Hosted stores or a database on the machine
This is the decision record for leaving hosted collections. It states the cost, the choice, what was rejected, and the consequence. It is not a pitch for the architecture.
Context
NRTR kept health collections in hosted stores. Variable infrastructure, inference, API, and storage cost about $2.15 per active user per month. A clinic install also meant the record lived where the vendor lived. The free product could not stay free on that cost, and a second copy of someone’s health record sat outside the operator’s control.
Variable cost per active user, annualized
Decision
Move the record to a database on the operator’s machine. Reach about 20 outside services through one internal boundary. Write the stores, the workflows, and the expected behavior down before the move.
A model may suggest a next step. The application writes the stored decision and names the inputs it used. If the model is unavailable, the screen says so.
Rejected
- Stay hosted and negotiate the bill. Cost stayed attached to use, and the record stayed with the vendor.
- Let the model write the stored decision when a source was missing. A suggestion can be absent. A stored fact cannot be invented to fill the gap.
What followed
Two people recreated more than 100 collections and about 30 workflows within a week, working from those documents. Operators now own backup and the machine. That is the trade. The same cost base was enough to avoid another financing round and reach positive operating economics.
Access limits, retention, encrypted transport, and credentials kept on the machine were part of HIPAA-shaped handling and SOC 2 audit preparation. This record does not claim a completed certification.