Start with the application and its dependencies
Cloud, local infrastructure, and edge computing describe placement and service arrangements, not automatic guarantees about cost, privacy, or reliability. Identify the workload, users, data flows, and operating objective before comparing them. A local component may still rely on remote identity or management services. A cloud service may support a distributed workflow with local devices. Draw the whole system so sourcing decisions address actual dependencies rather than the appeal of a particular architecture label.
Allocate security and privacy duties explicitly
HHS guidance explains that a cloud provider creating, receiving, maintaining, or transmitting electronic protected health information on behalf of a regulated entity can be a business associate. The particular relationship and applicable rules require review. An encrypted or no-view arrangement does not automatically remove those responsibilities. Specify which party manages access, configuration, monitoring, backups, and incident coordination. Avoid interpreting a supplier’s general compliance statement as proof that the customer’s intended use and configuration are appropriate.
Compare operating and recovery requirements
Evaluate staffing, support coverage, capacity, connectivity, and recovery capabilities. Include implementation and transition work in the cost comparison. Test what happens when the primary service or network path is unavailable. HHS notes that service-level arrangements can address availability, recovery, and return of information, while remaining consistent with the relevant agreements and rules. Those provisions need operational verification; a contractual promise is not the same as a successful restoration exercise.
Preserve the option to change
Define data export, configuration records, supplier handover, and termination procedures before the service becomes deeply embedded. Assess how a future network or computing change would affect the supported system. Keep decision criteria measurable and revisit them as workloads evolve. A credible sourcing choice explains who will operate, protect, recover, and eventually replace the service. It does not assume that every healthcare workload belongs in one location or that a future 6G capability settles the entire architecture.