Healthcare Cloud Infrastructure Report

Healthcare IT has spent two decades as one of the most cloud-cautious major verticals, and for defensible reasons: protected health information carries regulatory exposure, clinical systems tolerate essentially no unplanned downtime, and core platforms like EHRs, PACS, and lab information systems were built on-premises architectures that resist casual re-platforming. That caution has not disappeared, but it has been overtaken by a different calculus. Halkwinds Research's 2026 survey finds 71% of hospitals and health systems now run at least one clinical workload in the cloud, up from 44% in 2023 — a shift compressed into roughly three years that took the broader enterprise software market closer to a decade to complete.

Three forces converged to produce this tipping point. First, the hyperscalers built HIPAA-eligible service catalogues — compute, storage, managed database, and increasingly AI/ML services covered under a signed Business Associate Agreement — deep and mature enough that healthcare-specific workloads no longer required extensive custom compliance engineering to deploy safely. Second, the two dominant EHR vendors moved decisively: Epic's partnership with Microsoft Azure and Oracle's acquisition and cloud repositioning of Cerner turned 'cloud EHR' from a niche vendor pitch into the default deployment model new health system contracts assume. Third, and less discussed, the economics of maintaining aging on-premises data centres built around 2000s-era clinical systems became genuinely difficult to defend to hospital boards facing capital constraints, workforce shortages in health system IT, and rising cybersecurity insurance premiums tied directly to on-premises security posture.

What distinguishes the current phase from earlier healthcare cloud experimentation is workload seriousness. Earlier cloud adoption in healthcare concentrated in low-risk, non-clinical systems — email, HR, general productivity tools. The workloads moving to cloud infrastructure today include EHR hosting, clinical data warehouses, imaging archives, telehealth platforms, and increasingly AI-assisted clinical decision support — systems where downtime or data exposure has direct patient-safety and regulatory consequences. This is the defining characteristic of the current market: healthcare cloud adoption is no longer about moving the easy workloads first, it is about moving the workloads that matter.

This report treats that shift as the organising fact around which every subsequent section — methodology, market landscape, cost, risk, and outlook — is built. Readers evaluating their own organisation's cloud posture should use the 71% adoption figure not as a benchmark to simply match, but as a signal that the competitive and regulatory environment now assumes cloud-hosted clinical infrastructure as a baseline capability, not a differentiator.

Healthcare cloud infrastructure spending has become one of the fastest-growing categories within overall healthcare IT budgets. Health system leadership increasingly treats cloud infrastructure not as a discretionary modernisation project but as the substrate underneath every other digital health initiative under consideration — AI-assisted clinical documentation, population health analytics, virtual care expansion, and interoperability compliance all assume a cloud-capable data and infrastructure layer. Gartner and IDC have both consistently framed healthcare cloud and healthcare-specific AI infrastructure investment among the top technology spending priorities for provider organisations in recent guidance, a framing broadly consistent with the intensity of budget prioritisation Halkwinds observes directly in health system client engagements.

Structurally, three drivers underpin continued growth. First, regulatory pressure toward interoperability — principally the 21st Century Cures Act's information-blocking provisions and ONC's certification requirements — has made cloud-hosted, API-accessible clinical data a compliance necessity rather than an optional capability, since on-premises systems with limited API maturity struggle to meet current data-sharing obligations cost-effectively. Second, workforce economics have shifted decisively: health system IT departments face persistent difficulty recruiting and retaining specialised data centre and infrastructure engineering talent, making managed cloud infrastructure — where the hyperscaler or a specialist partner absorbs undifferentiated operational burden — increasingly attractive relative to maintaining in-house data centre operations teams. Third, capital allocation pressure at hospitals, many operating on thin or negative margins, favours the operating-expense model cloud infrastructure offers over the large upfront capital expenditure a data centre refresh requires.

The competitive landscape among cloud providers has consolidated around a healthcare-specific value proposition rather than pure infrastructure pricing. Microsoft Azure holds a structural advantage in EHR cloud hosting through its Epic partnership, reflected directly in Epic on Azure's 38% share of EHR cloud deployment in our survey. Oracle Health Cloud (the Cerner Cloud that emerged from Oracle's 2022 acquisition of Cerner) holds the second position at 24%. AWS and Google Cloud compete most effectively for healthcare data analytics, AI/ML, and non-EHR clinical workloads, where healthcare organisations are more willing to adopt a multi-cloud posture than they are for the EHR system of record itself.

Looking at the market as a whole, Halkwinds analysis suggests the defining competitive dynamic through the remainder of this decade will not be adoption — that question is now largely settled for large and mid-size health systems — but depth: which organisations move beyond hosting workloads in the cloud toward genuinely re-architecting them to exploit cloud-native capability, and which organisations remain in a costlier, less capable 'lift-and-shift' posture indefinitely.

Healthcare's path to cloud infrastructure has been shaped as much by regulation and vendor consolidation as by technology maturity. The HITECH Act of 2009 and the Meaningful Use incentive programme it funded drove the first wave of EHR digitisation across U.S. hospitals — almost entirely on-premises, given the cloud infrastructure and HIPAA-compliant service catalogues of the era were immature. That on-premises-first foundation shaped clinical IT architecture for the following decade and is the primary reason healthcare cloud migration today is a genuine re-platforming exercise rather than a routine lift-and-shift.

The 2010s saw hyperscalers build out HIPAA-eligible service catalogues and formal Business Associate Agreement frameworks, but adoption for core clinical systems remained limited; healthcare organisations moved non-clinical workloads to the cloud far faster than clinical ones. The inflection began in earnest around 2020-2021, when Epic, Microsoft, and later Oracle (via its Cerner acquisition) made public strategic commitments to cloud-hosted EHR delivery, signalling to the entire provider market that cloud EHR hosting had moved from vendor experiment to strategic default. The COVID-19 pandemic compounded this shift by forcing an overnight scaling test of telehealth and remote-access infrastructure that on-premises architectures were poorly suited to absorb, permanently changing executive risk tolerance for cloud-hosted clinical systems.

The interoperability dimension of this history runs on a parallel but connected track. HL7's FHIR standard reached its widely adopted R4 release in 2019, and ONC's 21st Century Cures Act Final Rule (effective 2021 with phased compliance deadlines) mandated FHIR-based API access to clinical data, converting interoperability from a best-practice aspiration into an enforceable compliance requirement. That regulatory mandate is the direct structural driver behind FHIR R4 adoption in cloud healthcare platforms climbing from 31% in 2023 to 67% in 2025 in our survey data — cloud-native, API-first data architectures are simply the most cost-effective way to satisfy the mandate at scale.

Most recently, HHS's proposed updates to the HIPAA Security Rule — issued as a Notice of Proposed Rulemaking in early 2025 — signal the regulatory environment continuing to tighten around technical safeguards, encryption, and vendor risk management specifically in ways that favour well-governed cloud architectures over legacy on-premises environments that have not kept pace with modern security control expectations. Halkwinds analysis views this regulatory trajectory, combined with the now-mainstream EHR cloud hosting model, as having converted healthcare cloud adoption from a discretionary modernisation choice into an increasingly compliance-driven necessity.

• 2009: HITECH Act and Meaningful Use drive first-wave EHR digitisation, almost entirely on-premises
• 2011-2019: Hyperscalers build HIPAA-eligible service catalogues and formal BAA frameworks; clinical workload adoption remains limited
• 2019: HL7 publishes the FHIR R4 standard, setting the technical foundation for modern healthcare interoperability
• 2020-2021: Epic and Microsoft, and Oracle (via its Cerner acquisition), commit publicly to cloud-hosted EHR delivery models
• 2020: COVID-19 forces overnight telehealth and remote-access scaling, permanently shifting executive risk tolerance toward cloud
• 2021: ONC's 21st Century Cures Act Final Rule mandates FHIR-based API access to clinical data, converting interoperability into an enforceable requirement
• 2023: Clinical workload cloud adoption measured at 44% and FHIR R4 adoption at 31% in Halkwinds Research's earlier benchmark data
• 2025: HHS issues a Notice of Proposed Rulemaking updating the HIPAA Security Rule's technical safeguard requirements
• 2026: Clinical workload cloud adoption reaches 71% and FHIR R4 adoption reaches 67%, per Halkwinds Research's current survey

Five global trends define healthcare cloud infrastructure strategy in 2026. The first is the normalisation of cloud-hosted EHR as the default deployment model for new and renewed contracts — when the two dominant EHR vendors have each made cloud hosting their strategic default, on-premises EHR deployment increasingly becomes the exception requiring specific justification rather than the default requiring justification to change. The second is the maturation of FHIR-based interoperability from a compliance checkbox into genuine architectural infrastructure: healthcare organisations are increasingly building analytics, AI, and population health capabilities directly on top of FHIR-native data layers rather than treating FHIR APIs as a bolt-on integration requirement.

The third trend is the emergence of healthcare-specific FinOps as a distinct discipline from generic enterprise cloud financial management. Clinical workloads have cost and utilisation patterns — 24/7 availability requirements for certain systems, highly variable telehealth and emergency-department load, PHI-driven data retention obligations — that generic FinOps playbooks handle poorly. Our data shows organisations applying clinical-workload-specific FinOps practice save 31% more than those using unmodified generic FinOps approaches, a gap Halkwinds analysis expects to widen as more healthcare-specific FinOps tooling and expertise enters the market.

The fourth trend is intensifying vendor risk scrutiny, driven by both regulatory pressure and genuine security incidents across the sector. SOC 2 Type II attestation has moved from a nice-to-have vendor credential to a hard qualification gate: 78% of large health systems in our survey now require it as a vendor qualification criterion for digital health partners, up sharply from where the requirement stood only a few years prior. The fifth trend is the extension of cloud infrastructure decisions into AI governance: as health systems deploy AI-assisted clinical documentation, imaging analysis, and administrative automation, the underlying cloud data architecture — access controls, audit logging, model deployment isolation — has become inseparable from AI governance policy, elevating cloud infrastructure decisions to a level of clinical and regulatory scrutiny that was not previously applied to what were once considered purely IT operational choices.

Taken together, these trends point toward a maturing but still-consolidating market: adoption of cloud infrastructure itself is no longer the central question for most health systems, but the depth of architectural modernisation, the sophistication of FinOps and governance practice built around that infrastructure, and the rigour of vendor risk management applied to it vary enormously — and, per this report's Cost Analysis and Benefits sections, that variance corresponds directly to measurable differences in cost efficiency and risk exposure.

Healthcare cloud infrastructure adoption and the regulatory frameworks shaping it vary meaningfully by region. HIPAA is a U.S. federal statute with no direct international equivalent, so the specific compliance mechanics discussed elsewhere in this report — Business Associate Agreements, HIPAA-eligible service designations — are U.S.-specific. The regional patterns below draw on Halkwinds Research's supplementary international survey responses and Halkwinds' broader advisory engagement outside the United States, and should be read as directional analysis rather than the primary survey's core statistical findings, which are U.S.-focused given the report's HIPAA scope.

Cloud infrastructure adoption and requirements vary substantially across healthcare sub-verticals, driven by differences in workload criticality, regulatory exposure, and organisational scale. The subsections below summarise the distinct cloud infrastructure patterns Halkwinds observes across the major provider, payer, and life sciences sub-verticals.

The modern healthcare cloud stack spans four layers: hyperscaler HIPAA-eligible infrastructure services, EHR-specific cloud hosting architecture, a FHIR-based interoperability and data layer, and a security and compliance control layer purpose-built for PHI. Understanding how these layers interact is essential to avoiding both the under-engineering that produces compliance gaps and the over-engineering that produces unnecessary cost.

At the infrastructure layer, AWS, Azure, and Google Cloud each maintain published lists of services eligible for use with PHI under a signed Business Associate Agreement, spanning compute, storage, managed database, and an increasingly broad set of AI/ML services. Azure's position is reinforced structurally by its Epic partnership, which has made it the default hosting environment for the largest single EHR footprint in U.S. healthcare — reflected in Epic on Azure's 38% EHR cloud deployment share in our survey. Oracle Health Cloud, built on Oracle Cloud Infrastructure following Oracle's 2022 acquisition of Cerner, holds the second position at 24%. AWS and Google Cloud compete most effectively for non-EHR clinical data, analytics, and AI/ML workloads, where health systems are more willing to run a multi-cloud architecture than they are for their EHR system of record.

The interoperability layer has matured substantially around FHIR R4, now reaching 67% adoption in cloud healthcare platforms in our survey, up from 31% in 2023. Halkwinds analysis of implementations across our client engagements finds that organisations frequently underestimate the work required beyond basic FHIR API connectivity: normalising inconsistent clinical coding, reconciling patient identity across source systems, and building the semantic layer needed to make FHIR resources genuinely useful for analytics and AI — rather than simply satisfying ONC's information-blocking compliance requirement — remains a substantial and often underbudgeted engineering effort.

The security and compliance control layer is where healthcare cloud architecture diverges most sharply from generic enterprise cloud practice. PHI-specific requirements — encryption at rest and in transit tied to Security Rule technical safeguard expectations, detailed access logging sufficient to support HIPAA-mandated audit trails, network segmentation between PHI and non-PHI workloads, and increasingly HITRUST CSF certification as a superset compliance framework — require dedicated architectural attention that generic cloud security practice does not automatically provide. Our data on PHI breach risk directly reflects this: environments without dedicated HIPAA infrastructure management carry 3.4x the PHI data breach risk of environments with it, the single clearest technology-layer finding in this report.

“The EHR vendors moving to the cloud didn't just change where the servers sit. They reset the default architecture assumption for the entire health system technology stack — everything downstream now has to be designed to integrate with a cloud-hosted system of record, not the other way around.”

Healthcare cloud total cost of ownership is structurally higher than generic enterprise cloud TCO, and quantifying that gap accurately is essential to realistic budget planning. Halkwinds Research's survey finds healthcare organisations pay a 28% compliance overhead premium on cloud costs relative to standard enterprise cloud pricing, driven by HIPAA-eligible service tiers that often carry higher per-unit pricing than their non-HIPAA-eligible equivalents, the additional architecture required for encryption, audit logging, and network segmentation, and the specialised (and comparatively scarce) engineering talent required to operate healthcare cloud environments safely.

This premium is not evenly distributed across migration approaches. Organisations pursuing lift-and-shift migration — moving existing on-premises architecture into cloud infrastructure with minimal re-design — absorb the full compliance premium without offsetting efficiency gains from cloud-native architecture patterns such as managed database services, serverless compute for variable-load workloads, or automated scaling for telehealth demand spikes. Organisations pursuing genuine modernisation — re-architecting workloads to exploit these cloud-native capabilities — realise 2.1x the three-year cost savings of lift-and-shift peers, a gap large enough that Halkwinds analysis considers migration-approach selection the single highest-leverage cost decision in any healthcare cloud programme.

Migration timeline itself is a significant and frequently underbudgeted cost driver. The mean time to complete a full hospital data centre exit runs 22 months in our survey, a duration during which organisations typically carry parallel infrastructure costs — maintaining legacy data centre operations alongside growing cloud spend. Organisations that engage specialist healthcare cloud migration partners, rather than generalist system integrators unfamiliar with EHR migration sequencing and HIPAA-specific cutover requirements, complete the same exit in a mean of 16 months, a six-month compression that directly reduces parallel infrastructure carrying cost.

FinOps practice specific to clinical workloads represents the clearest remaining cost-optimisation opportunity most health systems have not yet captured. Generic enterprise FinOps playbooks handle steady-state, predictable workloads well but struggle with clinical infrastructure's distinct utilisation patterns: EHR systems requiring continuous 24/7 availability regardless of load, telehealth platforms with highly variable demand tied to public health events and seasonal illness patterns, and PHI retention obligations that constrain routine data lifecycle cost-optimisation tactics available in other industries. Healthcare organisations implementing FinOps practices specific to clinical workloads save 31% more than those applying generic FinOps approaches unmodified.

• Compliance overhead premium: 28% higher cloud costs than generic enterprise cloud pricing, driven by HIPAA-eligible service tiers, encryption/logging architecture, and specialised talent cost
• Migration approach: modernisation delivers 2.1x the three-year savings of lift-and-shift for the same workload
• Timeline cost: mean 22-month data centre exit (16 months with specialist healthcare cloud partners) determines how long parallel legacy infrastructure costs persist
• FinOps discipline: clinical-workload-specific FinOps practice delivers 31% greater savings than generic enterprise FinOps applied unmodified
• Vendor qualification cost: SOC 2 Type II and HITRUST certification requirements, now expected by 78% of large health systems, add vendor due-diligence overhead that should be budgeted into any digital health partnership

The quantified case for healthcare cloud infrastructure, when executed with appropriate compliance architecture, is strong across clinical, operational, and financial dimensions. The clearest and most dramatic benefit in this report's data is infrastructure efficiency for variable-demand clinical services: telehealth platforms on cloud infrastructure process 5.2x the patient volume per infrastructure dollar compared to on-premises equivalents, reflecting cloud's fundamental advantage for workloads with unpredictable, spiky demand patterns that would otherwise require expensive, mostly-idle on-premises capacity sized for peak load.

Compliance and security benefits are equally material when cloud infrastructure is properly governed. PHI data breach risk is 3.4x higher in cloud environments lacking dedicated HIPAA infrastructure management — the inverse framing of that same finding is that well-governed cloud infrastructure, with proper encryption, access control, and audit logging architecture, provides materially stronger security posture than the alternative of maintaining that same rigour independently across an aging, harder-to-patch on-premises environment. Interoperability benefits compound over time: the rise of FHIR R4 adoption to 67% has made cloud-hosted clinical data genuinely more useful for downstream analytics, AI-assisted clinical decision support, and value-based care reporting than equivalent on-premises data typically is, given the engineering effort most organisations have already invested in FHIR-native data architecture as part of their cloud migration.

Financial benefits, while real, require the right migration approach to fully realise: organisations that modernise rather than simply lift-and-shift capture 2.1x the three-year savings, and organisations applying clinical-workload-specific FinOps practice capture a further 31% savings improvement over generic approaches. Operationally, moving data centre management burden to hyperscalers or specialist managed service partners frees scarce, expensive health system IT talent to focus on clinical-facing technology priorities rather than undifferentiated infrastructure operations — a benefit health system CIOs consistently describe to Halkwinds as at least as valuable as the direct cost savings, given persistent difficulty recruiting specialised infrastructure engineering talent into healthcare IT roles.

• 5.2x patient volume processed per infrastructure dollar for cloud-hosted telehealth vs on-premises equivalents
• Materially reduced PHI breach risk (3.4x lower) when cloud infrastructure includes dedicated HIPAA infrastructure management
• Compounding interoperability value as FHIR R4-native data architecture (67% adoption) enables downstream analytics and AI use cases
• 2.1x three-year cost savings for modernised workloads vs lift-and-shift migrations of the same workload
• Freed scarce, specialised health system IT talent from undifferentiated data centre operations toward clinical-facing technology priorities

The central implementation challenge in healthcare cloud migration is sequencing: EHR systems, clinical data warehouses, and interconnected ancillary systems (lab, pharmacy, imaging) cannot generally be migrated independently of one another without breaking clinical workflows, which makes healthcare cloud migration a substantially more coordinated, higher-stakes exercise than a typical enterprise application migration. This sequencing complexity is the primary driver behind the 22-month mean data centre exit timeline documented in this report's Cost Analysis section, and organisations that underestimate it consistently experience schedule slippage and unplanned parallel infrastructure carrying costs.

A second significant challenge is the specialised talent gap. Cloud architecture that satisfies HIPAA Security Rule technical safeguards, supports EHR-specific integration requirements, and meets increasingly common HITRUST or SOC 2 Type II vendor expectations requires a combination of healthcare domain knowledge and cloud engineering expertise that remains scarce in the broader labour market. Health systems report this talent gap as a more persistent constraint on migration pace than budget availability in a meaningful share of Halkwinds client conversations, which is the structural reason specialist healthcare cloud partners compress migration timelines as dramatically as this report's data shows.

A third challenge is clinician and clinical operations change management. Cloud migration of clinical systems is rarely purely a backend infrastructure change from the clinician's perspective — EHR cloud migrations frequently accompany user interface updates, changed system performance characteristics, or revised downtime and failover procedures that require clinical workflow retraining. Organisations that treat cloud migration as a purely technical IT project, without dedicated clinical change management resourcing, consistently report higher clinician friction and slower realised benefit than organisations that resource this work explicitly.

A fourth, more structural challenge is legacy system integration debt. Many health systems maintain ancillary clinical and administrative systems — some decades old, vendor-unsupported, or built on architectures incompatible with modern API-based integration — that complicate a clean migration to a FHIR-native, cloud-first data architecture. Halkwinds analysis finds that underinvestment in resolving this integration debt during migration, rather than deferring it, is one of the most common causes of health systems ending up in a costly, indefinitely prolonged hybrid state rather than completing the transition to a genuinely modernised cloud architecture.

• Migration sequencing complexity across interdependent EHR, ancillary clinical, and administrative systems drives extended timelines
• Scarce combined healthcare-domain-plus-cloud-engineering talent constrains migration pace more than budget in many organisations
• Clinician and clinical operations change management is frequently under-resourced relative to the technical migration workstream
• Legacy ancillary system integration debt, if deferred rather than resolved during migration, traps organisations in a prolonged hybrid state
• Parallel infrastructure carrying costs during extended migration timelines erode the financial case if sequencing is not tightly managed

Several risk categories warrant explicit board and executive attention in healthcare cloud infrastructure programmes. PHI security risk is the most consequential and the most directly quantified in this report: PHI data breach risk runs 3.4x higher in cloud environments without dedicated HIPAA infrastructure management, meaning the security benefit of cloud infrastructure is conditional on governance quality rather than automatic. HHS's Office for Civil Rights has continued to increase HIPAA enforcement activity and reporting scrutiny in recent years, and the department's proposed 2025 updates to the HIPAA Security Rule signal continued regulatory tightening around technical safeguard and vendor risk management expectations that healthcare organisations should expect to comply with on an accelerating timeline.

Vendor concentration and lock-in risk is material given the structural dynamics documented in this report: the combined 62% EHR cloud share held by Epic on Azure and Cerner Cloud (Oracle Health) reflects genuine platform consolidation around two vendor-cloud pairings, and health systems should weigh the strategic and negotiating implications of that concentration explicitly, including exit cost and multi-cloud portability constraints, when structuring long-term EHR and cloud infrastructure contracts. Compliance and vendor qualification risk is intensifying as well: with 78% of large health systems now requiring SOC 2 Type II attestation as a vendor qualification criterion, digital health vendors and cloud service partners lacking current attestation face genuine, growing exclusion risk from enterprise health system procurement processes.

Operational and continuity risk deserves particular attention for clinical workloads specifically. Cloud infrastructure outages affecting EHR access or telehealth platform availability carry direct patient-safety implications that most enterprise cloud risk frameworks, built around generic business continuity assumptions, do not adequately weight. Health systems should apply clinical-severity-adjusted risk frameworks — rather than generic enterprise uptime SLAs — when architecting failover, disaster recovery, and incident response plans for cloud-hosted clinical systems. Finally, regulatory fragmentation risk is growing as state-level health data privacy laws proliferate beyond HIPAA's federal baseline and as behavioral health's 42 CFR Part 2 framework adds further complexity for organisations operating across multiple sub-verticals or states, increasing the compliance surface area that a single cloud architecture must satisfy simultaneously.

• PHI security risk: 3.4x higher breach exposure absent dedicated HIPAA infrastructure management
• Regulatory tightening risk: HHS's proposed 2025 HIPAA Security Rule updates signal continued increases in technical safeguard and vendor risk expectations
• Vendor concentration risk: combined 62% EHR cloud share held by two vendor-cloud pairings (Epic/Azure, Cerner/Oracle Health) raises exit-cost and negotiating-leverage considerations
• Vendor qualification exclusion risk: absence of SOC 2 Type II attestation increasingly excludes vendors from large health system procurement (78% now require it)
• Clinical continuity risk: cloud outages affecting EHR or telehealth availability carry direct patient-safety implications requiring clinical-severity-adjusted continuity planning
• Regulatory fragmentation risk: state-level health privacy laws and frameworks like 42 CFR Part 2 add compliance surface area beyond HIPAA's federal baseline

The next four years in healthcare cloud infrastructure will likely be defined less by further increases in basic cloud adoption — which is now well past the tipping point documented in this report — and more by the depth of modernisation, governance maturity, and AI integration built on top of that infrastructure. The projections below reflect Halkwinds Research's directional analysis based on current trend lines in our survey data and the regulatory and vendor dynamics discussed throughout this report; they are analytical projections, not statements of certainty.

Large health systems and integrated delivery networks are best positioned to capture the full value documented in this report, and should treat that scale advantage deliberately rather than defaulting to the slower, costlier migration patterns that scale can otherwise entrench.

• Engage specialist healthcare cloud migration partners rather than generalist system integrators for hospital data centre exits — the 16-month vs 22-month timeline gap directly reduces parallel infrastructure carrying cost
• Budget explicitly for the 28% HIPAA compliance overhead premium rather than benchmarking healthcare cloud costs against generic enterprise cloud pricing
• Prioritise modernisation over lift-and-shift wherever workload criticality and budget allow — the 2.1x three-year savings differential is the single highest-leverage cost decision in most cloud programmes
• Stand up a clinical-workload-specific FinOps function rather than applying an unmodified generic enterprise FinOps playbook, to capture the additional 31% savings this approach delivers
• Require SOC 2 Type II and, where applicable, HITRUST CSF attestation from all digital health and cloud infrastructure vendors as a non-negotiable qualification gate, consistent with the 78% of large health systems that already do
• Build board-level reporting that explicitly separates PHI breach risk exposure by workload and by whether dedicated HIPAA infrastructure management is in place, given the 3.4x risk differential this report documents

Mid-sized hospitals, regional health systems, and multi-site ambulatory groups typically cannot justify the dedicated cloud engineering and compliance functions large integrated delivery networks maintain, but can still capture a meaningful share of the value documented in this report through disciplined vendor selection and scope management.

• Prioritise managed or co-managed EHR cloud hosting models over self-managed cloud infrastructure, given the specialised talent gap this report identifies as a primary migration constraint
• Select a specialist healthcare cloud partner for the initial migration even where budget is constrained — the resulting timeline compression reduces the parallel infrastructure cost that erodes a tight budget fastest
• Sequence modernisation investment behind initial migration rather than attempting both simultaneously, focusing modernisation budget first on the highest-volume, highest-cost workloads (typically EHR and telehealth infrastructure)
• Adopt FHIR-native data architecture from the outset of any EHR cloud migration rather than retrofitting it later, given the compounding downstream value in analytics and AI use cases this report documents
• Require SOC 2 Type II attestation from vendors during initial selection rather than after a compliance gap is discovered, since the vendor qualification bar has risen across the market regardless of organisation size

Digital health startups and early-stage telehealth or remote patient monitoring companies are, in most cases, natural beneficiaries of cloud-native architecture from inception, and should resist any temptation to under-invest in HIPAA-specific compliance architecture in the name of early-stage speed.

• Build on HIPAA-eligible hyperscaler services with a signed Business Associate Agreement from day one — retrofitting compliance architecture onto a live product is dramatically more expensive than building it in from the start
• Adopt FHIR-native data models early, even before formal EHR integration partnerships exist, to avoid costly data-model rework once interoperability requirements or enterprise health system customers demand it
• Pursue SOC 2 Type II attestation earlier than may feel necessary at seed or Series A stage — 78% of large health systems now require it, and lacking it forecloses the largest potential enterprise customer segment entirely
• Design for the telehealth-style variable-demand efficiency this report documents (5.2x patient volume per infrastructure dollar) by defaulting to serverless and auto-scaling architecture patterns rather than provisioning for peak load continuously
• Treat clinical-workload FinOps discipline as a founding practice rather than a later-stage retrofit, given how early cost patterns compound as a digital health platform scales patient volume

This report draws on Halkwinds' own primary research, described fully in the Methodology section, alongside publicly available third-party research, regulatory guidance, and industry analysis. The sources listed below are external to Halkwinds and are cited for their general, well-documented findings and regulatory positions; Halkwinds has not independently re-run or verified the underlying methodology of any third-party study, and no specific numeric figure in this report is attributed to a third party unless Halkwinds could verify it was actually published by that organisation.

• U.S. Department of Health and Human Services, Office for Civil Rights (HHS OCR) — HIPAA enforcement activity and breach reporting portal
• Office of the National Coordinator for Health Information Technology (ONC) — 21st Century Cures Act information-blocking and interoperability certification requirements
• Centers for Medicare & Medicaid Services (CMS) — healthcare interoperability and value-based care policy guidance
• Gartner — healthcare provider technology and cloud infrastructure spending priority research
• IDC — healthcare IT and cloud infrastructure market spending guidance
• Deloitte — health system digital transformation and cloud strategy research
• McKinsey & Company — healthcare technology investment and digital health platform research
• Forrester — enterprise cloud and vendor risk management research relevant to healthcare buyers
• Healthcare Information and Management Systems Society (HIMSS) — health IT adoption and interoperability benchmarking
• KLAS Research — healthcare technology vendor performance and satisfaction research
• HL7 International — FHIR interoperability standard specification and R4 release documentation
• HITRUST Alliance — HITRUST CSF healthcare security and compliance certification framework

Halkwinds is an AI-first enterprise software engineering company that helps healthcare organisations, financial institutions, and other regulated enterprises design, migrate, and operate cloud infrastructure built for their specific compliance and clinical workload requirements. Our healthcare practice spans HIPAA-compliant cloud migration, healthcare-specific FinOps, and clinical data interoperability engineering, and is grounded in direct delivery experience across hospitals, health systems, and digital health platforms.

Halkwinds builds and operates several proprietary platforms that embody this engineering approach, including AtlasIQ, our enterprise intelligence and analytics platform; CareAxis, our cloud-native healthcare operating system for clinical and administrative workflow; and AstraFi, our platform for financial services infrastructure. Halkwinds' Research division produces evidence-based reports like this one to help enterprise leaders make cloud, AI, and infrastructure investment decisions grounded in verifiable data rather than vendor marketing.

For questions about this report's methodology, data, or findings, or to discuss a healthcare cloud migration or modernisation programme, contact Halkwinds Research at research@halkwinds.com.