Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/4/2013
10:04 AM
50%
50%

Patient Privacy Advocate Calls For Better Cloud Security

Letter to Office of Civil Rights calls for stronger data security protections, business associate agreements with cloud computing services.

Health Data Security: Tips And Tools
Health Data Security: Tips And Tools
(click image for larger view and for slideshow)
A leading advocate for the privacy and security of patient health information is urging the government to issue a strong guidance document on how healthcare data should be protected in the cloud.

In a letter to the Office of Civil Rights (OCR) in the Department of Health and Human Services (HHS), Deborah Peel, MD, founder and chair of Patient Privacy Rights, said, "Health providers will benefit from such guidance as they consider moving to cloud services, and patients will benefit by knowing which data privacy and security protections should be in place."

Peel's letter cites the HHS' settlement with Phoenix Cardiac Surgery in April 2012 to illustrate the challenges that can arise when providers move to the cloud. In that case, the practice was fined $100,000 for managing appointments using a Web-based calendar that was publicly available.

Today, healthcare providers' use of cloud services goes far beyond that. Electronic health records, billing data, medical images and many other types of healthcare information are now stored on remote servers. According to an Optum Institute report published last March, nearly 60% of responding CIOs from organizations that had an EHR and a health information exchange said they planned to invest in "cloud-based open systems."

[ How can patient engagement help transform medical care? Check out 5 Healthcare Tools To Boost Patient Involvement. ]

Despite the burgeoning use of the cloud to store and manage information, however, Peel could not cite evidence that this shift has led to an increase in security breaches or that cloud storage is inherently less secure than onsite storage of data. "I don't know whether there are any studies of that," she told InformationWeek Healthcare.

What is known, she added, is that "the healthcare industry has the worst security practices of any industry. Eighty percent of hospitals still don't even encrypt data. Hospitals are not putting the money into data protection."

The key issue with cloud storage, she said, is that "there's no way of telling which services are following best practices for state-of-the-art comprehensive security and privacy."

For example, she pointed out, remote servers can be located anywhere. "We don't even know whether they're in the U.S. We have no way of knowing what happens inside the cloud servers, whether the owners of the cloud service snoop in the information or not, and there's no certification or auditing of these systems to verify whether they do what they say they do in a contract."

Even worse, she pointed out, many contracts between cloud service firms and healthcare providers lack even basic security protections. For example, the HIPAA law mandates that cloud services sign business associate agreements requiring them to adhere to the same security and privacy rules that HIPAA-covered entities must comply with. But many providers do not ensure that this provision is in their contracts.

Under the guidance that Peel's group is seeking, the OCR would urge cloud companies to provide:

-- A secure infrastructure, including data encryption and audit controls

-- Security standards consistent with standards required of federal agencies

-- Privacy of protected health information, based on standards for appropriate use, disclosure and safeguarding of individually identifiable information

-- Business associate agreements -- something that OCR has already called for.

Eventually, Peel said, her group wants the government to introduce a certification system for cloud computing, similar to the EHR certification it requires for showing Meaningful Use. Such certification, which could be performed by HHS or by private entities authorized by HHS, would incorporate the guidance elements in Peel's letter. It would also include other requirements set forth in a "trust framework" that her group plans to release within the next few weeks.

Patient Privacy Rights developed and validated the trust framework with the help of Microsoft and PwC and tested it on HealthVault, according to Peel. "We have some tools that could be used to assess every kind of platform, application or system so that some kind of ranking or rating could be created for how well they comply with what the public expects. We have 15 major principles broken down into auditable criteria, such as what nation the servers are in."

Initially, Peel noted, Patient Privacy Rights will release the framework for purposes of discussion, research and self-evaluation by cloud services and healthcare providers. The criteria in the framework, she said, could apply to anybody who stores healthcare information remotely, even on a website.

Clinical, patient engagement, and consumer apps promise to re-energize healthcare. Also in the new, all-digital Mobile Power issue of InformationWeek Healthcare: Comparative effectiveness research taps the IT toolbox to compare treatments to determine which ones are most effective. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
1/15/2013 | 6:15:54 AM
re: Patient Privacy Advocate Calls For Better Cloud Security
I don't believe these issues are specific to cloud technologies as a whole. Regardless of whether you have dedicated infrastructure or are using a cloud, you always have to have certain security measures in place. Sure, there may be a slightly larger risk when aggregating resources together, but at the end of the day all of that data should be secure so it shouldn't matter whether it's cloud hosted or not. Healthcare IT has it's work cut out for the next couple of years with trying to find solutions to the security concerns that plague it today.

Jay Simmons
Information Week Contributor
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
1/7/2013 | 8:54:45 PM
re: Patient Privacy Advocate Calls For Better Cloud Security
Big challenge here still will be the small healthcare practices without the IT security resources and knowledge.

Kelly Jackson Higgins, Senior Editor, Dark Reading
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/7/2013 | 4:33:53 PM
re: Patient Privacy Advocate Calls For Better Cloud Security
Wonderful article and a topic that I believe is getting overlooked, What I mean is people do not realize the risk of putting medical records in the cloud is security has to be standard and above and beyond 'normal' standards. Whatever policy that is written up also need sot consistent across the board or it will be useless for some organizations. I don't care if you are a small organization or massive, simple rule;encrypt your data, it is a very useful tool!

Paul Sprague
InformationWeek Contributor
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...