| 4 min read
The healthcare nowadays is in the clouds, and not just the prices. With
the fast pace in which technology advances and the many different
solutions that are offered to all types of users, enterprises across all
sectors are either in the cloud, transitioning to the cloud, or thinking
about making the idea of cloud a reality. Hospitals and healthcare
providers are no exception. The cloud provides near real time, accurate
exchange of information to support a variety of health care
scenarios—which is the objective of the Health Information Technology
for Economic and Clinical Health Act (HITECH Act), (Filkins, 2011).
Healthcare in the cloud.
The first steps hospitals took into migrating to the cloud was SaaS
(Software as a Service). "`SaaS` is a way of delivering applications
over the Internet as a service. Instead of installing and maintaining
software, you simply access it via the Internet, freeing yourself from
complex software and hardware management" (Salesforce, 2016). Now we are
one step further, the cloud.
Hospitals handle sensitive patient information and therefore have to abide by a series of laws that were put in place in order to assure privacy, secure access to that information and reduce fraud. Migrating to the cloud raises some concerns regarding those exact issues. Since all healthcare organizations are obligated to comply with these laws, the compliance itself not only brings the biggest risks but also poses the biggest challenge, whether it be in a server room down the hall or in the cloud.
Different countries have different laws in place that all hope to achieve the same objective but may differ in some aspects. In this article we will be talking about the security risk implied in the transition of hospitals and other healthcare organizations to the cloud but focused only on the United States law and healthcare providers.
Health Information Technology for Economic and Clinical Health Act (HITECH)
The HITECH act was created in 2009 to stimulate the adoption of
electronic health records (EHR) and supporting technology in the
United States. This act stipulates that beginning in 2011, healthcare
providers would be offered financial incentives for demonstrating
"meaningful use" of EHRs until 2015, after which time penalties may be
applied for failing to demonstrate such use (Rouse, 2015).
The Health Insurance Portability and Accountability Act (HIPAA)
The HIPAA act provides data privacy and security provisions for
safeguarding medical information. This is intended to guarantee the
privacy of medical information. This act is not directly related to
HITECH but they both reinforce each other in some aspects (Rouse,
2015).
Compliance in the Cloud
Chris Bowen, founder of ClearDATA, says there are three main focus
areas for HIPAA and HITECH regulations related to technology: 1.
Administrative controls: Policies must be in place to determine who has
access to what data. 2. Technical controls: Rules must be in place to
secure data. 3. Physical controls: Standards for physical access to data
and infrastructure resources must be abided by (Butler, 2016).
With the right precautions all of these regulations can be met in a
cloud environment. The majority of public clouds now offer a monitoring
and log functionality. Within the functionality, depending on the cloud,
you can also set up alarms to flag and report any unusual activity. That
covers the administrative controls. If the cloud you choose doesn’t
offer encryption then you aren’t looking at the right options. Clouds
also offer the possibility to deploy virtual security controls such as
an IDS, a WAF or even a DLP. With all data encrypted in the cloud
and some security controls deployed, depending on your needs, you can
cover the technical controls. Finally, most cloud providers offer
assurances to customers regarding physical access to the data centers
hosting their clouds. In this case you are transferring the risk to a
third party but based on the SLA they are obligated to meet and
therefore satisfying the physical controls.
Fraud and Cloud. Friends or foes?
Now that we can check off compliance we are left with fraud, the other big risk. With the migration to the cloud, it is not only your application but also your data that leaves your sight, which means it is no longer protected by whatever perimeter protection you had previously set up. This combined with the fact that cloud enables users to access information from various devices and various locations makes identity and access management more challenging and leaves room for fraud.
Medical identity fraud, which has affected an estimated 1.5 million
Americans, and Financial fraud, which is estimated at $5 billion
annually only in New York, are amongst the most popular types of fraud
(Filkins, 2011).
In the cloud, identity becomes the key to maintaining security,
visibility and control (Filkins, 2011). To solve the identity and access
management problem we need to stop the proliferation of user
credentials. When a system uses multiple credentials for one user, the
user tends to forget and lose them. A Single Sign On (SSO) technology
gives us a solution. A SSO in an authentication service that allows a
user to use one set of credential to access multiple applications.
SSO on its own is not enough, audits are the Robin to our SSO Batman
and the periodic auditing of all accesses and critical transactions will
complete the battle against fraud. This by no means implies that a SSO
service and audits will guarantee that you are going to be fraud free,
it is just a strong strategy and a very good start.
"The allure of on-demand cloud services combined with advances in cloud
security have transformed the healthcare IT mindset from “Why move to
the public cloud?” to “What should we move, how do we do it?”"
(ClearDATA, 2016).
Technology advances everyday, your enterprise must keep up with it. Here is a great article that gives you 9 Tips on securing your hospital’s information on the cloud
References
Recommended blog posts
You might be interested in the following related posts.
