Cerner and Microsoft 365: what works, what doesn't

Cerner (rebranded Oracle Health following Oracle's 2022 acquisition) keeps patient records in its own database, but clinicians need Microsoft 365 file access alongside PowerChart and the wider Cerner Millennium platform: reference documents, team collaboration files, shift-handover notes, personal OneDrive. On a shared clinical workstation with Imprivata tap-in/tap-out and (usually) a Citrix, AVD or Horizon backend, the OneDrive sync client is a poor fit for a stack of specific reasons. This piece walks through what breaks in a Cerner-hosted clinical environment, why, and how Cloud Drive Mapper provides real-time Microsoft 365 storage access alongside PowerChart without leaving patient information on the endpoint.

What breaks when Cerner clinicians run the OneDrive sync client?

Six patterns come up repeatedly across the healthcare providers we work with. The story is essentially identical to what we see across the other major EHR platforms, because the shared-clinical-workstation environment is the same regardless of whether the EHR sitting on the desk is Cerner, EPIC or MEDITECH. Any two of these together are usually enough to push a clinical IT team off the OneDrive sync client for good.

Persistent PHI cache on shared workstations

OneDrive sync mirrors files locally. On a shared clinical workstation, one clinician's OneDrive-cached files persist on disk after they tap out. Clinicians routinely save patient letters, discharge summaries and attachments to OneDrive, and any of that content that ends up cached locally is patient information at rest on a shared device. HIPAA-conscious organisations do not accept that arrangement, and Cerner customers tend to be HIPAA-first by default.

Session start is too slow for tap-in workflows

Imprivata OneSign lets a clinician tap onto a workstation with their proximity badge and reach a live desktop in a couple of seconds. OneDrive's session-start sync process is not that fast. First-log-on churn as the sync client discovers changes since the last session (or worse, bootstraps from empty on a wiped session host) can run for minutes. In a Cerner-hosted ward environment where PowerChart launches immediately at tap-in, a slow OneDrive layer is the one thing that keeps a clinician standing at the workstation when they should be walking to the next patient.

Non-persistent VDI is a permanent maintenance burden

A large share of Cerner estates run over Citrix (either bare Citrix Virtual Apps and Desktops or the Oracle Health-hosted Citrix variants), with Azure Virtual Desktop, Windows 365 Cloud PC and Omnissa Horizon covering the rest. On non-persistent session hosts, even with FSLogix profile containers, the OneDrive sync client is a known pain point: container growth over time, sync loops on session start, conflicts across multiple session hosts. See our companion piece OneDrive for Business in Citrix for the deep detail.

Multi-user workstations can't have OneDrive sync per user

A nursing station on a Cerner-supported ward gets used by 20+ nurses across a shift. A physician-lounge PC serves whichever doctor sat down first. OneDrive's design assumes one user per Windows machine. On a shared clinical workstation you can have one shared OneDrive account (which loses individual accountability), or nobody gets OneDrive sync (and staff work around it, saving files to network drives or emailing themselves). Neither is a clean answer.

Files On-Demand hydration fails during time-sensitive workflows

A clinician tapping in to document a patient encounter in PowerChart does not have time to wait for OneDrive to hydrate their reference documents. If the shift-handover template or the ward escalation checklist is a cached stub that needs to download before opening, the workflow stalls at exactly the wrong moment.

Local search index leaks across users

Windows Search indexes local OneDrive content by default. On a shared clinical workstation, that index can persist across tap-in and tap-out sessions if it is not aggressively wiped. If Nurse A's OneDrive contained files with patient names, Nurse B's Windows search on the same workstation can return hits from those files. Not something any information governance officer wants to hear from a Cerner-hosted environment.

Why the OneDrive sync client isn't built for clinical shared workstations

The mismatch is architectural. The OneDrive sync client assumes a persistent, single-user Windows machine that keeps a local mirror of the user's cloud files. Cerner-hosted clinical workstations are the opposite: shared, often non-persistent (when VDI-delivered), rapidly switched between users, and subject to strict rules about what can live on the local disk.

Add the PHI-at-rest concern on top: even where OneDrive works technically, the local caching model is not a fit for environments that need to be sure no patient information persists on a shared endpoint. Careful configuration reduces the risk without eliminating it, and "reduces without eliminates" is not the standard clinical governance operates to.

For the broader take on why sync clients struggle with applications and environments that need real filesystem guarantees, see Desktop applications and real file paths. Cerner-hosted workstations sit in the same underlying pattern as our companion pieces on EPIC and MEDITECH; all three major EHRs face the same shared-workstation, VDI-heavy, PHI-conscious environment.

What are the fix options?

Three approaches. The first two are common in the field; the third is what this page is about.

Force clinicians to use the browser for M365 file access

Deny the sync client entirely, tell clinicians to open documents through the SharePoint browser or the Teams client. Works, avoids PHI-at-rest concerns, and produces poor UX. Clinicians work around it by emailing files to themselves or copying to network drives, which reintroduces exactly the governance problem you were trying to solve.

Configure OneDrive extremely carefully with per-workstation controls and FSLogix

Combine per-workstation OneDrive policy, aggressive cache-wipe scripts on tap-out, FSLogix containers for the sync client state, and profile-management controls to keep search indexes clean. Complex, fragile, and does not fully solve the PHI-at-rest problem because the sync client still caches files locally between the wipe cycles.

Use a drive-mapping approach (Cloud Drive Mapper)

Present SharePoint and OneDrive as real Windows drive letters that stream content on demand. No local cache, so no PHI at rest. Per-user mount on tap-in, unmounted cleanly on tap-out. Works on non-persistent VDI because there is nothing to bootstrap. This is the approach the rest of the page is about.

How Cloud Drive Mapper works with Cerner in clinical environments

CDM does not integrate with Cerner directly. What CDM does is make Microsoft 365 storage behave like a network drive inside the same Windows session PowerChart is running in. Clinicians see Cerner in front of them, and their SharePoint sites and personal OneDrive as familiar mapped drives alongside it. Five specific things change.

No PHI on the endpoint

CDM streams file content on demand from Microsoft 365 and releases it after close. Nothing persists on the local disk. When a clinician taps out, there is no cached OneDrive folder waiting to be discovered by the next user or by a lost-laptop scenario. For Cerner-hosted providers this is often the deciding factor.

Instant mount on Imprivata tap-in

CDM mounts per-user at session start. When a clinician taps onto a workstation, their drive letters appear along with their desktop and PowerChart. When they tap out, the mount goes with the session. Compatible with Imprivata OneSign and similar rapid-context-switching workflows on ward PCs, workstations on wheels and physician-lounge stations.

Works on non-persistent Citrix, AVD, Windows 365 and Horizon

No local cache means nothing to bootstrap or reconcile across session resets. Whether the delivered desktop is Citrix Virtual Apps and Desktops (common in Cerner-hosted estates), Azure Virtual Desktop, Windows 365 Cloud PC or Omnissa Horizon, CDM behaves the same way: mount on login, release on logout, no growing container to manage.

Real drive letters visible from PowerChart and adjacent Cerner apps

PowerChart's document upload dialogs, FirstNet's Emergency-Department attachment flows, SurgiNet's operative-note import, and the Excel and Word integration clinicians use to move data in and out of Cerner all see Microsoft 365 storage as a real network drive when CDM is present. Clinicians attach a scanned consent form or export a report to SharePoint the same way they would to a traditional network share. No browser detours, no copy-and-paste workarounds.

Multi-user workstation supported natively

Each user's mount is per-user, per-session, per-credentials. Twenty nurses over a shift on one workstation means twenty discrete sessions, each with its own mount, its own view of Microsoft 365 content, and no cross-user leakage between them.

Cerner-specific configuration notes

CDM does not sit inside Cerner and requires no changes to the Cerner (or Oracle Health) deployment. PowerChart, FirstNet, SurgiNet, RadNet and the Millennium platform continue to run on Windows endpoints exactly as they did before. What matters is the Windows session CDM lives in. A few things worth setting up correctly:

• Deploy CDM per Windows session, not per machine, so each user gets their own mount.
• Configure CDM to trigger its mount at Imprivata tap-in so drive letters are ready when the clinician needs them, at the same moment PowerChart launches.
• Map SharePoint document libraries to consistent drive letters (typically M:, N:, P:) so clinicians can find things across workstations.
• Verify Cerner's file dialogs see the mapped drives; test the document-upload and export paths in PowerChart and any specialty modules (FirstNet, SurgiNet) as part of go-live.
• For information governance sign-off, walk stakeholders through the zero-access architecture underpinning CDM: no local cache, delegated permissions to the customer tenant, no IAM Cloud staff access to customer content by design.

CDM supports Cerner-adjacent workflows in the following deployment models:

• Windows desktops (direct)
• Citrix Virtual Apps and Desktops (including Oracle Health-hosted Citrix variants)
• Citrix DaaS
• Azure Virtual Desktop (AVD)
• Windows 365 Cloud PC
• Omnissa Horizon (formerly VMware Horizon)

Cloud Drive Mapper is used across hospitals and healthcare providers to give Cerner clinicians clean Microsoft 365 file access without leaving patient information on the endpoint.

Frequently asked questions

Does Cloud Drive Mapper work with Cerner PowerChart, FirstNet, SurgiNet and the wider Millennium platform?

Yes. CDM does not integrate with Cerner directly and does not touch PowerChart, FirstNet, SurgiNet, RadNet or the underlying Cerner Millennium (Oracle Health) platform. It provides mapped drive letters for Microsoft 365 storage on the same Windows session that Cerner's thick clients run in. The two operate in different scopes: Cerner handles patient records in its own database; CDM handles Microsoft 365 file storage on the endpoint.

Does Cloud Drive Mapper store patient information on the local device?

No. CDM streams file content on demand from Microsoft 365 and releases it after close. Nothing persists on the local disk. This is the design, and it is the primary reason healthcare providers choose CDM over the OneDrive sync client for shared clinical workstations. Patient information stored in SharePoint or OneDrive is accessed through the mapped drive but never cached locally.

Does CDM work with Imprivata tap-in and tap-out on Cerner-hosted workstations?

Yes. CDM mounts per-user at session start. When one clinician taps out and another taps in, the previous user's mount unmounts and the new user gets their own. Compatible with Imprivata OneSign and similar rapid-context-switching workflows on ward PCs, workstations on wheels and shared physician-lounge stations common in Cerner environments.

Does CDM work on non-persistent Citrix, Azure Virtual Desktop, or Omnissa Horizon session hosts?

Yes. Because CDM does not maintain a persistent local cache, there is nothing to bootstrap or reconcile across session resets. Mounting is immediate at session start. This matters for the substantial share of Cerner estates delivered through Citrix (either bare Citrix or the Oracle Health-hosted Citrix variants) as well as those on AVD, Windows 365 Cloud PC or Omnissa Horizon.

Does the Oracle Health rebrand affect Cloud Drive Mapper compatibility?

No. Oracle's 2022 acquisition of Cerner and the subsequent rebrand to Oracle Health did not change the underlying clinical software from CDM's perspective. PowerChart, FirstNet, SurgiNet, RadNet and the Millennium platform continue to run on Windows endpoints exactly as they did pre-acquisition. CDM's mapped-drive layer sits on those endpoints unchanged.

Does IAM Cloud have access to our patient data or Cerner content?

No. Cloud Drive Mapper does not touch Cerner in any way and operates purely with delegated permissions inside your Microsoft 365 tenant. IAM Cloud holds no credentials that would authenticate to your tenant, and holds no relationship with your Cerner or Oracle Health environment. If IAM Cloud's cloud systems were compromised, an attacker would not, as a result, gain access to any patient data.

Related solutions

• EPIC and Microsoft 365: what works, what doesn't (the same pattern for the other major US EHR)
• MEDITECH and Microsoft 365: what works, what doesn't (community and mid-size hospital EHR)
• Imprivata and Microsoft 365: what works, what doesn't
• OneDrive for Business in Citrix (Cerner-hosted Citrix is a common pattern)
• Desktop applications and real file paths (the underlying problem class)
• Zero-access architecture in Cloud Drive Mapper
• Cloud Drive Mapper for healthcare
• Case study: Respiratory Health Association

← Back to all solutions