With new regulations in mind about how medical organisations can store data which could have a future benefit to society, it was with great interest that I read Gary Lieberman’s article on the benefits and drawbacks of storing healthcare data in the cloud. In the article Lieberman sets out a number of aspects for organisations to think about when considering what type of long-term storage to use for sensitive healthcare data.
There is however another model of cloud-based archive infrastructure that in my opinion is better and more secure than many, if not all, of the cloud solutions. Lieberman discusses hybrid cloud, however there is a similar but fundamentally different type of hybrid, one where the data leaving the organisation’s firewall is encrypted on a gateway appliance that sits on the local network, and therefore, within the company’s own firewall.
> See also: Time for a technology check-up: what NHS staff need their IT managers and suppliers to know
This means that the data that gets sent out to, to use Lieberman’s terminology, a 'public cloud’ infrastructure, is data that was encrypted by the company themselves using their own keys. The archive storage provider does not have access to the keys and therefore has no access to or knowledge of the data that it is storing.
In this model, the archive storage provider is providing just that – a chain-of-custody driven service that delivers long-term secure data archiving – of data that it has no knowledge of as it has already been encrypted.
By definition, this model is the most secure option as the client chooses the level of security to apply to their data.
Also in this model, there is no need to consider what data you are storing and force yourself to make difficult, time-consuming and potentially litigious decisions about where to store your data and with what level of security, integrity or level of compliance needs to be applied.
These are generally impossible decisions to make and the parameters applied can, and do, change over time. Data that can be archived to less-secure storage today might need high-security storage tomorrow. There isn’t an easy solution to these problems.
Yes, you still need to select a storage vendor that meets your highest common denominator for the security regulations in your industry, but I’d suggest that this is easier than you think with the majority of vendors; after all, they have a vested interested in being compliant.
It is therefore much better to simply archive all of your data to one level of security and to one very high level of data integrity.
As Lieberman states auditing and standards are of course of paramount importance. These also have to cover the secure connection between the local network and the cloud storage provider’s data centres/cloud. Here in the UK, the healthcare standards that need to be considered include the UK Information Governance Toolkit (IG Toolkit) that includes the option ofdelivery of the storage service via the NHS N3 network.
The IG Toolkit is a UK Department of Health (DoH) policy delivery vehicle that the Health and Social Care Information Centre (HSCIC) is commissioned to develop and maintain. It draws together the legal rules and central guidance set out by DoH policy and presents them in a single standard as a set of information governance requirements.
Organisations, in this case, storage providers, are required to carry out self-assessments of their compliance against the IG requirements. Archiving service providers need to offer delivery of their services via the NHS N3 network; providing the highest level (3) is the benchmark for working with patient identifiable data in the UK.
> See also: How Open Source can bring NHS IT back to the future
The point that Lieberman makes in concluding his article is a good one – flexibility in getting your data into the archive storage is crucial and the range of options you have at your disposal will be a significant factor in the overall ROI of the archiving system.
Over and above the flexibility of the options for migrating data, having the ability to manage and automate the migration is often a key factor in maximising system usage and hence ROI (as well as ensuring compliant migration policies are followed).
So, my final recommendation is to add to your list of migration questions: How am I going to manage data migration? How am I going to create and enforce migration policies?
