I have only limited experience in the healthcare space when it comes to cloud selection, but I can tell you that every single healthcare company I work with uses Azure.

They don't do it because it may or may not be right for their needs. They pick Azure because somewhere along the line the mid- and upper-level managers, including director-level IT people, have been made to believe that anything other than Windows is insecure and not suitable for HIPAA.

If I even mention the word "Linux" or "AWS" to them they immediately curl up in a little ball mentally and treat me like I'm some kind of evil script kiddie, or magical wizard. It's truly baffling the responses I get from people who are supposed to be in charge of these things.

I don't know these people outside of boardroom presentations, so I don't know how they got this way. My best guess is that it's either Microsoft salesmen, industry conferences, or simply what they're comfortable with and anything else is not worth risking their jobs.

Azure does appear to be quite wide-spread, I think microsoft has always been a very glom-y company with a very high network effect from using multiple of their products in tandem. The healthcare market isn't nearly as startup friendly as others and a lot of the movers and shakers directing company direction are likely to be more familiar with the business sides of things than pure dev folks - I think that naturally slides into an MSFT preference since those folks will be using all flavours of office and at least some portion of dev talent will need to be MSFT folks who can work Access/TSQL/VB magic and make the spreadsheets work.

Lastly, all three of AWS, Azure and GCS do try and make a big deal of their HIPAA compatible instances, but whatever the compliance officer at a company is used to is what will get by the easiest - honestly anyone who has a compliance officer that is happy to accept a non-on-premises solution should count themselves as lucky.

All that said - I'd be amazed if MSFT hasn't invested heavily into advertising to cement this decision, but I'd also be surprised if AWS hasn't been trying to dump even more money in there - google just seems a bit clueless when it comes to the convention game and these sort of closed circles where everyone plays golf on tuesdays.

>They pick Azure because somewhere along the line the mid- and upper-level managers, including director-level IT people, have been made to believe that anything other than Windows is insecure and not suitable for HIPAA.

I'd argue it's less because of a belief that a non-Windows environment is inherently insecure and more that Microsoft very aggressively promotes their products as being compliant with regulations like HIPAA.

This isn't limited to PaaS. For example, I think that Teams will likely gain a foothold in healthcare environments over Slack because MS markets Teams as explicitly HIPAA compliant. (Slack explicitly is not).

Things like that buy them a lot of mindshare when it comes time to choose a PaaS provider.

“Director-level IT” healthcare person here. We use AWS but are evaluating Azure because of the way Microsoft includes VDI in the form of Windows 10 Multi-Session licenses available only with Azure+Windows Virtual Desktop. Classic Microsoft bundle approach.

Oh, and Slack is available with HIPAA compliance — https://slack.com/help/articles/360020685594-slack-and-hipaa

Also, as someone who actively shops for SaaS offerings for healthcare users, I can say that AWS and Azure are some of the very, very few organizations who offer anything with HIPAA compliance that isn’t locked away at the most expensive “contact us for pricing” tier. It’s so annoying. Never a chance to try a service with a low cost/stakes pilot/prototype because they hit you with the full sales pitch and highest price points. Being able to dip our proverbial toe into AWS with a low time/dollar commitment was a huge win.

Side note: interesting point on trying services with low cost/stakes pilot/prototype. How would you expect to try things out? Would it be similar to online demos that many other SaaS companies employ?

note: I would love to connect with you to discover other's director level experiences. I'm relatively new in the healthcare space after spending awhile in finance and utilities. If you'd like to connect, see my email in-profile.

It'x a brilliant piece of marketing from MS, if you think about it. Many decision makers, even in spaces with HIPAA data, have no real idea what it entails. They are frightened of screwing it up.

What Microsoft sells is a "good enough" solution that speaks the right language for the decision makers. In turn, this makes their decision less risky while still satisficing the requirements.

Exactly. From the perspective of high level decision makers, PaaS is heading toward being a commodity good, so differentiating your platform can be what makes a deal and making regulatory compliance "easy" in heavily regulated industries can be a pretty strong differentiator.

If you have an existing business relationship with a company and already trust them to help you navigate regulatory hoops, there's going to be strong inclination to continue to trust them as you expand your infrastructure to the cloud.

Like you said, it's the kind of very smart, long-term marketing I tend to associate with "New"/Nadella Microsoft.

Like the new "Windows Terminal" project - EXCELLENT marketing strategies in recent years.

I still don't trust them, but credit where credit is due.

I encourage you to consider how your statement, "I don't trust Microsoft," sounds to a higher level exec or department head. I don't mean this as a criticism -- I notice there's a tendency for ICs to state their opinions in such a way that hurts their perception.

Namely, if you were to state to a higher level manager that you "don't trust Microsoft", you will come across as a crank. Or a developer who doesn't see the bigger picture.

To improve perception, folks should try to reframe their personal preferences ("I don't trust MS") as risks to the business - "I worry that MS will lock us in to their platform and jack up prices". The former is reputation-harming; the latter is being a savvy 2nd order thinker, who looks beyond just what the MS salesman says.

That would be the first reason I'd give to someone that questioned my "crank" statement.

The next one would be the PRISM connection (Skype architecture, etc), and FISA orders they're surely under.

It's not totally they're fault I don't trust them. Buuuuut, it is partly.

Definitely appreciate the feedback - lucky for me, I have removed myself from corporate tech bureaucracy, become self-employed, and can preach from my poor man's pulpit ;D

The company I work for does not deal with health-related data so I don't have direct exposure to the issues. But, I think there is something analogous happening with SOX compliance. It is a very expensive and slow bureaucracy that reacts very poorly to change. For example, once I was mortified to find out that due to me randomly logging in to some SOX-covered server, afterward there were multiple meetings between SOX people and my manager to justify that login. (Manager didn't tell me originally to shield me, I just happened to find out later). Any changes to SOX-covered systems have to go through many meetings with technically not very good SOX team.

As a result what we end up having is this shadow-structure/architecture at the company that is highly resistant to change, such that when new projects are discussed and designed, oftentimes decisions are made that are technically worse but save time due to not messing with the SOX structure.

I feel the Azure choice might be due to a similar phenomenon. Maybe the Azure people promise all sorts of out-of-the box HIPAA compliance and insurance and security etc. and the upper management is happy not having to deal with it. Price difference almost doesn't matter very much, if saving a few bucks means that you'll now have to hire and retain a team to design and maintain compliance in your AWS stack. I've no idea if this is actually what happens but it smells like it.

If you work for a company that must follow regulations, then you should be aware of your impact. You will learn this as you advance further in your career.. however this post was written as though the regulations are there to cause you grief, but that can't be further from the truth. Think of it like this, the Boeing team is finding out the hard way what happens when you skirt steps in a highly regulated field.

SOX is the standard for change management for financial companies to prevent shadow changes that could enable another Enron, Worldcom, or Adelphia style cooking-of-books financial scandal. The idea is that all changes should be fully analyzed for their impact. If a change is found to have been made without going through the controls process then a review and an emergency after-the-fact change record must be created. This leads me to believe you did not just login to a server, unless you weren't supposed to have access in the first place (separation of duties requirement), but actually made a modification to that server without an approved change.

All this means that the system is very resilient and will not suffer random outages but most importantly, in the SOX world, there is no avenue for malicious changes to be introduced to critical financial systems and their data.

If you’ve never encountered a brain-dead compliance process, you’ve had an extraordinarily lucky career.

Even good and thoughtful regulations get interpreted into nonsensical bureaucratic nightmares by some companies’ compliance departments. The implementations that add disproportionate friction usually don’t achieve the intended benefit either. It’s not people choosing a convenience vs. safety tradeoff. It’s just people who don’t understand the subject matter at all.

Having worked in a lab environment heavily subject to OSHA regulation, I think you are both correct. I've been personally subjected to brain-dead interpretations on multiple occasions, but I'm also absolutely certain that in the absence of any regulation the environment would have been absurdly dangerous. On the balance, I'll favor the regulation.

I would agree that this is the health _system_ sentiment, but not healthcare overall.

I work with hundreds of vendors and digital health organizations that deliver life critical software applications to health systems - and we host everything on AWS. Independent 3rd party HIPAA assessments + a HITRUST (not self assessed) certification goes a long way with hospitals now.

I think that's because before this whole cloud thing came about, Microsoft already had built the image as an enterprise software vendor. They provided hosted cloud solutions long back, then they invented hybrid solutions like Azure Stack and slowly and carefully eased their clients into Azure.

Also, Microsoft support for enterprise customers is just amazing. They have been deploying their own engineers to support enterprise customers in the past for their hosted clouds.

Cant mention much about security but Microsoft does open fewer lower level Apis compared to Linux. For example, it's impossible to do certain socket-level ops with Windows apis. So, in a sense I guess it makes Windows safer at least historically?

Windows and Office are Trojan horses for Azure. Microsoft does all sorts of SKU trickery at the time of Windows and Office license renewal to make it seem like you can't afford to NOT buy Azure from them.

The problem is, especially with Office, that it has no alternatives.Google Suite is a toy and any open source solution feels like someone chopped your hands off and sent you back to 90's..

How long has it been since you've used LibreOffice?

If lacking a ribbon interface makes you feel like someone chopped off your hands...take your hands off the mouse and put them on the keyboard, haha

I try them at least once or twice a year and always get to the point where I'm like: "Ok, where's my Excel". It's not the ribbon, it's the whole experience that is lacking. Also MS office products do integrate well with each other.

Have you tried SoftMaker FreeOffice? It's not libre, but I've heard good things about it.

I'm not surprised. Azure is the obvious choice at the enterprise level since it's MS makes it relatively easy to sync on-prem Active Directory into Azure AD.

I work in the public sector where we often pick Azure, but your reasoning for why we do it is wrong.

People are professionals, and these decisions are important and expensive enough that they are very rarely made by lower level management. Sure your CTO will advice the executives to go with Azure, but it’s not because he or she fears Linux, Azure runs a lot of Linux after all. It’s because of several business related reasons.

When you’re and enterprise sized organisation your IT staff probably knows Microsoft products. They are certified in them, and have worked on them for maybe decades. You probably also already run an Office365 platform, which means you probably already run things like Azure AD, which again means, that training and re-training costs will be millions lower if you stick with Microsoft rather than going with AWS, and Google is typically not even on the table because their support isn’t competitive with Microsoft or Amazon. Not only are there the training cost, but you will probably lose your best IT staff members if you don’t pick the technologies they like, and that’s really expensive in a world where some of the hardest IT people to hire are people who know how to manage an enterprise sized cloud setup.

Then there is the business relationship. We’ve worked with Microsoft for what? Three decades? And while the average Joe was making M$ jokes, they were the only company, aside from IBM, to take enterprise organisations with a lot of different business related needs serious. It’s hard to compete with that sort of history. Amazon actually does a great job with AWS now that they’ve realised just how much money is available in public sector cloud, but they’re still up against a business relationship where we know that we can call directly to Seattle when something breaks and that they will be on the phone with us all the way until it’s fixed. Not having the same relationship with Amazon is a huge risk factor in your strategic analysis, and that is something most enterprise organisations but especially the public sector is very careful with.

I don’t think I’ve ever heard a single argument to run Windows because it was safer than Linux, or any of the million other Internet armchair options on why the public sector wastes its money on Microsoft. The truth is a lot simpler, there is no alternative, and Microsoft is actually very good at selling software solutions as well as support to enterprise organisations. There is no actual alternative to office365, and 90% of the 300-500 applications/IT-systems you operate only run on Windows and have no alternatives available. Like we run a medical journal that keeps track of first graders vaccination history, it’s client only works on Windows and it’s backend is on a mainframe. We’d like to replace it, because only a few companies know how to operate mainframes, which means they can squeeze us on price, but no one has made a competing system, and that’s just one of a million such stories.

If the price difference isn’t significant, you’re going to have a very hard time competing with Microsoft if the enterprise organisation you’re selling to in anyway has to operate part of its backend in a lot of organisations.

That's a correct read of the article, but since that fact was self-reported by Epic it may not be the true cause of their withdrawal from GCS.

All that said, cross-cloud data links are relatively easy to establish - just like linking in data from someone else when everyone had on-premises servers.