Managed HIPAA GPU Hosting For AI In Cancer Research for a U.S. University

A cancer research organization recently approached Atlantic.Net about a managed HIPAA hosting environment for its latest AI research project. The request included several requirements: GPU computing capacity, protection for sensitive patient information, U.S. data residency, and ongoing infrastructure management.

Our proposed configuration combined an NVIDIA H100 NVL GPU dedicated server with encrypted storage, managed security services, backups, and support. The research workload would still need testing against the proposed resources, and both Atlantic.Net and the client would need a clear understanding of the services covered by the hosting agreement.

In this installment of our managed hosting proposal series, we examine the configuration, explain the included services, and discuss the shared responsibility model agreed to enable the research platform to go live.

What The Cancer Research Organization Needed

The quote request focused on 2 distinct areas: Atlantic.Net AI/ML dedicated servers and handling electronic protected health information (ePHI). Alongside dedicated, HIPAA-compliant GPU resources, the client wanted a managed service that included managed security, reliable backups, and technical support covered by a service level agreement.

The client has a strict U.S. data residency requirement. This was a key factor in deciding the primary hosting location, backup arrangements, and the third-party services involved in processing the data.

Further sizing and deployment planning would depend on the client’s research team’s intended workload: the models and software it planned to use, the size of training datasets, and whether the project involved additional AI training, application fine-tuning, or AI inference. These details matter because they guide capacity planning and help us align the maintenance schedule with the customer’s needs.

The Proposed GPU Hosting Configuration

For this cancer research project, we proposed the following configuration. Our engineering teams would need to validate the suitability using the chosen dedicated server models and a representative research workload test.

Our engineers recommended this configuration because the CPU and system memory are an ideal match for preparing complex datasets, loading research data, and running processes alongside the GPU workload. We recommended at least 240 GB of system RAM, and the H100 offers up to 94 GB of HBM3 GPU memory.

System resources on our GPU-dedicated server line are substantial because training an AI model from scratch, fine-tuning an existing model, and running inference can be resource-intensive. Batch size, input length, numerical precision, and the training method can all place huge demand on the hosting platform.

Fast SSD/Flash Storage is critical for AI workloads. A source dataset may fit comfortably within 2.4 TB; sizing needs to be accurate and account for future growth. This includes several prepared versions, temporary files, and saved training checkpoints. Our engineers recommend running a pilot to understand future growth and help us plan and reserve enough space for future work.

Our HIPAA GPU hosting service combines GPU resources with managed security services and includes a 20 TB monthly transfer allowance.

Managed Security And HIPAA Business Associate Agreement (BAA) Coverage

For this prospect, the security services and HIPAA Business Associate Agreement (BAA) needed to be considered together. The BAA and service scope give an organization a clear record of the services covered and the responsibilities it retains.

To achieve HIPAA compliance, our HIPAA Business Associate Agreement (BAA) offer for this proposal was conditional on acceptance of the full required service package. HIPAA’s administrative, technical, and physical safeguards are stringent, so any request to remove a security component would require reviewing the package and its contractual scope.

Controlling Access To The Research Environment

Access controls are mandatory for HIPAA compliance, and the proposed access controls combine a managed FortiGate firewall and intrusion prevention system with AES-256 encrypted virtual private network (VPN) access and Duo multi-factor authentication (MFA). The configuration would depend on how the clients, researchers, and administrators needed to reach the environment, including permitted connections, applications accepting inbound traffic, and where MFA applies.

The package also included Trend Micro security software. Its configured protections, alert handling, and interaction with research jobs were a great fit for the customer. Audit logging and the customer’s needs for the events recorded, who reviews them, and how long those records remain available made Trend Micro a great fit.

The client would be required to follow specific data-handling requirements. For example, a clinical-text project could leave electronic protected health information (ePHI) in prepared datasets, notebook output, temporary files, or error messages. Understanding how data is accessed helps define log-in and data retention requirements, including which outputs need review before leaving the environment.

Backups, Recovery, And Data Location

The proposal included encrypted daily backups, stored locally and off-site, with 30-day retention. For the research team, a useful recovery test is to restore a dataset and a saved training checkpoint, and confirm everything works with detailed testing.

A 30-day retention period was recommended; it determines how long backup copies remain available. Recovery planning must separately define how much recent work the organization can afford to lose and how quickly it must restore the environment. These requirements are expressed through the recovery point objective and recovery time objective, respectively.

Testing a restore provides a practical way to assess those objectives and evaluate the recovery procedure before relying on the environment for live research.

Third-Party Services And U.S. Residency

The proposal also included managed services for a web application firewall, distributed denial-of-service (DDoS) protection, and content delivery services. Before routing research traffic through them, we needed to identify all endpoints involved and whether requests, responses, or logs contained protected health information (PHI).

For those traffic paths, the customer needs to establish the applicable services, configuration, and contractual coverage, taking into account this prospect’s U.S. data residency requirement.

Documenting the primary hosting location, backup locations, and any third-party processing in the service scope gives the organization a record of where its data will be handled across the proposed environment.

What Atlantic.Net Would Manage

The proposed package included fully managed hosting and U.S.-based support available 24/7/365. Atlantic.Net engineers would work with the client to define the operating system, security, and backup tasks required before launch and throughout the hosting engagement.

Under the shared responsibility model, the hosting agreement sets out the infrastructure services we manage, maintenance responsibilities, and the escalation process. For the proposed Ubuntu 24.04 LTS environment, the maintenance plan needs to account for operating system updates and long-running research jobs.

For this proposal, the customer would remain responsible for GPU driver changes and compatibility testing. The research team retains ownership of dataset permissions, preparation code, model selection, application access, and scientific validation. The machine learning framework and its dependencies also need named owners within that responsibility record.

A failed training job could involve infrastructure, an incompatible software package, or research code. Naming contacts for infrastructure incidents and research-software problems helped the teams reach the right support.

Separately Scoped Professional Services

The customer also discussed possible assistance with migrating an existing environment or preparing software for the new server. Any such work would be scoped separately under a professional services agreement.

A professional services agreement defines the deliverables, pricing, acceptance criteria, and responsibility for software support after handover. Both teams can then distinguish that work from the ongoing hosting service.

Validating The Environment Before Introducing PHI

With the proposed resources and responsibilities defined, a pilot using synthetic or suitable public data would allow the team to test the workload, access controls, and recovery procedures before introducing PHI.

The pilot should cover five practical checks:

1. Run a representative job. Use the intended model, training or inference approach, and realistic input lengths. Record the software versions so you can reproduce the results.
2. Measure resource use. Capture peak GPU memory, host RAM, storage growth, and processing time. Confirm the GPU resources available to the job and check compatibility between Ubuntu, the GPU driver, and the research software.
3. Test access and logging. Check permitted and denied access, account removal, and administrator activity. Inspect logs for sample records, credentials, or other sensitive content.
4. Restore a working state. Recover a test dataset and a saved checkpoint from backup. Measure the recovery time and verify that work can resume.
5. Complete the scope review. Confirm data locations, retention, third-party services, research permissions, and the executed HIPAA Business Associate Agreement (BAA). Include any separately agreed professional services and support responsibilities.

The results would show whether the proposed configuration can run the agreed workload and meet the team’s access and recovery requirements. Changes to the model, dataset, access arrangements, or external services can then prompt a review of capacity and security as the project develops.

Planning Your Research Environment With Atlantic.Net

This cancer research proposal brought GPU computing resources, managed security, backups, and support into a single hosting design. Evaluating those services together helps a research organization assess both the proposed environment and the support available on demand.

For a team planning a similar project, start with the work it needs to run and the requirements around its data. Contact our solutions team with your model requirements, dataset size, expected training or inference schedule, and PHI-handling requirements. Include your data residency and recovery objectives so we can discuss a configuration and managed service scope that your research and security teams can evaluate together.