Talk about putting EHRs in the cloud has been loud and constant. But what are the key issues for ensuring security and safety of data stored in a cloud application? What considerations do EHR buyers need to be aware of?
“Three principles are critical for ensuring privacy of patients and the content authenticity and source verifiability of electronic medical records. First, all electronic medical records, be it PHR or EHR or EMR, should be guarded through ownership controlled encryption, enabling secure storage, transmission, and access. Second, the creation and maintenance of EHRs should preserve not only content authenticity but also data integrity and customizable patient privacy throughout the EHR integration process. Third but not the least, the access and sharing of EHRs should provide end-to-end source verification through signatures and certification process against blind subpoena and unauthorized change in healthcare critical data content and user agreements.”
To explain these three principles, the authors Riu & Ling (citation below break the healthcare cloud into 3 components. The first is Software As A Service (SaaS). In this model, the client healthcare organization purchases the rights to use a software, usually through the web. All of the hardware and most of the software code is owned by the vendor.
For Platforms in the Cloud, or Platforms As A Service (PaaS), the client or healthcare organization can choose and deploy technologies that they own, which are approved by the vendor. However, the underlying cloud platform, including servers and hardware, are owned by the cloud provider. In the third instance, Infrastructure is the focus–Infrastructure As A Service (IaaS). This situation allows the client to choose, support, maintain and run any program or software they choose. The cloud service simply provides the remote security and sometimes backup storage.
In each of these cases, security becomes more and more the responsibility of the healthcare organization; for SaaS, the client is mostly responsible for adding and appropriately using accounts. For PaaS, upgrades, maintenance and interfaces between programs are also the responsibility of the client. In IaaS, almost all security responsibility is on the healthcare organization.
Those responsibilities may be shifted, depending on the ownership of the cloud service. A private cloud is one purchased for a single organization, and maintained only for those users. A community cloud is shared by several organizations, all of whom are responsible for security of data and proper use. Typically, the cloud is a third party used by the network of healthcare providers. A public cloud is one that anyone may access, and the software developers and healthcare organizations are responsible for security.
Three roles need to be considered for security models around healthcare data: Creator, Author and Manager. Creators are the ones who originate the data, inputting it into the system. Authors are usually creators, but are always the people responsible for the information–for instance, a physician is the author of the information even if she writes down the data and a nurse enters into into the system. The manager is responsible for access, storage and security of the data.
In addition to these models, dental practices need to find out if the software and any associated backups of data are stored and transmitted in a HIPAA-compliant fashion. Security is crucial to reducing legal concerns, and not all dental software is HIPAA compliant.
Considering the elements and models laid out by Rui & Ling, those deciding how to store data in the cloud have the necessary tools. Knowledge of contracts and technological requirements is a big part of the information need.
- Ownership of health data on the cloud requires end-to-end encrypted security protocols that meet HIPAA regulations.
- Software as a Service (SaaS) allows healthcare organizations to use specified software through designated access points, with limited security responsibilities.
- Platform as a Service (PaaS) allows healthcare organizations to install vendor-approved software into the cloud for access and backups, and take on more security responsibility.
- Infrastructure as a Service (IaaS) allows healthcare organizations to install any software, but they are also responsible for most security, storage and backups.
- Private clouds are for a single organization’s use, while community clouds have networks of users who may implement different security protocols for information exchange. A public cloud allow access by many entities and may have very complex and sometimes user-controlled security.
- Creators, authors and managers of data each have different security and responsibilities for cloud access.
Rui, Z., & Ling, L. (July 05, 2010). Security Models and Requirements for Healthcare Application Clouds. 268-275.