Healthcare EHR + Microsoft Integration — Special Forces Hub
Healthcare EHR + Microsoft Integration: Epic, Oracle Health, MEDITECH, NextGen + Microsoft 365 + Power BI + Fabric + Copilot
How HIPAA-covered healthcare enterprises move clinical data into Microsoft Fabric, surface it in Power BI, ground Microsoft 365 Copilot on it, and integrate Microsoft 365 into the clinician and patient workflow — without breaking HIPAA, 42 CFR Part 2, or state privacy law. Five named integration patterns. Active healthcare Business Associate Agreements. Senior-architect-led delivery.
Published 2026-06-15 · Microsoft Solutions Partner — six designations · 4× Microsoft Press bestselling author · Active healthcare BAAs
Healthcare enterprises integrate Epic, Oracle Health (Cerner), MEDITECH, and NextGen with Microsoft 365, Power BI, Fabric, and Copilot using five named patterns — Fabric Lakehouse mirror, FHIR event streaming, Copilot grounding on de-identified extracts, SharePoint plus EHR context-launch, and Entra External ID patient SSO. Every pattern is HIPAA-compatible and audit-ready when BAA scope, Purview labels, Sentinel logging, and 42 CFR Part 2 segregation are documented end-to-end.
Key Facts
- EPC Group is a Microsoft Solutions Partner with six designations and 29 years of Microsoft consulting delivery since 1997.
- 11,000+ Microsoft engagements completed across 70+ Fortune 500 organizations.
- Active Business Associate Agreements with Palmetto Infusion, ARRT, OMRF, Eisenhower Health, and Medavie anchor the HIPAA-covered-entity practice.
- Five named EHR plus Microsoft integration patterns — Fabric Lakehouse mirror, FHIR event streaming, Copilot grounding on de-identified extracts, SharePoint plus EHR context-launch, Entra External ID patient SSO.
- Microsoft Purview sensitivity labels enforced at OneLake storage layer and propagated to every downstream Power BI dataset, SharePoint library, and Copilot grounding surface — across 500+ Fabric implementations and 1,500+ Power BI deployments.
- Compliance coverage spans HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP — with HIPAA, 42 CFR Part 2, and state privacy law (CMIA, HB 300, SHIELD Act, My Health My Data Act) mapped to the Purview taxonomy at engagement kick-off.
- Microsoft Sentinel audit-log retention defaults to seven years across OneLake access logs, Power BI activity logs, Purview audit logs, and Copilot interaction logs.
- EPC Healthcare EHR + Microsoft Integration Accelerator — 90-day or 180-day fixed-scope, fixed-fee engagement priced $400K to $1.5M with named deliverables per phase.
The Four EHR Vendors — Microsoft Integration Realities
Four EHR vendors dominate the HIPAA-covered enterprise footprint in the United States and Canada — Epic, Oracle Health (formerly Cerner), MEDITECH, and NextGen Healthcare. Each vendor has a distinct architecture, a distinct sanctioned external-integration surface, and a distinct relationship with the Microsoft platform. The integration plan starts with naming the vendor, naming the deployment generation, and naming the Microsoft surfaces in scope.
Epic
Epic remains the dominant electronic health record vendor in academic medical centers and large integrated delivery networks. The Hyperdrive web client has replaced Hyperspace as the production user interface. Caboodle is the enterprise data warehouse layer; Clarity is the relational reporting database. App Orchard and Epic on FHIR APIs are the sanctioned external integration surfaces, and Cosmos is the de-identified multi-organization research dataset. Storm is the Epic-side grounding surface for Microsoft Copilot.
Microsoft integration surfaces
- Power BI integration via Caboodle tabular models or Clarity-anchored datasets, with row-level security inherited from the EHR security matrix
- Microsoft Fabric ingestion via Lakehouse mirror of Caboodle or FHIR streaming from Epic on FHIR endpoints into Fabric event streams
- Microsoft 365 Copilot grounding via Epic Storm, with sensitivity labels enforced through Microsoft Purview before any clinical data crosses into the Copilot prompt context
- Microsoft Entra ID single sign-on into Hyperdrive, with Conditional Access policies governing device compliance, named locations, and MFA
Oracle Health (formerly Cerner)
Oracle Health is the post-acquisition brand for Cerner Millennium, HealtheLife, and HealtheIntent. Millennium is the clinical electronic health record. HealtheLife is the patient portal. HealtheIntent is the population-health analytics platform. Oracle Code is the code-set governance surface for terminology, value sets, and clinical content. Oracle is publicly committed to running the Millennium back-end on Oracle Cloud Infrastructure (OCI) with progressive AI feature parity through 2026 and beyond.
Microsoft integration surfaces
- Power BI and Microsoft Fabric ingestion via Cerner DataLake exports, HealtheIntent population-health feeds, and FHIR API endpoints from Millennium
- Microsoft Purview classification of HealtheLife patient-portal export data before it enters a Microsoft 365 SharePoint or OneDrive surface
- Microsoft 365 Copilot grounding via curated, de-identified HealtheIntent extracts — Copilot is not grounded directly on Millennium clinical records
- Microsoft Entra ID single sign-on into HealtheLife and clinician-facing Oracle Health workloads, with Conditional Access aligned to the hospital identity baseline
MEDITECH
MEDITECH serves community hospitals, regional health systems, and a sizeable international footprint. The platform spans the modern Expanse web client, the older Magic and Client/Server (6.x) generations still running in many community hospitals, and the MEDITECH-supported business intelligence connector layer used for analytics and FHIR-based interoperability.
Microsoft integration surfaces
- Power BI integration via MEDITECH-supported BI connectors, Data Repository extracts, and FHIR endpoints exposed through MEDITECH Greenfield
- Microsoft Fabric Lakehouse ingestion via batch extracts from the MEDITECH Data Repository, with OneLake medallion architecture (bronze, silver, gold) governed by Purview
- Microsoft 365 Copilot grounding on the Fabric gold layer — never on raw clinical records — with sensitivity labels enforced before any extract leaves the regulated boundary
- Microsoft Entra ID single sign-on into Expanse and SharePoint-hosted physician portals
NextGen Healthcare
NextGen Healthcare serves ambulatory specialty practices, federally qualified health centers, behavioral health organizations, and a significant share of the multi-specialty ambulatory market. The product line covers NextGen Enterprise (electronic health record + practice management) and NextGen Office (cloud-native ambulatory). FHIR APIs are the sanctioned integration surface for downstream analytics and Microsoft platform integration.
Microsoft integration surfaces
- Microsoft Fabric Lakehouse ingestion via FHIR resource pulls and standard ETL into the medallion architecture
- Power BI dashboards anchored on the Fabric gold layer for ambulatory operational and population-health analytics
- Microsoft Purview governance applied at the OneLake storage layer, with sensitivity labels propagated to every Power BI dataset and Copilot grounding surface
- Microsoft 365 Copilot grounding on curated de-identified extracts — clinical narrative remains inside the NextGen production boundary
Five Named Integration Patterns
EPC has executed five distinct patterns for EHR-to-Microsoft integration across active healthcare engagements. Every engagement adopts one or more of these patterns. Each pattern has a named regulatory control plane, a named delivery sequence, and a named evidence package — none of the five is invented at engagement kick-off.
Pattern A. Read-only Fabric Lakehouse mirror of EHR clinical data warehouse
The most common EHR-to-Microsoft integration pattern in the field today. The clinical data warehouse — Epic Caboodle, Cerner DataLake, MEDITECH Data Repository, or the NextGen FHIR resource set — is mirrored, read-only, into a Microsoft Fabric Lakehouse following a bronze, silver, gold medallion architecture. Microsoft Purview enforces sensitivity labels at the OneLake storage layer and propagates them to every Power BI dataset, every Copilot grounding surface, and every downstream Microsoft 365 surface. This pattern is HIPAA-compatible, audit-ready, and CMS-acceptable when the BAA scope and sub-processor chain are documented end-to-end.
Named deliverables
- OneLake medallion architecture — bronze (raw EHR extract), silver (cleansed and conformed), gold (analytics-ready) — with named refresh cadence and named owner per layer
- Microsoft Purview sensitivity-label taxonomy applied at the OneLake storage layer, propagated to every Power BI dataset and every downstream extract
- Power BI workspace topology — dev / test / prod — with row-level security inherited from the EHR security matrix where the EHR matrix is the source of truth
- Audit-ready logging — OneLake access logs, Power BI activity logs, and Purview audit logs piped into Microsoft Sentinel with seven-year retention by default
- BAA scope document covering Microsoft Fabric, Microsoft 365, Microsoft Purview, Microsoft Sentinel, and any sub-processors named in the data flow
Pattern B. Real-time FHIR API streaming into Fabric event streams for operational dashboards
When the operational use case requires near-real-time clinical data — emergency department throughput, operating room turnover, bed occupancy, infusion-chair utilization, length-of-stay alerts — the batch mirror in Pattern A is too slow. Pattern B streams FHIR resource updates from the EHR FHIR endpoint into Microsoft Fabric event streams, lands the stream in a Fabric KQL or Eventhouse database, and surfaces it to Power BI in real-time. The same Purview sensitivity-label and Sentinel audit-log discipline applies — the cadence changes, the regulatory control plane does not.
Named deliverables
- FHIR resource map — which Patient, Encounter, Observation, MedicationAdministration, and Location resources stream in real time vs which remain batch
- Fabric event-stream architecture — Eventhouse or KQL database — with named retention window, named partition strategy, and named latency SLA per use case
- Real-time Power BI report set covering the operational use cases — emergency department throughput, operating-room turnover, infusion-chair utilization, ward-level census
- Sentinel detection rules tuned to FHIR API misuse patterns — abnormal call volume, abnormal resource scope, abnormal time-of-day patterns by service account
- Sub-processor disclosure document covering every Microsoft service touched by the real-time path, signed into the BAA as a named addendum
Pattern C. Copilot grounding on de-identified EHR data via sensitivity labels and Purview
Microsoft 365 Copilot is the most-requested AI surface in healthcare enterprises today, and it is also the easiest surface on which to accidentally leak protected health information. The EPC pattern is conservative by design. Copilot is never grounded directly on identified clinical records. Copilot is grounded on a curated, de-identified gold-layer extract that lives behind a Microsoft Purview sensitivity label. Sensitivity labels are enforced at the OneLake storage layer, at the Power BI dataset layer, at the SharePoint document-library layer, and at the Copilot prompt-context layer. Re-identification risk is documented and signed by the responsible Information System Security Officer before the surface goes to general availability.
Named deliverables
- Copilot grounding source catalog — every SharePoint library, every Power BI dataset, every Fabric gold-layer table that Copilot is allowed to ground on, with named owner and sensitivity label per item
- De-identification playbook — what fields are stripped, what fields are tokenized, what fields are aggregated to a safe granularity, and what residual re-identification risk remains
- Purview sensitivity-label taxonomy specific to the Copilot grounding surface — typically a separate label family from the general data-classification taxonomy
- Copilot interaction-logging pipeline into Microsoft Sentinel with seven-year retention, indexed by user, by grounding source, and by prompt category
- Copilot user-acceptable-use policy signed by every Copilot-licensed user, with explicit acknowledgement that no protected health information may be pasted into the prompt context
Pattern D. Bidirectional Microsoft 365 + EHR integration — SharePoint physician portal + EHR launch
A bidirectional pattern. The physician portal lives in SharePoint Online as a Communication Site, integrated into Microsoft 365 with Entra ID single sign-on and Conditional Access. The portal carries clinical reference content, departmental policy, on-call schedules, and contextual links into the production electronic health record using context-aware launch — Epic Hyperdrive, Oracle Health Millennium, MEDITECH Expanse, or NextGen Enterprise opens at the right patient record and the right encounter. The reverse direction is supported through EHR-hosted SmartLinks or context-passing launches back into SharePoint pages. The pattern keeps clinical data inside the regulated electronic health record while keeping reference content, policy, and collaboration inside Microsoft 365.
Named deliverables
- SharePoint Online physician portal — Communication Site topology, intranet hub site integration, page-template library, and named content owners by department
- Microsoft Entra ID single sign-on configured across SharePoint Online and the EHR clinician-facing surface, with Conditional Access policies aligned to the hospital identity baseline
- Context-aware EHR launch implementation — Epic SmartLinks, Cerner Concept-Oriented Reference Launch, MEDITECH context passing, NextGen launch tokens — with named test cases per workflow
- Microsoft Purview sensitivity labels applied to portal libraries that hold any reference content with regulatory implications, with information rights management where appropriate
- BAA scope addendum covering SharePoint Online, Microsoft 365 Copilot (where enabled), Microsoft Entra ID, and any sub-processor in the context-launch path
Pattern E. HealtheLife / MyChart integration with Microsoft Entra B2C for patient SSO
A patient-facing pattern. The patient portal — Epic MyChart, Oracle Health HealtheLife, MEDITECH Patient and Consumer Health Portal, NextGen Patient Portal — federates patient identity through Microsoft Entra External ID (formerly Entra B2C). The hospital owns the identity layer, the patient owns the identity object, and the consumer-facing identity provider chain is governed by the hospital security baseline. Multi-factor authentication, social-identity sign-in, account recovery, and privacy notice are all controlled in Entra External ID. The pattern collapses the proliferation of disconnected patient portals across an integrated delivery network into one consumer identity surface, which is the precondition for any meaningful patient-facing AI service.
Named deliverables
- Microsoft Entra External ID tenant design — naming, branding, custom domain, social-identity provider list, MFA policy, account-recovery policy
- Federation map — which patient portal federates through which Entra External ID user flow, and which legacy local-account portals remain in scope for retirement
- Privacy notice, terms of service, and HIPAA Notice of Privacy Practices integration into the Entra External ID sign-up and sign-in flow
- Microsoft Sentinel detection rules tuned to patient-portal misuse — credential stuffing, abnormal device fingerprints, abnormal velocity patterns by patient identity
- BAA scope addendum covering Entra External ID, the federated patient portal vendors, and any sub-processor in the consumer identity path
HIPAA, 42 CFR Part 2, and State Privacy Law — The Layered Control Plane
HIPAA alone is not the regulatory boundary in 2026. The compliant integration plan applies a layered control plane that covers identity and access, data classification with Purview sensitivity labels, audit-trail retention in Microsoft Sentinel, BAA scope and sub-processor disclosure, and a 42 CFR Part 2 and state-privacy-law overlay. Every layer is named, owned, and audit-ready before the first clinical record crosses into the Microsoft platform.
Identity + access control
- Microsoft Entra ID single sign-on into the EHR clinician surface with Conditional Access policies tied to device compliance, named locations, and risk-based MFA
- Privileged Identity Management (PIM) for every administrative role in the EHR-to-Microsoft data path, with just-in-time elevation and approval workflow
- Microsoft Entra External ID for the patient-facing identity layer, with HIPAA-aligned account-recovery and MFA policy
Data classification + sensitivity labels
- Microsoft Purview sensitivity-label taxonomy specific to the regulated boundary — PHI, de-identified clinical, business-confidential, public
- Sensitivity labels applied at the OneLake storage layer and propagated automatically to every downstream Power BI dataset, SharePoint library, and Copilot grounding surface
- Row-level security inherited from the EHR security matrix where the EHR matrix is the named source of truth
Audit trail + log retention
- OneLake access logs, Power BI activity logs, Fabric eventhouse logs, and Purview audit logs piped into Microsoft Sentinel with seven-year retention by default
- Immutable audit-log storage on the Sentinel back-end with named retention policy and named legal-hold workflow
- Quarterly audit-log review evidence package signed by the responsible Information System Security Officer
BAA scope + sub-processor disclosure
- Named BAA scope covering Microsoft Fabric, Microsoft 365, Microsoft Purview, Microsoft Sentinel, Microsoft Entra External ID, and any EHR vendor sub-processor in the data flow
- Sub-processor disclosure addendum signed at the start of every engagement and refreshed at every architecture change
- Microsoft HIPAA BAA on file as the foundational document, with EPC Group acting as the downstream Business Associate to the Covered Entity
42 CFR Part 2 + state privacy law overlay
- Where 42 CFR Part 2 substance-use disorder records are in scope, an additional segregation layer is applied at the Fabric silver layer with a separate sensitivity-label family and a separate access-approval workflow
- State-specific privacy frameworks — California CMIA, Texas HB 300, New York SHIELD Act, Washington My Health My Data Act — are mapped to the Purview taxonomy at engagement kick-off, not retrofitted at go-live
- Cross-border data-residency constraints (Canadian PHIPA, EU GDPR Article 9 health data) are addressed through Fabric capacity placement and tenant-region pinning
CMS + Joint Commission Audit-Readiness Controls
CMS Conditions of Participation, CMS Promoting Interoperability, and Joint Commission accreditation surveys do not test the marketing slide — they test the binder. Every EHR-plus-Microsoft integration EPC delivers carries a named audit-readiness package the surveyor can read in the order the surveyor needs it.
1. Explicit log-retention policy
Every audit log in the EHR-to-Microsoft data path — OneLake access logs, Power BI activity logs, Fabric eventhouse logs, Purview audit logs, Sentinel detection logs — is retained for seven years by default, indexed by user, action, resource, and timestamp, and held under immutable storage. Retention shorter than seven years is documented as a named exception signed by the responsible Information System Security Officer.
2. Segregation of duties
The administrator who provisions the Fabric workspace is not the administrator who approves the BAA scope, who is not the administrator who runs the quarterly audit-log review. Privileged Identity Management enforces the boundary, and the named role separation is reviewed annually at the audit-readiness assessment.
3. Break-glass procedure
For any clinical use case where a delay in access would cause patient harm, a documented break-glass procedure overrides the Conditional Access baseline. Every break-glass invocation is logged, alerted in real time to Sentinel, and reviewed within 24 hours by the responsible clinical informatics officer and the responsible Information System Security Officer.
4. Incident response playbook
The named incident response playbook covers the seven HIPAA breach-notification timelines (60 days to affected individuals, 60 days to the HHS Secretary, contemporaneous to media for breaches over 500 individuals in a state), the named role responsibilities (privacy officer, security officer, communications, general counsel), and the named evidence package — Sentinel detection log, Purview audit log, EHR access log — that supports the breach risk assessment.
5. CMS + Joint Commission audit-readiness package
For Joint Commission accreditation, CMS Conditions of Participation, and CMS Promoting Interoperability requirements, the audit-readiness package documents the EHR-to-Microsoft data path end-to-end — BAA scope, sub-processor list, sensitivity-label taxonomy, log-retention policy, segregation of duties, break-glass procedure, and incident response playbook — in one signed binder that the surveyor can read in the order the surveyor needs it.
Named EPC Healthcare Client Portfolio
EPC Group operates as a Business Associate under HIPAA-compliant Business Associate Agreements across a named healthcare portfolio. The references below are stated at the level the client has authorized — engagement-type description without breach of clinical or commercial confidentiality. Past-performance detail beyond this level is shared under mutual NDA on the first 30-minute scope call.
Palmetto Infusion
Active Business Associate Agreement and Microsoft cloud engagement covering revenue-cycle analytics, cash-application acceleration, and Microsoft platform modernization across an ambulatory infusion-therapy footprint.
American Registry of Radiologic Technologists (ARRT)
Microsoft platform engagement covering certifying-body operational workloads with HIPAA-aligned governance and EPC-led Microsoft 365 modernization.
Oklahoma Medical Research Foundation (OMRF)
Microsoft platform engagement with HIPAA-aligned governance for biomedical research operations, supporting administrative workflows and analytics surfaces aligned to the research mission.
Eisenhower Health
Microsoft platform engagement supporting a regional integrated delivery network, with HIPAA-aligned governance applied across Microsoft 365 and Microsoft analytics workloads.
Medavie
Canadian health-services engagement with BAA, HIPAA-aligned governance, and ECIF-funded Microsoft cloud modernization workstreams.
EPC Group is an active Business Associate under HIPAA-compliant Business Associate Agreements with healthcare clients including Palmetto Infusion, the American Registry of Radiologic Technologists (ARRT), the Oklahoma Medical Research Foundation (OMRF), Eisenhower Health, and Medavie (BAA + HIPAA + ECIF-funded).
EPC Healthcare EHR + Microsoft Integration Accelerator
The EPC Healthcare EHR + Microsoft Integration Accelerator is a fixed-scope, fixed-fee, milestone-priced engagement that delivers one or more of the five named patterns end-to-end against the named EHR vendor and the named regulatory boundary. Senior-architect-led, no offshore handoff, weekly executive briefing, named regulator evidence package at handoff.
Engagement structure
- Duration: 90 days for a single-pattern engagement against a single EHR vendor, 180 days for a multi-pattern engagement covering Fabric Lakehouse mirror plus Copilot grounding plus SharePoint physician portal
- Pricing band: $400,000 to $1.5 million depending on EHR vendor, patient and clinician count, regulatory overlay (42 CFR Part 2, state privacy law, cross-border data residency), and number of patterns in scope
- Milestone pricing: integration architecture signed, FHIR API map signed, Purview governance live, Copilot grounding strategy signed, audit-ready logging live, regulator evidence package signed
- Reporting cadence: weekly executive briefing through engagement close, regulator-posture report to CISO, CCO, and ISSO at handoff, named hypercare window post go-live
Named deliverables per engagement
- Integration architecture document — named EHR vendor, named Microsoft surfaces, named pattern(s) in scope, signed by integration steering committee
- FHIR API map — every FHIR resource pulled, every endpoint called, every refresh cadence, every retention window
- Microsoft Purview governance plan — sensitivity-label taxonomy, OneLake storage labels, downstream propagation, exception workflow
- Microsoft 365 Copilot grounding strategy — grounding source catalog, de-identification playbook, user-acceptable-use policy, interaction-log pipeline
- Audit-ready logging design — Sentinel pipeline, seven-year retention, immutable storage, legal-hold workflow, quarterly review evidence
The EPC Special-Forces Suite — Cross-Links
The healthcare EHR + Microsoft integration hub is one of four named complex-scenario hubs. The four hubs cross-reference each other because regulated healthcare enterprises rarely face only one of these challenges in isolation — analytics governance, tenant consolidation after a system merger, and full platform orchestration all share the same control-plane discipline.
Healthcare IT Consulting — HIPAA Microsoft 2026
The foundational HIPAA-covered Microsoft consulting hub for healthcare enterprises.
Enterprise Regulated Analytics on Microsoft
Regulated analytics on Power BI, Fabric, and Purview across HIPAA, FFIEC, SR 11-7, FedRAMP, and CMMC 2.0.
EPC Cloud Orchestrator
The full managed M&A and platform orchestration practice across Microsoft 365, Power BI, and Fabric.
M&A Microsoft Tenant Consolidation — 90-Day Playbook
The named 5-phase 90-day methodology for consolidating two Microsoft 365 tenants after a merger or acquisition.
See also: Digital Transformation Microsoft Enterprise 2026 · Microsoft Fabric Expertise · Microsoft Power BI Expertise.
EPC Credential Stack
11,000+
Microsoft engagements delivered
500+
Microsoft Fabric implementations
1,500+
Power BI enterprise deployments
29 years
Microsoft consulting delivery since 1997
Microsoft Solutions Partner — six designations
Data & AI (Azure), Digital & App Innovation (Azure), Infrastructure (Azure), Modern Work, Security, and Business Applications.
Active healthcare BAAs
Palmetto Infusion, ARRT, OMRF, Eisenhower Health, Medavie — HIPAA-compliant Business Associate Agreements anchoring the regulated-healthcare practice.
4× Microsoft Press bestselling author
Errin O'Connor is the original Microsoft Power BI Project Crescent and SharePoint Project Tahoe beta-team member, with four Microsoft Press titles in print.
Compliance coverage
HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP — with 42 CFR Part 2, CMIA, HB 300, SHIELD Act, and My Health My Data Act mapped to the Purview taxonomy at kick-off.
Frequently Asked Questions
Can Epic clinical data really go into Microsoft Fabric?
Yes, with the right scope and the right control plane. The dominant pattern is a read-only mirror of Caboodle into a Microsoft Fabric Lakehouse following a bronze, silver, gold medallion architecture. Clarity remains the relational reporting database inside the Epic boundary. FHIR streaming through Epic on FHIR is the second pattern when near-real-time data is required for operational use cases. Microsoft Purview sensitivity labels are enforced at the OneLake storage layer and propagate to every downstream Power BI dataset, Copilot grounding surface, and Microsoft 365 surface. The BAA scope covers Microsoft Fabric, Microsoft 365, Purview, and Sentinel end-to-end, and the sub-processor chain is documented as a named addendum. EPC Group has executed this pattern under active healthcare BAAs.
Cosmos Research vs Caboodle export — which is the right source for analytics?
They serve different use cases. Caboodle is the enterprise data warehouse for the local Epic instance, governed by the local BAA, the local security matrix, and the local row-level security model. A Caboodle mirror into Microsoft Fabric is the right pattern for operational analytics, population-health analytics specific to the local panel, and Power BI dashboards that follow local clinical-leadership decisions. Cosmos is the de-identified multi-organization research dataset across the Epic community, governed by the Cosmos data use agreement and the Epic research framework. Cosmos is the right pattern for benchmarking, multi-site research, and outcomes comparison across the Epic community. Most enterprise healthcare clients ultimately need both — the local Caboodle mirror in Fabric for operations, and Cosmos for benchmarking and research.
How does Microsoft 365 Copilot ground on EHR data without leaking protected health information?
Copilot is never grounded directly on identified clinical records. The EPC pattern grounds Copilot on a curated, de-identified gold-layer extract that lives behind a Microsoft Purview sensitivity label, with the sensitivity label enforced at the OneLake storage layer, the Power BI dataset layer, the SharePoint document-library layer, and the Copilot prompt-context layer. Re-identification risk is documented and signed by the responsible Information System Security Officer before the surface reaches general availability. Copilot interaction logs flow into Microsoft Sentinel with seven-year retention, indexed by user, grounding source, and prompt category. A separate user-acceptable-use policy explicitly forbids any user from pasting protected health information into the Copilot prompt context.
FHIR streaming or batch export — which is the right ingestion pattern?
Both, sequenced by use case. The dominant pattern is a batch mirror of the clinical data warehouse — Caboodle, Cerner DataLake, MEDITECH Data Repository, NextGen FHIR resource set — into a Microsoft Fabric Lakehouse on a nightly or every-six-hour cadence. Most analytical, population-health, and revenue-cycle use cases are satisfied by the batch cadence. FHIR streaming through Fabric event streams is layered on top for operational use cases that require near-real-time data — emergency department throughput, operating-room turnover, bed occupancy, infusion-chair utilization, length-of-stay alerts. The same Purview sensitivity-label and Sentinel audit-log discipline applies to both paths.
What is the BAA scope when Microsoft is involved in the EHR data path?
The Microsoft HIPAA Business Associate Agreement is the foundational document and covers the in-scope Microsoft cloud services as Microsoft defines them. EPC Group signs a downstream Business Associate Agreement with the Covered Entity that covers EPC consulting and managed services for the entire EHR-to-Microsoft data path. A named BAA scope addendum documents every Microsoft service in scope — Microsoft Fabric, Microsoft 365, Microsoft Purview, Microsoft Sentinel, Microsoft Entra ID, Microsoft Entra External ID, Microsoft 365 Copilot — plus every sub-processor and every EHR vendor in the data flow. The addendum is refreshed at every architecture change, not just at engagement kick-off.
How is 42 CFR Part 2 substance-use disorder data handled in Power BI?
A separate segregation layer is applied at the Fabric silver layer with a separate Purview sensitivity-label family, a separate access-approval workflow, and a separate audit-log review cadence. The Power BI workspace that holds any 42 CFR Part 2 dataset is provisioned in a workspace topology distinct from the general clinical-analytics topology, with row-level security and object-level security enforced at the dataset boundary. Re-disclosure is governed by the 42 CFR Part 2 consent workflow, which is integrated with the Purview sensitivity-label policy rather than retrofitted at the report-publication layer.
MEDITECH Expanse to Microsoft integration — what does the path actually look like?
For MEDITECH Expanse, the integration path is a batch extract from the MEDITECH Data Repository or via MEDITECH-supported business intelligence connectors into a Microsoft Fabric Lakehouse using the bronze, silver, gold medallion architecture, with Microsoft Purview governing the OneLake storage layer. Power BI dashboards anchor on the gold layer. FHIR endpoints exposed through MEDITECH Greenfield serve the near-real-time operational use cases that require streaming. For community hospitals still on the older Magic or 6.x generations, the path runs through the MEDITECH-supported BI connector layer with the same medallion architecture downstream. The same HIPAA control plane applies regardless of MEDITECH generation.
How does the Oracle Health post-acquisition roadmap affect the integration plan?
Oracle has publicly committed to running the Cerner Millennium back-end on Oracle Cloud Infrastructure (OCI) with progressive AI feature parity through 2026 and beyond. For the EPC integration plan, the practical implication is that the FHIR endpoint, HealtheIntent population-health feed, and HealtheLife patient-portal export remain the sanctioned integration surfaces during the transition. The Microsoft platform side of the integration — Fabric Lakehouse mirror, Power BI workspace topology, Purview sensitivity-label taxonomy, Sentinel audit-log pipeline — is independent of the Oracle Health back-end and remains stable through the OCI migration. EPC tracks the Oracle Health roadmap as a named risk and revisits the integration surface at every architecture-decision gate.
Talk to an EPC Healthcare Microsoft Architect
A 60-minute call with a senior healthcare Microsoft architect — no sales lead. We will give you an honest scope-fit assessment against the EHR vendor, the regulatory overlay, the integration patterns in scope, and the named pricing band for a 90-day or 180-day Accelerator. If a different firm is a better fit for your healthcare integration challenge, we will say so.
Errin O'Connor · Founder & CEO · Microsoft Solutions Partner · 4× Microsoft Press bestselling author · 4900 Woodway Drive, Suite 830, Houston, TX 77056