Slashdot Mirror
UK Hospitals Can Now Store Confidential Patient Records In the Public Cloud (zdnet.com)
The National Health Service (NHS) has given hospitals the go-ahead to store sensitive patient records in the cloud. "NHS Digital said the advantages of using cloud services include cost savings associated with not having to buy and maintain hardware and software, and availability of backup and fast system recovery," reports ZDNet. "'Together these features cut the risk of health information not being available due to local hardware failure,' said the report." From ZDNet: Rob Shaw, deputy chief executive at NHS Digital, said: "It is for individual organizations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively." The UK government introduced a 'cloud first' policy for public sector IT in 2013, and NHS Choices and NHS England's Code4Health initiative are already successfully using the cloud. NHS Digital's guidance said that the NHS and social care providers may use cloud computing services for NHS data, although data must only be hosted within the European Economic Area, a country deemed adequate by the European Commission, or in the U.S. where covered by Privacy Shield.
n/t.
Yes! I can see THIS ending well!
*Facepalm*
Chas - The one, the only.
THANK GOD!!!
"The cloud" is setting itself up for a really huge public failure because a breach in one portion can more easily be re-used in all portions. If the back ends are consistent enough to get the economy-of-scale cloud promises, that consistency also means hackers can leverage their knowledge to get access to a larger group of systems.
This is NOT saying that on average clouds are riskier, it only means that breaches will be quite public because it will affect more organizations.
It's sort of comparable to travelling by car versus plane. Cars are overall more risky per mile, but you don't see car crashes in the news very often, at least not in proportion to those killed. But plane crashes are usually headlines. The cloud is a plane.
Table-ized A.I.
They "dispute" the figure of course.
Around the time of WannaCry
"A reported 90 percent of NHS trusts run at least one Windows XP device, an operating system Microsoft first introduced in 2001 and hasn't supported since 2014."
https://www.wired.com/2017/05/...
What could possibly go wrong?
as long as the data is fully encrypted while sitting on or traversing cloud networks.
If they decrypt / encrypt it locally on the client or even a hospital owned proxy server, then the data should be fine.
At no point should this type of data reside on the cloud or the connecting networks outside of the hospital in any unencrypted form.
...than letting hundreds of hospitals store their own records individually on their own systems with variable levels of IT security competence in the teams managing them.
Hacking the NHS records should turn out to be more profitable than some of the crappy ransomware going around.
It's not like anything is safe anymore, unless it's literally offline storage -- and then only if you do a backup of your backup with a machine that's never connected to the Internet, ever. Better print out paper copies and copy those, too, just to be safe. At least until the criminal hacker organizations find a way to ransomware your paper copies, too.
On an associated subject: with all the advances being made with neural interfaces, how long do y'all think it'll be before they have ransomware for your wetware? "Nice memories you have there, friend; would be a shame if something.. happened to them.."
... of course not openly, but through a maze of sub-sub-sub-sub-contractors ultimately handling the "cloud" hardware the NHS information will reside on.
And I am sure they will keep that data safe, and well back-up-ed, given how valuable it might become when tinkering with the next election or blackmailing the next politician.
Why would they care?
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission
https://en.wikipedia.org/wiki/...
Brexit is the prospective withdrawal of the United Kingdom (UK) from the European Union (EU).
https://en.wikipedia.org/wiki/...
Everything I write is lies, read between the lines.
The UK version of the principles of GDPR, as in the country specific legislation, which all in EU are implementing, is already agreed to be enacted. Brexit has nothing to do with it and doesn't mean it will be discarded.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
For any deployment of reasonable size, the cloud is not economical. Yes it does save you from having to hire hardware jockeys, but you have to replace them all with experts in cloud provisioning and configuration. For the UK NHS to move to the cloud is going to cost them a boatload of money.
At least all those pounds sterling will likely pay for actual security and robustness, but it’s bothing they couldn’t have gotten by spending even less to build and maintain it themselves.
One of the first rules of database design is to capture every piece of data only once, and then keep it secure. I don't want to have to tell every new doctor I visit my mediacal history all over again from the beginning, and then keep regurgitating it everyyear for every practitioner. If information like my age when I had measles is important, we can't keep running the risk that I will start getting the date wrong as the years go by.
I want an online medical jacket that contains my entire history, accessible to every doctor who needs to know my list of medications, including those that were tried and given up on, so that I don't have to keep imperfectly remembering whether Dr. Fuzzbucket stopped prescribing Spenditol-X because it didn't work for me, or because I had an allergic reaction.
And no, because hackers were able to attack Target does not mean that keeping online records secure is impossible. My bank and my brokerage have operated online for years, so why can't healthcare?
Brexit has nothing to do with it
Brexit has something to do with it.
and doesn't mean it will be discarded.
But it means they can adapt it as they see fit:
http://www.computerweekly.com/...
Everything I write is lies, read between the lines.
First google search on NHS leak records:
https://www.google.com/search?...
Why guess when you can know? Measure!
If one company gets to encrypt for the gov then other contractors cant get the money thats on the table.
Thats why so much of the US gov/mil work is plain text, on internet facing networks.
Domestic spying is now "Benign Information Gathering"
Brexit isn't going to change GDPR, it'll come in place before Brexit happens and such regulations will be applied in UK law. The UK was heavily involved in developing GDPR so isn't going to be looking to dodge it. Plus it's the easiest way to be considered "adequate" to keep doing business with the rest of Europe and not need some custom arrangement for data transfers.
Not sure what relevance the OP has anyway, using cloud services doesn't mean you're not compliant with GDPR or any other regulation.
They also might remember the Health and Social Care Act of 2015 which makes a hospital liable if patient care is adversely affected by not sharing patient data with another hospital.
Brexit has nothing to do with it. There is currently a bill going through Parliament that will implement all current EU laws at the time of our exit in March into UK law.
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams