Slashdot Mirror
UK Hospitals Can Now Store Confidential Patient Records In the Public Cloud (zdnet.com)
The National Health Service (NHS) has given hospitals the go-ahead to store sensitive patient records in the cloud. "NHS Digital said the advantages of using cloud services include cost savings associated with not having to buy and maintain hardware and software, and availability of backup and fast system recovery," reports ZDNet. "'Together these features cut the risk of health information not being available due to local hardware failure,' said the report." From ZDNet: Rob Shaw, deputy chief executive at NHS Digital, said: "It is for individual organizations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively." The UK government introduced a 'cloud first' policy for public sector IT in 2013, and NHS Choices and NHS England's Code4Health initiative are already successfully using the cloud. NHS Digital's guidance said that the NHS and social care providers may use cloud computing services for NHS data, although data must only be hosted within the European Economic Area, a country deemed adequate by the European Commission, or in the U.S. where covered by Privacy Shield.
But do they see the disadvantages...?
There should at least be strict requirements about encryption and passwords.
n/t.
Yes! I can see THIS ending well!
*Facepalm*
Chas - The one, the only.
THANK GOD!!!
"The cloud" is setting itself up for a really huge public failure because a breach in one portion can more easily be re-used in all portions. If the back ends are consistent enough to get the economy-of-scale cloud promises, that consistency also means hackers can leverage their knowledge to get access to a larger group of systems.
This is NOT saying that on average clouds are riskier, it only means that breaches will be quite public because it will affect more organizations.
It's sort of comparable to travelling by car versus plane. Cars are overall more risky per mile, but you don't see car crashes in the news very often, at least not in proportion to those killed. But plane crashes are usually headlines. The cloud is a plane.
Table-ized A.I.
They "dispute" the figure of course.
Around the time of WannaCry
"A reported 90 percent of NHS trusts run at least one Windows XP device, an operating system Microsoft first introduced in 2001 and hasn't supported since 2014."
https://www.wired.com/2017/05/...
What could possibly go wrong?
as long as the data is fully encrypted while sitting on or traversing cloud networks.
If they decrypt / encrypt it locally on the client or even a hospital owned proxy server, then the data should be fine.
At no point should this type of data reside on the cloud or the connecting networks outside of the hospital in any unencrypted form.
...than letting hundreds of hospitals store their own records individually on their own systems with variable levels of IT security competence in the teams managing them.
Hacking the NHS records should turn out to be more profitable than some of the crappy ransomware going around.
It's not like anything is safe anymore, unless it's literally offline storage -- and then only if you do a backup of your backup with a machine that's never connected to the Internet, ever. Better print out paper copies and copy those, too, just to be safe. At least until the criminal hacker organizations find a way to ransomware your paper copies, too.
On an associated subject: with all the advances being made with neural interfaces, how long do y'all think it'll be before they have ransomware for your wetware? "Nice memories you have there, friend; would be a shame if something.. happened to them.."
... of course not openly, but through a maze of sub-sub-sub-sub-contractors ultimately handling the "cloud" hardware the NHS information will reside on.
And I am sure they will keep that data safe, and well back-up-ed, given how valuable it might become when tinkering with the next election or blackmailing the next politician.
As mentioned in the article, the NHS has had a "Cloud First" policy since 2013. This is advertorial for a cloud services proovider.
Not only did they choose to ignore the thousands who opted out of records being digitised and shared but now they're uploading it to the public cloud.
Their history of competence in IT isn't exactly inspiring.
Who do I sue when my records are inevitably leaked?
For any deployment of reasonable size, the cloud is not economical. Yes it does save you from having to hire hardware jockeys, but you have to replace them all with experts in cloud provisioning and configuration. For the UK NHS to move to the cloud is going to cost them a boatload of money.
At least all those pounds sterling will likely pay for actual security and robustness, but it’s bothing they couldn’t have gotten by spending even less to build and maintain it themselves.
One of the first rules of database design is to capture every piece of data only once, and then keep it secure. I don't want to have to tell every new doctor I visit my mediacal history all over again from the beginning, and then keep regurgitating it everyyear for every practitioner. If information like my age when I had measles is important, we can't keep running the risk that I will start getting the date wrong as the years go by.
I want an online medical jacket that contains my entire history, accessible to every doctor who needs to know my list of medications, including those that were tried and given up on, so that I don't have to keep imperfectly remembering whether Dr. Fuzzbucket stopped prescribing Spenditol-X because it didn't work for me, or because I had an allergic reaction.
And no, because hackers were able to attack Target does not mean that keeping online records secure is impossible. My bank and my brokerage have operated online for years, so why can't healthcare?
First google search on NHS leak records:
https://www.google.com/search?...
Why guess when you can know? Measure!