By: Richard Mach

We are all hearing more and more about “The Cloud” and cloud computing. It’s talked about on industry web sites; It’s one of the hot topics at HIMSS; We even see television commercials about cloud computing. Is this really an option for Healthcare IT? What is cloud computing, anyway? Simply stated – instead of a hospital or healthcare organization owning and running their own computer servers, they rent servers or share applications supplied by commercial organizations.

Are there risks involved with cloud computing? Healthcare organizations access them via the Internet – aka “The Cloud.” It is one of the most rapidly evolving areas of IT. In fact, you may already be using cloud computing. Some examples include: Webmail, Google Docs, MobileME, and Dropbox. You could even say that several large HIS system vendors have a cloud option with their newer systems.

But, there are serious risks with using cloud computing:

· Confidentiality risks – e.g. ‘leakage’ or inappropriate disclosure of patient information through the cloud service provider or network.

· Integrity risks – corruption of data, unauthorized or inappropriate changes to systems, applications and databases, and malware infections.

· The risk of service availability caused by an interruption or termination of cloud services, network issues, and dependence on a non-healthcare service provider.

There are also commercial and legal aspects to consider when implementing cloud computing:

· Are the information security obligations of cloud service providers properly specified in the contracts or Service Level Agreements?

· Do the cloud computing services fulfill the institution’s security compliance obligations under applicable laws?

These are some of the significant issues to consider when thinking about using The Cloud in a healthcare environment. Each issue relates to how cloud computing is designed, used, managed, and controlled. While much of this is not necessarily in the control of the healthcare institution, the institution still has a responsibility to protect the electronic patient data it collects. Therefore, it is very important that when considering cloud computing, you work with the service provider to make sure that all needed security measures are in place and the requirements/expectations are clearly outlined in your service contract.

So, if there are all these security risks, why use cloud computing at all? We all know there are information security issues with conventional computing too. A securely designed and

delivered cloud computing service can actually improve the flexibility, resilience, and reliability of IT services. The main attraction, however, is to reduce costs. Cloud service providers specialize in what they do, and benefit from “economies of scale” (cost advantages that a business obtains due to an expansion), spreading their infrastructure costs across multiple customers.

Most healthcare institutions are already using some form of cloud computing services. Now, you need to think carefully about the information security aspects. For example, public webmail/email/file sharing services such as Gmail and Yahoo! are not really suitable for confidential patient information and should not be used for business purposes. Second, watch out for possible information security incidents and report them in the normal manner. If your institution does not have a formal IT security office and reporting policy, one needs to be created. Third, if you are considering expanding your institution’s cloud computing, make sure all the information security aspects are taken into account. Someone should analyze the security risks and do a cost-benefit analysis prior to moving forward.

If all the security risks are taken into account, reliability standards are outlined, and responsibilities are clearly outlined in your contract with your cloud service provider, cloud computing can be a great way to significantly lower costs in your IT department.

So, what do you think about Healthcare IT moving to “The Cloud?”