Azure Confidential Computing

A hardware-enforced isolation zone within the CPU that protects code and data from the host operating system, hypervisor, and even cloud administrators. In Azure, TEEs are implemented via Intel SGX and AMD SEV-SNP technologies. The TEE creates an encrypted memory region—often called an enclave—where computation occurs in complete isolation. Even if the host OS is compromised, data inside the TEE remains inaccessible. For healthcare workloads, this means Protected Health Information (PHI) can be processed without exposure to the underlying infrastructure layer.

A cryptographic verification process that proves a TEE is running on genuine, trusted hardware with the correct software configuration before any sensitive data is released to it. Azure Attestation validates:

• Hardware identity: Confirms the enclave runs on authentic Intel or AMD silicon
• Firmware integrity: Verifies no tampered microcode is present
• Software measurement: Ensures the exact expected code binary is loaded This provides a verifiable chain of trust from silicon to application, critical for healthcare compliance auditors who need proof that PHI processing environments haven't been compromised.

Full VMs protected by AMD SEV-SNP or Intel TDX that encrypt the entire VM memory space against the hypervisor. Unlike enclave-based approaches that require code refactoring, Confidential VMs allow lift-and-shift migration of existing healthcare applications. The entire OS disk and memory state are encrypted with keys generated within the hardware. Key benefits for HIPAA workloads:

• No application code changes required
• Full OS support (Windows Server, Ubuntu, RHEL)
• Ephemeral vTPM for measured boot and secrets release
• Disk encryption keys never leave the hardware security module

Kubernetes pods running inside hardware-protected TEEs on Azure Kubernetes Service, combining the agility of containers with confidential computing guarantees. Built on the Kata Confidential Containers stack, this architecture:

• Encrypts container memory against the host kernel
• Supports unmodified container images
• Integrates with Azure Key Vault for attested secrets release
• Enables confidential multi-party data collaboration where multiple healthcare organizations can jointly process data without exposing it to each other This is the foundational pattern for deploying HIPAA-compliant AI inference microservices at scale.

A FIPS 140-2 Level 3 validated hardware security module service that safeguards cryptographic keys and secrets used by confidential computing workloads. Keys stored in Managed HSM are protected by dedicated hardware in Azure datacenters. For confidential computing scenarios, Managed HSM integrates with attestation to implement secure key release: decryption keys are only released to an enclave after it successfully proves its identity and integrity. This ensures that even Azure operators cannot access the keys needed to decrypt PHI—only a verified, attested TEE can retrieve them.

The specific pattern of running AI model inference inside a TEE so that both the model weights (intellectual property) and the input data (patient PHI) remain encrypted during computation. In healthcare, this enables scenarios where:

• A proprietary diagnostic model runs on hospital data without the model owner seeing patient records
• A payer's prior authorization AI processes clinical notes without the provider exposing raw PHI
• Multi-party model evaluation occurs where neither the data owner nor model owner can access the other's assets Azure implements this via NVIDIA GPU TEEs and CPU-based enclaves with ONNX Runtime.