Are health care’s cloud security concerns grounded in reality?

Concerns about cloud security in health care are limiting use by hospitals and health systems, survey finds

Cyberattacks on hospitals and health systems have been increasing, leading to data breaches of sensitive information.

As hackers have been stepping up attacks, more health data is moving to the cloud. The combination of those trends is a recipe for concern for many in health care.

More than half of respondents to a new survey said their health system’s use of the cloud was “significantly limited” by cybersecurity concerns. Another quarter of respondents answered that those concerns had “somewhat limited” use of the cloud. Those results come from new survey research, sponsored by the Center for Connected Medicine (CCM) and conducted by HIIMSS Media, which focused on cloud security perceptions at health systems.

“Many vendors who provide critical applications – such as EMRs – are aggressively moving to the cloud,” said John Houston, Vice President of Privacy and Security and Associate Counsel at UPMC. “In many cases there will not be an option.”

Despite concerns, few real security incidents

Data theft, maintaining regulatory compliance, and managing identity and access were the top external threats related to cloud security named by survey respondents.

The survey also looked at how concerns vary between large and small hospitals. But despite the concerns of IT and business professionals at health systems, very few of the survey respondents could point to known security incidents linked to the cloud.

Less than 10 percent of respondents said they could point to a security incident involving the cloud in the past 12 months, the survey found. An additional 28 percent were unsure. This uncertainty may help explain why survey respondents were much more comfortable using private cloud infrastructure for certain data types. Physician notes, electronic health records, and personal patient data are more likely to be stored in a private cloud than public cloud, according to the survey.

Addressing the reality of cloud security in health care

As cloud technology advances and proliferates in health care, it’s essential for IT professionals to understand how to manage threats across their systems. UPMC’s Houston says almost all health care data will be processed in the cloud in the next five years. For that reason, he says health systems must “address that reality rather than simply digging our heels in and saying no.”