Cloud Migration That Delivered 99.99% Uptime for Healthcare SaaS

The Company

CareBridge Health is a 90-employee healthcare SaaS company whose care-coordination platform serves 120 clinics. The platform sits at the center of its customers' daily operations: patient scheduling, secure messaging between care teams, telehealth hand-offs and billing all flow through it, which means every clinic receptionist, nurse coordinator and practice manager who opens a browser is touching CareBridge's infrastructure. The company sells to small and mid-sized practices on annual contracts with availability commitments written into the agreements, and its product roadmap depends on shipping clinical workflow improvements faster than the practice-management incumbents it competes against.

Because the platform handles protected health information end to end, CareBridge lives under HIPAA obligations that shape every infrastructure decision: encryption at rest, access logging, audit trails and the ability to produce evidence on demand when a risk assessment or a customer security review arrives. In healthcare, the stakes of getting this wrong are unusually high. IBM's Cost of a Data Breach report has repeatedly found healthcare carries the industry's highest average breach costs — reportedly exceeding $10 million per incident in recent years. Reliability failures are cheaper than breaches, but as the team would soon learn, they are not cheap.

Where Things Stood

When Emerson Technology first talked with CareBridge's leadership, the entire platform ran on two racks of aging servers in a leased data center. The hardware was past end-of-life on several critical components, power feeds had no redundancy, and the network uplink was a single path whose failure meant a total outage. The operations burden fell on a small infrastructure group who spent their weeks applying patches by hand, babysitting storage arrays and negotiating maintenance windows with the business. Quarterly patching cycles forced weekend downtime that clinicians had to plan around, and engineers privately dreaded each one because manual runbooks meant the outcome was never fully certain until Monday morning.

The defining incident came in March, when a single disk failure took patient scheduling offline for nine hours during a business day. The consequences cascaded exactly as you would expect: SLA credits were issued, the three largest clinic customers raised churn threats, and the incident triggered a formal HIPAA risk assessment finding that leadership now had to remediate on a timeline. Beyond that acute failure, the chronic symptoms were wearing the team down. Flu-season traffic spikes — predictable every winter — regularly degraded response times because capacity was fixed at what the racks could hold. A vendor quote to refresh the data center arrived at $1.4M in capex, with no meaningful improvement in reliability, no improvement in release speed and the same single-site risk profile as before.

The Challenge

The challenge was not "move to the cloud" as a slogan; it was a three-sided trap. On one side, reliability: the platform's availability posture was one hardware fault away from another nine-hour outage, and Uptime Institute's Annual Outage Analysis reports that a majority of operators say their most recent significant outage cost more than $100,000, with a meaningful share exceeding $1 million — figures that match CareBridge's own March experience once credits and crisis labor were tallied. On the second side, compliance: the HIPAA risk assessment finding meant every future architecture decision needed documented controls, not best-effort intentions. On the third side, cost: a $1.4M refresh would lock five more years of capex into infrastructure that still could not scale for flu season or ship a release faster than monthly.

There was also a sequencing problem that made the situation genuinely difficult. CareBridge could not pause the product while a migration happened; clinics do not tolerate a frozen scheduling platform, and the sales team was actively in renewal conversations with the very customers who had issued churn threats. The migration therefore had to happen underneath a live, revenue-critical, regulated system — one service at a time, with rollback options at every step. Leadership framed the decision bluntly: either commit to a cloud exit that removed the single-site risk and the capex cycle, or spend $1.4M to stand still.

Discovery and Diagnosis

Emerson Technology opened with a two-week discovery sprint across CareBridge's systems, dependencies and operations rituals. The team inventoried every service — scheduling, messaging, telehealth hand-offs, billing and the supporting batch jobs — and mapped how data moved between them, tracing which jobs read from which databases and which nightly processes silently depended on each other. Three findings shaped everything that followed. First, several components documented as independent were in fact coupled through shared file shares and a cron scheduler nobody had touched in years. Second, capacity had been sized for average load, so winter spikes had nowhere to go but response-time graphs. Third, compliance evidence existed mostly as tribal knowledge inside two senior engineers rather than as retrievable artifacts.

The diagnosis reframed the vendor's $1.4M quote as the wrong baseline. McKinsey research reportedly estimates that migrating on-prem workloads to the cloud can reduce total cost of ownership by roughly 30-40% for well-optimized environments — and CareBridge's environment, with its low utilization and manual operations, was the kind of environment that optimization helps most. The discovery sprint closed with a wave plan: service domains grouped by data dependency and blast radius, ordered so that each wave could be rehearsed, executed and rolled back independently, with the patient-facing scheduling core deliberately scheduled last when the team's cloud operating muscle was proven.

The Solution

Emerson Technology executed a strangler-pattern migration to AWS over seven months, moving each service domain in planned waves while the platform stayed live throughout. The destination architecture was designed for three properties: no single point of failure, no manually provisioned components, and compliance controls that existed as code from day one.

The landing zone

Everything in the new environment is defined in Terraform across three Availability Zones. Networks, subnets, security groups and IAM roles are reusable modules that get reviewed as code rather than configured by hand. EC2 Auto Scaling groups sit behind Application Load Balancers, so capacity rises and falls with demand instead of being bolted to a rack. Amazon RDS for PostgreSQL runs with a Multi-AZ standby, giving database failover that the old single-array setup could never offer, and encrypted EBS volumes plus S3 lifecycle policies handle clinical document storage with predictable, tiered cost. Because the whole environment is code, a failed region-level experiment can be torn down and rebuilt in an afternoon — a property the old data center never had.

The migration waves

Each service domain moved in its own wave: dependency mapping first, a staging rehearsal second, a monitored cutover third, and a documented rollback path throughout. GitHub Actions pipelines run automated test suites and rehearsed database migrations before every promotion to production, which is what turned releases from a monthly event into a weekly routine. Load tests modeled 5x flu-season peaks, deliberately harsher than any winter the platform had seen, so the autoscaling behavior was proven before the patients depended on it. The final workloads moved during a monitored cutover weekend run from a shared checklist, with dashboards for latency, error rates and sync lag visible to everyone in the room — and it closed with zero unplanned downtime.

The compliance backbone

PHI is protected end to end by design rather than by policy documents. KMS-managed encryption covers every volume and bucket at rest, TLS 1.3 protects data in transit, application tiers live in private subnets with no direct internet path, and IAM roles grant least-privilege access per service. CloudTrail audit logging captures every API call, and each control is mapped directly to a named HIPAA requirement in a living evidence index. That mapping is the quiet hero of the project: when the formal risk assessment was re-run, and later when CareBridge pursued SOC 2 Type II, the auditors drew from the same artifacts the engineers already produced, so audits became a review exercise instead of an archaeology project.

The First 90 Days

The first six weeks belonged to foundations. The landing zone was built and peer-reviewed as Terraform, the CI/CD pipelines were stood up with automated tests and migration rehearsals, and the team ran its first full staging rehearsal of a migration wave — which promptly surfaced a hidden dependency between messaging attachments and a legacy file share that no design review had caught. Catching it in staging, with a rollback available and no customers watching, was exactly what the rehearsal discipline exists for. By week six, the messaging domain was live on AWS, serving real clinic traffic, with the on-prem path still warm as a fallback.

Weeks seven through ten moved billing and telehealth hand-offs, and with them came the operational habits that make a platform auditable: structured logging forwarded centrally, CloudTrail mapped into the HIPAA evidence index, and SLA instrumentation — availability targets, alert thresholds and error budgets — defined and reviewed before the spend grew large enough to blur them. Reserved-capacity purchases were deliberately deferred until roughly the 60-day mark, after utilization data showed the real steady-state footprint, so commitments were bought against observed usage rather than guessed sizing. Weeks eleven and twelve carried the last pre-scheduling wave and a full 5x load-test rehearsal of the scheduling service, including a timed cutover drill that the team improved twice before the real weekend. By day 90, seven months of work had a proven rhythm, and only the final cutover lay ahead. It went according to the checklist — the highest compliment a migration can be paid.

The Results

In the twelve months since the final cutover, CareBridge has sustained 99.99% availability while absorbing two full flu-season peaks that previously degraded response times every winter. Monthly infrastructure spend fell 34% against the old data center, and the $1.4M hardware refresh simply evaporated as a line item. Weekly releases replaced the monthly cycle, unplanned downtime fell roughly 96% year over year, and the HIPAA risk assessment was closed with no critical findings. CareBridge then passed a SOC 2 Type II audit drawing on the same evidence pipeline the engineers already maintained — no audit-specific scramble, no documentary heroics.

The operational texture of the company changed along with the numbers. Release weekends disappeared from engineers' calendars, replaced by routine weekly promotions that a single on-call engineer can supervise. Capacity conversations shifted from "what can the racks hold" to "what does this week's forecast need," and the answer arrives by changing an autoscaling parameter instead of issuing a purchase order. Sales conversations changed too: availability commitments that once required caveats are now made from evidence, because the monitoring that proves 99.99% is the same monitoring the team watches daily.

What Your Business Should Do

The sequence CareBridge followed is repeatable, and its ordering matters more than its tooling. Start by mapping workloads into migration waves grouped by data dependency and blast radius rather than by department, because wave planning is what lets you rehearse each move, catch coupling problems early and keep rollback options open. Write Terraform before you migrate anything: codify networks, IAM, databases and storage as reusable modules, since reviewing infrastructure-as-code is faster and safer than reviewing screenshots, and it makes compliance evidence collection dramatically easier. Encrypt regulated data with managed keys from the start — KMS at rest, TLS in transit, least-privilege IAM — and map every control to a named requirement so audits stop being archaeology projects. Then rehearse the cutover in staging with production-like load tests and timed drills; teams that rehearse discover their real dependencies weeks earlier than runbook reviews ever will.

Handle the economics with the same discipline. Automate releases before you move, because migrating a manually deployed system recreates every bad habit you had on-prem, just on more expensive infrastructure. Wait 60 to 90 days after cutover to observe real utilization, and only then commit to reserved capacity — buying commitments against guessed sizing locks in the wrong footprint for years. Instrument SLAs before your first cloud invoice: define availability targets, alert thresholds and error budgets up front and review them quarterly, because a 99.99% commitment you cannot measure is a marketing claim rather than an operations policy. Finally, close the audit loop once: build a single evidence pipeline of logs, access reviews and change records that serves HIPAA, SOC 2 and customer security reviews together, so every future audit reuses the same artifacts. As you plan, sit with the questions this engagement raised — what a nine-hour outage would actually cost you, how many of your controls exist as evidence versus tribal knowledge, which workload you would move first if you could only rehearse one wave this quarter, and what standing still truly costs. Work through these eight steps with your team using the action checklist in this practice book, and revisit the reflection questions each quarter to keep the migration honest long after the last server is switched off.