Healthcare Cloud Migration Strategy: A 10-Step Checklist for CTOs

Healthcare cloud migrations carry a risk most migrations never face: a failed cutover can postpone treatment. A healthcare cloud migration strategy maps every system to the clinical service it supports, settles patient data contracts and risk assessments before anything moves, and rehearses rollback with clinical teams. 

With Windows Server 2016, NHS DSPT and HIPAA deadlines all landing in 2027, this checklist shows CTOs how to plan it. 

Why 2027 Is a Forcing Year for Healthcare Cloud Migration

Five deadlines and cost pressures shape any healthcare migration planned for the next 12 months.

VMware figures: survey of 302 IT decision-makers, January 2026, reported by CIO.com.

What this means: a migration scoped now can retire unsupported servers, avoid a VMware renewal and produce the evidence for the next DSPT submission in one programme.

Why Healthcare Migrations Carry Higher Stakes

A migration cutover is a planned outage of the systems clinicians depend on. The 2024 ransomware attack on Synnovis, a pathology provider for south-east London hospitals, shows what an unplanned loss of those systems costs. NHS England reported 10,152 acute outpatient appointments and 1,710 elective procedures postponed at King’s College Hospital and Guy’s and St Thomas’.

Patient data also carries the heaviest regulatory weight. It is special category data under UK GDPR and protected health information under HIPAA. The rules on where it can be stored are clearer than many teams assume:

US position: HHS guidance on HIPAA and cloud computing. 

UK position: 2018 joint guidance from DHSC, NHS England, NHS Digital and NHS Improvement. 

Cloud vs On-Premise: What Changes on the Balance Sheet

Moving to the cloud changes who controls spend and how quickly it moves:

• Forecasting changes. A fixed three-to-five-year refresh cycle becomes a monthly bill that moves with usage.
• Engineers set the budget. Every instance size, storage tier and test environment changes the invoice.
• Discounts require commitment. One- to three-year savings plans cut rates, yet more than half of organisations still pay on-demand prices.
• Waste surfaces late. Idle cloud resources bill by the hour and often go unnoticed until the monthly invoice.

The 29% problem: cloud decision-makers estimate 29% of IaaS and PaaS spend is wasted, the first rise in five years, according to Flexera’s 2026 State of the Cloud Report. Price the target state with right-sizing and commitments applied, add the parallel-run months, and name a cost owner for every workload. Step 5 covers how.

The 10-Step Cloud Migration Checklist

Each step ends with an output: the evidence that the step is done. In healthcare, most of those outputs also feed your DSPT submission and HIPAA documentation.

1. Write the Business Case in Numbers

Name a goal the board can audit: retire unsupported servers before 12 January 2027, exit a data centre by a date, cut run cost by a set percentage or meet a recovery target for clinical systems. Then baseline today’s total cost of ownership:

• staff time and support contracts
• licences, power and space
• the next hardware refresh you would otherwise fund

2. Map Every System to a Clinical Service

Server lists miss what breaks healthcare migrations: interfaces between clinical systems, batch jobs and hard-coded IP addresses. Run automated discovery (Azure Migrate, AWS Migration Evaluator or a third-party tool) for at least a month. Then record, for each workload, the clinical pathway it supports, the manual fallback and how long clinicians can safely work without it. Typical tiers:

• Minutes: EPR, pathology, PACS, e-prescribing
• Hours: booking, referrals, patient portals
• Days: HR, finance, reporting

3. Classify Patient Data and Decide Where It May Live

Separate identifiable, pseudonymised and fully de-identified data. The distinction changes your obligations: HHS states that a cloud provider receiving only properly de-identified data is not a business associate. Record a residency decision for each dataset, such as UK regions for NHS workloads and US regions for US workloads. Use the NHS Health and Social Care Cloud Risk Framework to set proportionate controls.

Output: a classification and residency register for every dataset.

4. Sign Contracts and Complete Risk Assessments Before Data Moves

No patient data moves until both sets are in place.

Contracts

• a BAA with the cloud provider and every subcontractor that touches ePHI (US)
• Article 28 processor terms and a written shared responsibility matrix (UK)
• the same terms with your migration partner, if its engineers can access patient data

Risk assessments

• a HIPAA risk analysis covering the new cloud configuration
• a data protection impact assessment (DPIA) under Article 35 UK GDPR
• a DCB0160 clinical risk assessment, owned by your Clinical Safety Officer, with an updated hazard log

5. Assign One of the 7 Rs to Every Workload

Give every workload one strategy and one reason, then check it against supplier support terms. An EPR or PACS configuration the supplier won’t support is a clinical risk in its own right.

Expect most of the estate to land in rehost, replatform and retire, with refactoring kept for a few strategic systems through app modernisation.

Output: a disposition table with one strategy, one rationale and supplier confirmation for every workload.

6. Build the Landing Zone in Code, With Controls On From Day One

Pick the provider on licensing, existing skills and where your data already lives. Then confirm every service in the design is covered by the provider’s BAA.

Define the landing zone in Terraform, Bicep or CloudFormation, with these controls switched on before the first workload arrives:

• encryption at rest and in transit, with customer-managed keys
• MFA and least privilege on every admin and remote access path
• network segmentation and central logging with defined retention
• continuous vulnerability scanning

These map to the proposed HIPAA controls and to the Cyber Assessment Framework (CAF) outcomes behind the DSPT.

7. Model the Run Cost Before Anything Moves

Model each wave’s monthly cost across five lines: right-sized compute, storage tiers, commitment discounts, egress, and the parallel-run months when you pay for both environments. Clinical systems often need longer parallel runs than back-office ones, so budget for them separately.

Enforce tags for owner, environment, cost centre and data classification before migration, and name a cost owner per application. At day 90, right-size on real usage and buy commitments for steady workloads.

Output: a per-wave cost model, a tagging policy enforced by the landing zone and a day-90 optimisation report. The six most common post-migration cost leaks are covered in Cloud Migration Not Working for Your Budget?

8. Test Clinical Integrations in a Pilot Wave

Healthcare systems rarely fail alone. They fail at the interfaces: HL7 v2 feeds, FHIR APIs, PAS-to-EPR messaging, and lab and radiology orders. Pick a low-risk, representative pilot. Run contract tests on every interface, load test at peak clinic times and run user acceptance testing with clinicians. Feed the results into the hazard log so the Clinical Safety Officer signs off on test evidence.

9. Rehearse Cutover and Rollback With Clinical Teams

Before each wave, agree with clinical operations and the change board:

1. the cutover window
2. ward downtime procedures, and who briefs staff
3. go/no-go criteria and the point of no return
4. a rollback path, rehearsed at least once

After cutover, reconcile data with record counts and checksums. Run a hypercare period with a direct route for clinical safety incidents. CI/CD pipelines make rehearsals repeatable.

Output: a cutover runbook with timed steps, named clinical and technical decision-makers and a tested rollback.

10. Prove Recovery and Hand Over an Evidence Pack

Time real restores against the downtime tolerances from Step 2, using immutable backups held in a separate account or tenant. The proposed HIPAA rule would expect critical systems to be restored within 72 hours. Include Microsoft 365 if referrals and clinical correspondence are stored there; Recoverable by Deployflow covers that layer.

The migration ends when your team can run and evidence the platform without the people who built it. The handover pack should include:

• architecture and data flow diagrams, and the asset inventory
• the three risk assessments and the hazard log
• test and restore results, access reviews and change audit trails
• runbooks and documented knowledge transfer

Output: a signed-off evidence pack mapped to DSPT assertions and HIPAA documentation requirements. Ongoing operations: cloud management.

Cloud Migration Tools Worth Knowing in 2026

Each provider offers native tooling for moving onto its own platform, plus a funding programme that can offset assessment and migration costs.

Before you sign a funding agreement:

• Check eligibility first. Funding depends on qualifying workloads and committed spend, so confirm it before agreeing to a statement of work.
• Tag before you migrate. MAP credits only apply to workloads tagged correctly ahead of migration.
• Watch expiry dates. Unused RaMP incentives expire 12 months after issue.

Check BAA coverage service by service. AWS, Azure and Google Cloud all sign BAAs, but each agreement covers a defined list of services. A managed database or AI service outside that list cannot hold ePHI. 

Complete the stack with Infrastructure as Code (Terraform, Bicep or CloudFormation) and a FinOps tool for cost visibility. CloudEndure and Migrate for Compute Engine, still listed in older guides, have been retired.

How Much Does Cloud Migration Cost?

Cloud migration cost depends on estate size, the mix of migration strategies and data volume, so per-server price lists rarely hold. What you control is which lines make it into the budget. Most overruns come from the ones left out.

One-Off Costs

• Assessment and planning: discovery, business case and disposition. Often assumed to be free pre-sales work.
• Migration labour: engineering time per wave. Grows when refactoring scope creeps mid-project.
• Parallel run: paying for on-premise and cloud at once. Every slipped cutover extends it.
• Training and change: upskilling teams and adapting processes. Usually missing from the business case.
• Clinical safety and assurance: Clinical Safety Officer time, the DPIA, hazard log updates and DSPT evidence. Rarely costed upfront.
• Supplier fees: EPR and PACS suppliers may charge to support or approve a cloud-hosted configuration.

Ongoing Costs

• Licensing: moving licences or buying cloud editions. Portability rules vary by vendor and product.
• Data transfer: inbound transfer is usually free, while egress to users and integrations is billed every month.
• Optimisation: right-sizing, commitments and cleanup. Needs a named owner and a schedule.

Budget rule: migrations average 14% over plan, so hold at least that much in contingency. Ask every partner to quote against these nine lines so bids are comparable.

In-House or Partner: How to Decide

Answer three questions:

1. Has your team completed a comparable migration in the last two years?
2. Can it carry the migration alongside clinical system support without delaying either?
3. Has it run a clinical safety case and a DSPT evidence cycle alongside infrastructure change?

Three yeses: run it in-house. Any no, or a fixed deadline such as an end-of-support date or data centre lease: bring in a partner.

Either way, compliance stays with your organisation. The DSPT submission, BAA obligations and Clinical Safety Officer role all remain yours, and OCR does not certify any vendor as “HIPAA compliant”.

Five Questions to Ask Any Healthcare Cloud Migration Partner

1. Will it sign a BAA or Article 28 terms? Look for: a yes, whenever its engineers can access patient data.
2. What does its ISO 27001 certificate cover? Look for: a scope that includes the delivery engineers who will access your systems.
3. Has it worked alongside a Clinical Safety Officer? Look for: experience feeding test evidence into a DCB0160 hazard log.
4. How is rollback designed and rehearsed? Look for: a rehearsal per wave, with go/no-go criteria agreed with clinical operations.
5. What does handover include? Look for: an evidence pack mapped to DSPT assertions and HIPAA documentation, plus measured knowledge transfer.

Case Study: Little Journey’s Secure Azure Platform

Little Journey is an eSupport platform for paediatric patients and their families. Rapid growth meant new customer environments took days to set up by hand, with limited in-house DevOps capacity and medical regulatory requirements to meet.

Deployflow built the platform on Azure with Terraform, GitLab and Ansible, giving each customer a separate environment with its own security controls. The DevSecOps team secured cloud endpoints, set security policies and centralised security control.

• Two hours to deploy a new environment, down from several days
• 70% less manual infrastructure work
• 50% more infrastructure scalability
• Full data segregation between customer environments

“Working with Deployflow has been transformative for Little Journey. Deployflow’s team addressed our critical needs for scalability, efficiency, and security by simplifying our cloud infrastructure management.”

Azim Palmer, CTO, Little Journey

Read the full Little Journey case study.

Plan Your Healthcare Cloud Migration With Deployflow

Deployflow runs healthcare cloud migrations to the outputs in this checklist. Every engagement starts with assessment and clinical risk mapping, so you see the tiered inventory, disposition table and wave plan before any workload moves. Deployflow works alongside your DPO, Caldicott Guardian and Clinical Safety Officer. It builds pipelines that generate the audit evidence your DSPT submission and HIPAA documentation depend on.

• Certified: ISO 27001 and UK Cyber Essentials
• Multi-cloud: partner of AWS, Microsoft Azure and Google Cloud
• Healthcare delivery: clinical system DevOps, HL7 and FHIR integration, and zero-downtime releases for clinical-facing systems

Scope your healthcare cloud migration, or see how the Healthcare DevOps practice keeps clinical systems live through change.

Healthcare Cloud Migration Strategy: Frequently Asked Questions