Department of Health and Human Services (HHS), Assistant Secretary for Preparedness and Response (ASPR): emPOWER Platform

Executive Summary

CTAC developed and continues to enhance the emPOWER Planning Platform for HHS ASPR to enable secure data sharing across federal, state, and local agencies. emPOWER helps mitigate the risks of power outages, natural disasters, and other emergencies for individuals who rely on electricity-dependent Durable Medical Equipment (DME).

The initiative originated after Hurricane Katrina, when hospitals were overwhelmed by otherwise healthy DME users who lost power and sought care. The emPOWER Platform and public-facing map provide access to de-identified CMS data that helps emergency planners identify and assist at-risk populations during extended outages.

Originally built in AWS’s East Cloud Region in 2015, emPOWER continues to evolve to support modern emergency preparedness and response efforts.

Introduction to Customer

The Administration for Strategic Preparedness and Response (ASPR) is a federal agency within HHS. Its mission is to save lives and protect Americans from 21st-century health security threats. ASPR leads medical and public health preparedness, response, and recovery in coordination with public and private sector partners.

During disasters and public health emergencies, ASPR provides federal support to states, localities, tribes, and territories. It also advances preparedness through grants and cooperative agreements with healthcare coalitions and systems nationwide.

The emPOWER program is one of ASPR’s longest-running and most visible platforms. It is actively used by planners and first responders in all 50 states, the District of Columbia, and U.S. territories.

Customer Challenge

Emergency planners lacked timely, actionable data to identify individuals who depend on electricity-powered Durable Medical Equipment (DME). Instead, they relied on indirect methods—such as utility outage maps, social vulnerability indexes, and anecdotal reports—to assess risk during power outages.

There was no standardized process for determining who required urgent support or where to prioritize resource deployment.

ASPR needed a secure, scalable platform that could deliver de-identified CMS data to planners across state and local jurisdictions. They also required analytics tools to make that data quickly understandable and actionable during emergencies.

Proposed Solution and Solution Implementation

CTAC developed the emPOWER Planning Platform in partnership with ASPR and CMS to give emergency planners secure access to de-identified DME and claims data. The platform runs on AWS to support high availability, geographic redundancy, and elastic scalability.

emPOWER follows a three-tier architecture hosted within a private VPC. The application layer runs on EC2 instances deployed in Auto Scaling Groups behind ALBs. Transactional and state data are stored in DynamoDB. Static content is hosted in S3 and delivered via CloudFront.

CTAC provisioned infrastructure using Terraform, ensuring consistency across development, staging, and production environments. Jenkins pipelines automate AMI builds, application deployments, and infrastructure changes using a unified, version-controlled process. Environment configurations are stored in AWS Parameter Store and injected at runtime.

The CMS data import pipeline is handled by Lambda functions triggered by SNS. Logs are sent to CloudWatch and Splunk. Alarms notify the SA team and stakeholders of performance issues or data import failures.

Backups are stored in versioned S3 buckets. The restore process is tested monthly in staging to ensure data integrity. Security is enforced using IAM roles with least-privilege access, KMS encryption, and VPC endpoints to isolate traffic.

In addition, CTAC integrated Google Analytics into the front-end to track user behavior, such as file downloads, commonly searched geographic areas, and overall engagement trends. These metrics help the team continuously improve the platform based on actual usage patterns.

Provisioning & Compliance-Ready Environments

CTAC used Terraform to provision infrastructure across development, staging, and production environments. Jenkins pipelines automate deployment of infrastructure and application code, including custom Amazon Machine Images (AMIs). This approach ensures consistency across environments and supports compliance with infrastructure-as-code practices.

Modular & Consistent Deployment

Infrastructure templates and application code are version-controlled in Bitbucket. Configuration values are parameterized and retrieved dynamically from AWS Systems Manager Parameter Store. This enables reusable deployment patterns that adapt cleanly to each environment without duplicating logic.

Scalable & Redundant Architecture

The emPOWER application is deployed using a three-tier architecture. EC2 instances are grouped in Auto Scaling Groups behind Application Load Balancers (ALBs). The application backend uses DynamoDB for relational and NoSQL data storage. Static assets are hosted in Amazon S3 and served via CloudFront for high-performance global access. All compute resources are deployed across multiple Availability Zones for high availability.

Secure Access & Monitoring

Access to AWS resources is secured using IAM roles with least-privilege permissions. Sensitive values are stored as SecureString parameters encrypted via AWS KMS. Logs are stored in CloudWatch and streamed to Splunk for long-term analysis and security monitoring. CloudWatch Alarms notify the SA team and other stakeholders of system performance or import issues.

Data Import & Operational Resilience

Lambda functions, triggered by SNS, process incoming CMS data and write it to S3. The Lambda pipeline includes built-in retries and logs all activity to CloudWatch. Versioned S3 buckets ensure that data is not lost, and monthly restore tests in staging confirm recoverability.

Google Analytics is integrated into the front-end to monitor user behavior—such as search patterns, file downloads, and regional access trends—to inform usability improvements.

Outcomes and Results:

The emPOWER platform is a nationally recognized resource used by emergency planners, public health officials, and first responders across all 50 states, the District of Columbia, and U.S. territories. It enables secure access to de-identified CMS data to help identify individuals who rely on electricity-dependent Durable Medical Equipment (DME), particularly during disasters and power outages.

Public health authorities and their partners have used the emPOWER Map application to perform many emergency preparedness and response activities, including:

Identifying at-risk populations in areas impacted by disasters
Enhancing situational awareness for severe weather events
Supporting sheltering and transportation coordination
Prioritizing power restoration for electricity-dependent individuals
Assisting with evacuation planning and outreach to at-risk populations

Some specific highlights of life-saving activities include:

Conducting outreach to over 50,000 electricity-dependent Medicare beneficiaries during major hurricanes, wildfires, and other disasters using the emPOWER Emergency Response Outreach Dataset.
Supporting the evacuation of electricity-dependent individuals during California wildfires and Hurricanes Harvey, Irma, Maria, Florence, Laura, Ida, and Fiona.
Informing planning and response activities for Tropical Storm Barry, multiple Nor’easters, and the 2021 Texas winter storms.
Assisting the placement of at-risk individuals in heated shelters during power outages in extreme cold weather.
Identifying and supporting individuals who rely on life-sustaining oxygen equipment during COVID-19 response efforts.
Helping utility companies prioritize power restoration for neighborhoods with high concentrations of DME users.
Enabling state and local officials to identify service needs during planned public safety power shutoffs (PSPS) in high-risk wildfire areas.
The city of New Orleans, LA made informed decisions about the locations of emergency shelters for at-risk populations.
The state of New Jersey developed a Geographic Information System (GIS)-based tool using emPOWER data to support local emergency response.
The state of Florida integrated emPOWER into its data visualization tools to support rapid and targeted emergency planning and decision-making.
The U.S. Virgin Islands used emPOWER data to develop its first all-hazards disaster preparedness and response plan for electricity-dependent individuals.

emPOWER’s AWS-based architecture ensures high availability, fault tolerance, and automation. Terraform and Jenkins pipelines support consistent deployments across environments. CloudWatch Alarms notify the SA team when issues arise. Monthly backup restore testing confirms data resiliency.

Google Analytics provides insight into how users engage with the platform. CTAC uses this data to improve usability by monitoring download activity, frequently searched regions, and engagement trends.

Through this work, CTAC has delivered a scalable, secure, and resilient system that supports real-time emergency planning and saves lives.

Press:

Lessons Learned

CTAC and ASPR have continued to evolve the emPOWER Planning Platform in response to real-world emergencies and ongoing stakeholder engagement. Several important lessons have emerged throughout the platform’s development, deployment, and continuous operation:

Collaboration across federal, state, and local stakeholders is essential to ensure the data is understandable and actionable.
De-identified data can be highly effective in supporting life-saving interventions when paired with appropriate tools and training.
Cloud-native services such as AWS enable rapid scaling and high availability during times of increased demand.
Automation and infrastructure-as-code support consistent deployments and reduce risk during maintenance and recovery.
Continuous user engagement, combined with usage analytics, drives iterative improvements that strengthen usability and impact.
Compliance with NIST security and privacy guidelines is critical to ensuring continued operation within federal environments.
The ATO renewal process benefits from a strong security posture that includes role-based IAM access, encryption, audit logging, and incident response testing.

These lessons continue to inform enhancements to the emPOWER platform and serve as best practices for building future public health preparedness systems.

Conclusion

The emPOWER Planning Platform demonstrates how secure, cloud-based technologies can strengthen national emergency preparedness and response capabilities. By integrating de-identified CMS data with scalable AWS infrastructure, CTAC and ASPR have delivered a resilient solution that protects medically vulnerable populations during disasters.

Through continuous iteration, automation, and user engagement, emPOWER has become a trusted resource for planners and responders at every level of government. Its architecture, compliance alignment, and proven impact offer a model for future public health data platforms.