By: Kari Baldonado Lander, Vice President and General Manager, Artera Government Solutions
There’s an active conversation happening in Washington about the future of FedRAMP — whether the bar is too high, whether the process takes too long, and whether there’s a faster path to secure cloud adoption. Those are fair questions, and we welcome the dialogue.
For us at Artera, the conversation has always been less about the requirement and more about the reason behind it. FedRAMP Class D Certification (previously known as FedRAMP High) represents the highest standard of trust that the federal government places on a cloud platform. And when the people you serve include veterans, service members, and tribal communities — people who have already given so much — earning that trust feels less like a compliance exercise and more like a responsibility.
And while that certification lives in our federal environment, the discipline behind it runs through everything we build. The work we did to clear this bar has reshaped how we serve every customer — whether a federal agency, specialty organization, health system, or FQHC.
What FedRAMP Class D Certification means
FedRAMP Class D is the federal government’s most rigorous security standard for cloud services — more than 400 security controls spanning access management, encryption, physical security, incident response, and more, validated by an independent third-party assessor (3PAO). Fewer than 100 companies in the world hold it.
Artera Harmony Federal Edition is among the first patient communication platforms to achieve this certification.
But what matters most isn’t the number of controls — it’s what they protect. Federal healthcare systems hold some of the most sensitive patient information in the country: service-connected disabilities, behavioral health records, tribal health data. These aren’t abstract data points. They represent real people in moments of vulnerability, and they deserve infrastructure built with that weight in mind.
Trust is the point, not just compliance
Healthcare is the most targeted sector for cyberattacks in the U.S. That reality alone makes a strong case for rigorous security standards. But beyond the threat landscape, there’s something more fundamental: the relationship between a healthcare system and the people it serves is built on trust. Every message sent, every appointment reminder, every callback — each one carries an implicit promise that the information behind it is safe.
FedRAMP Class D is how we honor that promise – and not only for federal agencies. The majority of its controls now run through our commercial delivery and pipeline, too. While it isn’t FedRAMP in name for every customer, these rigorous controls and protections now apply across the board.
That commitment runs deepest where the stakes are highest. Artera Government Solutions (AGS), an Artera business unit, supports patient communication technology across the Department of Veterans Affairs, the Department of Defense, Indian Health Services sites. With FedRAMP Certification now in place, AGS can deepen these partnerships and expand its reach across federal healthcare.
And this also matters well beyond compliance. In an era when nearly every vendor claims AI can do anything, the harder question is who healthcare organizations can trust with their patients’ most sensitive information. Security has always been our baseline, and FedRAMP Class D is the clearest proof yet of a standard we hold for everyone we serve.
What it took to get here
What I’m most proud of is what the process brought out in our team. It raised the bar for how we operate and how we think about the people on the other end of our technology. That kind of discipline doesn’t end when the audit does — it becomes part of how you show up every day. The journey changed us:
- “In Process” status in August 2025
- Authority to Operate (ATO) in February 2026
- Full Authorization in May 2026
When the authorization came through, someone asked if I was proud. The honest answer is yes — deeply. But not because of the milestone itself. Because of who it’s for.
The veteran waiting on a callback. The family navigating a new appointment. They may never know about FedRAMP or the hundreds of controls behind their experience. They shouldn’t have to. They should just be able to trust that they’re being cared for — securely, every time.
That’s why we believe the standard matters. And that’s why we’ll keep holding ourselves to it.
