The direct answer
Yes. EPC Group designs the environment around the rule that applies and then builds the analytics inside it. For healthcare, Microsoft offers its HIPAA business associate agreement through the Data Protection Addendum and states that Fabric has a HIPAA BAA, and it is explicit that a BAA does not by itself make a deployment compliant (Microsoft Learn, accessed 2026-10-29). EPC Group therefore adds the controls protected health information needs: OneLake security roles with row- and column-level security, sensitivity labels, private links and an audit review.
For broker-dealers, the records SEC Rule 17a-4(f) and FINRA Rule 4511(c) require stay in Azure Blob Storage under a locked immutability policy, the configuration Cohasset assessed against those rules; the analytics copy in Fabric is never the record of retention. For defense contractors, Microsoft places organizations that handle controlled unclassified information, or whose contracts require DFARS, in GCC High. Fabric is available there with limits: customer-managed keys, workspace identity and workspace-level private link are not supported, and its FedRAMP High authorization in GCC High is under government assessment (Microsoft Learn, accessed 2026-10-29). EPC Group checks the workload list against that page before design starts. Before Fabric holds CUI, read what to settle before Fabric holds CUI in GCC High.
Rule, Microsoft's part, EPC Group's part
| Obligation | What Microsoft provides | What EPC Group builds |
|---|---|---|
| HIPAA | BAA through the Data Protection Addendum; Fabric listed with a HIPAA BAA | PHI inventory, OneLake security roles with row- and column-level security, sensitivity labels, audit review |
| SEC 17a-4(f), FINRA 4511(c) | Azure Blob immutable storage with policy lock, assessed by Cohasset | Records kept WORM in Blob Storage; analytics reads a copy |
| CMMC Level 2 (NIST SP 800-171) | Microsoft 365 GCC High supports CMMC Level 2 and 3 when configured appropriately | Data boundary in GCC High, workload check against Fabric's GCC High list, access limited to U.S. persons where the contract requires it |
| FedRAMP High | Fabric authorized in the commercial cloud; GCC High package under government assessment | Authorization status recorded with its date for the client's security plan |
Documented work
EPC Group engagement data for regulated analytics includes an engagement to validate a healthcare services company's data warehouse and audit its object-, row- and column-level security for partner clinics and internal users (anonymized engagement summary), an engagement to build an Azure data warehouse and role-secured Power BI dashboards for a medical device manufacturer, with data-security and compliance protocols set during discovery (anonymized engagement summary) and an engagement to consolidate two Microsoft 365 GCC High tenants for a defense technology company, with U.S. persons only on the client's GCC High data (anonymized engagement summary). Client names are not published. Source records are in the Evidence Center.
Primary sources
- Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act — Microsoft Learn, accessed 2026-10-29
- Governance overview and guidance (Microsoft Fabric) — Microsoft Learn, accessed 2026-10-29
- Store business-critical blob data with immutable storage in a WORM state — Microsoft Learn, accessed 2026-10-29
- Microsoft Fabric for US Government GCC High customers — Microsoft Learn, accessed 2026-10-29
- Microsoft and the Cybersecurity Maturity Model Certification (CMMC) — Microsoft Learn, accessed 2026-10-29
Frequently Asked Questions
Is Microsoft Fabric covered by a HIPAA business associate agreement?
EPC Group confirms the BAA status of every service before protected health information lands in it. Microsoft states that Fabric has a HIPAA BAA, offered to covered entities and business associates through its Data Protection Addendum, and that a BAA does not on its own make a deployment compliant.
Can EPC Group use Microsoft Fabric for FINRA-regulated records?
EPC Group keeps the records that SEC Rule 17a-4(f) and FINRA Rule 4511(c) require in non-rewriteable form in Azure Blob Storage under a locked immutability policy, the configuration Cohasset assessed against those rules. Fabric holds the analytics copy, so retention never depends on the reporting platform.
Does EPC Group build Fabric analytics in GCC High for CMMC?
EPC Group builds in GCC High when controlled unclassified information is in scope, after checking each workload against Microsoft’s GCC High availability list: customer-managed keys, workspace identity and workspace-level private link are not supported there, and tenant-level private link is. CMMC assesses the contractor rather than the cloud, so the controls feed the contractor’s own NIST SP 800-171 evidence.
Talk to a senior architect
A one-hour scoping call with a senior EPC Group architect covers the rule you answer to, the cloud it points to and the analytics you need inside it. Email contact@epcgroup.net or call 888-381-9725.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- GCC High Tenant Consolidation: Defense Technology (2026)Anonymized engagement summary · Defense technology company · 2026
- SharePoint Intranet Permission Automation: Contractor (2024)Anonymized engagement summary · Federal government contractor · 2024