Summary
The University of Arkansas will permit approved shared platform services to support HIPAA workloads when those services do not process, store, or expose protected health information (PHI).
Shared services may be consumed by regulated workloads when they satisfy approved security, governance, and operational requirements.
Body
Decision
HIPAA workloads may consume approved enterprise shared services that operate outside the HIPAA workload boundary.
Services that store, process, or provide direct access to PHI must be deployed within approved HIPAA hosting patterns.
Services providing identity, monitoring, management, governance, automation, or similar platform capabilities may be shared when approved through architecture standards and patterns.
Technical Reasoning
Duplicating common platform capabilities within every regulated environment increases cost, complexity, and operational overhead.
Many enterprise services provide supporting capabilities without handling regulated data directly. Allowing approved shared services enables consistency, improves operational efficiency, and reduces unnecessary duplication while maintaining appropriate workload isolation.
Consequences
Architecture patterns must identify which services are approved as shared services and which services must remain within the HIPAA workload boundary.
Workload teams may not assume that all shared services are automatically approved for use by HIPAA workloads.
Standards and architecture reviews must evaluate shared services before adoption.
Governance & Compliance
This ADR establishes the architectural approach for shared services supporting regulated workloads.
Implementation requirements and approved service classifications will be defined through related standards and architecture patterns.
Strategic Alignment
- Operational Sustainability
- Consistency
- Efficiency