What worries healthcare leaders most about cloud computing might be its greatest attribute when it comes to patient health data security – it’s not on-site.
Since patient records are the responsibility of the healthcare system, and ultimately the CEO, it might seem logical to want to store them close by where you can keep an eye on them. So most hospitals and health systems rely on traditional client-server computing systems, with office desktop and laptop computers directly networked into local servers housed in a server room somewhere in the hospital or administrative offices.
[Part 1: Money in a mattress: Why patient records should move to a private cloud.]
But a look at stories and surveys on security breaches should convince healthcare administrators to reconsider whether the physical security of on-site client-server systems is the best way to protect patient health information.
- Forty percent of large patient health data breaches involve lost or stolen devices, according to the U.S. Department of Health and Human Services.
- The actions of insiders – negligence or willful misconduct by employees and contractors – accounted for nearly three times as many patient record security breaches as external attacks, said a report last year by the Privacy Rights Clearinghouse.
- Less than 2 percent of healthcare data breaches were from hacking. More than 10 percent were from insider theft or data lost or stolen when being physically transported somewhere else, according to a 2011 survey by the Identity Theft Resource Center.
- Insider attacks are more costly than outsider attacks, both in dollars and damaged reputation, said a cyber-security survey by CSO magazine last year.
A quick look at the Privacy Rights Clearinghouse’s chronology of healthcare data breaches over the last three years tells the same story: Unencrypted backup computer tapes lost in the mail, an employee arrested for stealing records to commit identity theft, a misplaced unencrypted laptop, a flash drive stolen from an employee's car, personal information accidentally placed online, a desktop computer gone missing…
These problems are rooted in easy access to patient records by too many insiders, not attacks by anonymous hackers. So instead of trying to keep records within reach, healthcare systems might want to put them out of reach. Instead of hiding money in a mattress, put it in a bank.
[See also: With eye on public health, Delaware, Michigan roll out clouds.]
The banks for patient health records can be secure private datacenters, an industry that’s undergoing double-digit growth rates because of rising demand for safe and scalable data storage. Thousands of secure private datacenters are scattered throughout the country, but the public doesn’t know about them because they are meant to not be seen. Networked to users through Web-based Software-as-a-Service (SaaS), the system is called secure private cloud.
A visit to a private data center that stores patient health information is convincing. Ensconced in an anonymous warehouse at the back of a nondescript business park, there’s no business sign or even a name on the window. But, when you walk in the front door, open 24-hours a day so clients can always access their data, you feel like you’ve stumbled into black ops guarding a national security secret. A small window of bullet-proof glass fronts a uniformed attendant scrutinizing a bank of closed-circuit video screens. Cameras sweep the waiting room, whose walls are Kevlar-impregnated. A heavily-secured iron door with biometric fingerprint and face scanners leads into what’s known as a man-trap. The man-trap is a small room with more cameras where the inside door won’t open until the outside door is locked. Visual and verbal security checks must be passed before you’re released from the man-trap. Then you pass through a long, stark hallway with more cameras to another heavily barred door with a biometric fingerprint scanner. Inside, the data center looks like a prison with servers as inmates. The giant warehouse is filled with rows of cells; each vendor’s server banks are locked in separate cells. The data center is managed around-the-clock by data security experts whose sole responsibility is keeping your data safe.
Nobody is stealing computer hardware – or anything else – from this place. Nobody has physical access without rigidly controlled authorization. Human error is at a minimum because everybody and everything is intently focused on security.
By contrast, in most client-server systems at hospitals, on-site servers and other hardware are housed in a server room, which is basically protected by a locked door, if that. Meanwhile, desktop computers that can contain patient records sit unguarded, while laptops may be locked in a file cabinet or taken home. Healthcare IT staffs are spread thin with many duties, such as servicing all computers and other equipment. Data security is important, but it’s only one of many responsibilities for them.
The Web-based SaaS that networks the secure private data center provides a critical security feature compared to client-server models. When you finish entering data in web-based private cloud, and then hit “save,” you’re not saving data onto your desktop computer or laptop. That precious information need never reside on your local hard drive at all. Instead, it is sent in an encrypted format to the data center, where it is saved into the secure private database. So if a burglar steals an office computer or a laptop is left in the back seat of a taxi, patient health information remains safe.
[Related: How cloud computing can bring expenditure agility to agency budgets.]
This elemental feature of cloud-based systems is so common in our cyber-centered lives that we don’t even think about it. Google e-mail, Amazon Web Service and SalesForce customer relationship management provide important computerized services for work and play, yet they don’t exist on our computers. Downloading large amounts of data from them, if for some reason you’d want to, can be difficult. And SaaS can be customized to make downloading extremely difficult.
With traditional client-server systems, many people have access to patient information through their computers directly networked to local servers, while physical access to the servers themselves is easy. With web-based secure private cloud systems, proximity to data is farther removed from people inside your organization who would, mistakenly or otherwise, tamper with it. No one except an authorized few can access the private cloud and even fewer know where the private cloud is located. Physical access is next to impossible.
While physical security in secure private cloud systems is clearly superior to client-server systems, cyber security can be as good or better. The last section will examine cyber security for patient health information in the secure private cloud.
Craig K. Collins is President & CEO of Perminova Inc.
Related coverage:
Q&A: Michigan's journey to cloud engagement
HIT makeover, public health style
Cloud, mobile tech's on display at Government Health IT conference
NASCIO's 12 tips for states considering the cloud
NIST's 10 cloud computing requirements
