each hop in a microservices pipeline, the system can reconstruct the full data journey for compliance and forensic purposes.
Machine learning is applied to help classify and identify sensitive data patterns automatically, reducing the burden on engineering teams who might otherwise need to manually annotate every data field that could constitute PHI.
Relevance for DevOps and Platform Engineering Teams
For DevOps and platform engineers working in regulated healthcare environments, ClearDATA Locate represents an attempt to shift compliance controls left into the infrastructure layer rather than relying solely on application-level controls. Key points of interest include:
- The solution operates at the Kubernetes workload level, meaning it can be integrated alongside existing container orchestration workflows without requiring changes to individual application codebases.
- Multi-cloud support across AWS, GCP, and Azure aligns with how many larger healthcare organizations operate — using more than one cloud provider for different workloads or as a risk mitigation strategy.
- Continuous inventory updates reflect the dynamic, ephemeral nature of containerized workloads, where pods and services spin up and down frequently.
Teams evaluating this type of tooling should also consider how it integrates with existing observability stacks (such as Prometheus, Jaeger, or cloud-native tracing services) and how PHI tagging and classification rules are configured and maintained over time.