Analysis of the Security and Privacy Requirements of Cloud-Based Electronic Health Records Systems

Abstract

BackgroundThe Cloud Computing paradigm offers eHealth systems the opportunity to enhance the features and functionality that they offer. However, moving patients’ medical information to the Cloud implies several risks in terms of the security and privacy of sensitive health records. In this paper, the risks of hosting Electronic Health Records (EHRs) on the servers of third-party Cloud service providers are reviewed. To protect the confidentiality of patient information and facilitate the process, some suggestions for health care providers are made. Moreover, security issues that Cloud service providers should address in their platforms are considered.ObjectiveTo show that, before moving patient health records to the Cloud, security and privacy concerns must be considered by both health care providers and Cloud service providers. Security requirements of a generic Cloud service provider are analyzed.MethodsTo study the latest in Cloud-based computing solutions, bibliographic material was obtained mainly from Medline sources. Furthermore, direct contact was made with several Cloud service providers.ResultsSome of the security issues that should be considered by both Cloud service providers and their health care customers are role-based access, network security mechanisms, data encryption, digital signatures, and access monitoring. Furthermore, to guarantee the safety of the information and comply with privacy policies, the Cloud service provider must be compliant with various certifications and third-party requirements, such as SAS70 Type II, PCI DSS Level 1, ISO 27001, and the US Federal Information Security Management Act (FISMA).ConclusionsStoring sensitive information such as EHRs in the Cloud means that precautions must be taken to ensure the safety and confidentiality of the data. A relationship built on trust with the Cloud service provider is essential to ensure a transparent process. Cloud service providers must make certain that all security mechanisms are in place to avoid unauthorized access and data breaches. Patients must be kept informed about how their data are being managed.

Cloud Computing and Healthcare Services

“…In the process of migrating healthcare data to a cloud system, there are security precautions to be taken which include data encryption [8]. While data encryption seems be the most secure method for handling patients data, however not all EHR systems are compatible with standard encryption methods.…”

“…Cloud network security is a must for a secure transfer of data. Digital signature is another method that helps in the process of data security, in addition to having a backup server for the data saved in a cloud as a security measure in case the server is hacked or damaged [8].…”

Salve

“…In particular, we explore the adoption of location information provided by LCS as a second factor of web server authentication. This is motivated by the fact that security-critical online services (e.g., financial services [43,68], e-health services [59]) are often hosted at dedicated and physically-protected locations. The on-site protection makes it difficult or expensive for an adversary to infiltrate such data centers.…”

Implementasi Algoritme 3DES pada Sistem Sharing Electronic Health Record (EHR) Berbasis Cloud

“…Namun, kondisi yang ada saat ini menunjukkan bahwa penyedia layanan kesehatan menyimpan EHR sendiri-sendiri. Hal ini berdampak pada sulitnya mekanisme integrasi dan pertukaran EHR antar penyedia layanan kesehatan [2].Cloud Computing telah menjadi paradigma yang menjanjikan serta mendapat perhatian yang lebih dari akademisi dan industri. Paradigma ini menggeser lokasi dari infrastruktur komputer ke pihak ketiga.…”

“…Namun, kondisi yang ada saat ini menunjukkan bahwa penyedia layanan kesehatan menyimpan EHR sendiri-sendiri. Hal ini berdampak pada sulitnya mekanisme integrasi dan pertukaran EHR antar penyedia layanan kesehatan [2].…”