Decision
Regulated workloads, including HIPAA workloads, will be hosted in Azure Commercial.
Required security, identity, monitoring, networking, data protection, and governance controls will be implemented through approved standards and architecture patterns.
Azure Government will be considered only when a specific requirement cannot be met through Azure Commercial.
Technical Reasoning
Azure Commercial provides the services, capabilities, and security controls required to support regulated workloads while maintaining alignment with University cloud strategy, operational practices, and platform engineering investments.
Using a single cloud environment reduces operational complexity, improves consistency, simplifies service delivery, and allows governance, automation, and architecture patterns to be applied uniformly across workloads.
Consequences
HIPAA and other regulated workloads will use approved hosting patterns developed for Azure Commercial.
Security, compliance, and operational controls must be implemented through standards, architecture patterns, and automation before workloads are approved for production use.
Workloads requiring Azure Government must provide documented business, regulatory, or contractual justification.
Governance & Compliance
This ADR establishes the hosting platform decision for regulated workloads.
Implementation requirements will be defined through related standards, including the HIPAA Hosting Standard, and through approved architecture patterns such as the HIPAA Landing Zone Pattern.
Strategic Alignment
- Consistency
- Standardization
- Operational Sustainability