title: Analysis of the security and privacy requirements of cloud-based electronic health records systems.
abstract: BACKGROUND
  The Cloud Computing paradigm offers eHealth systems the opportunity to enhance the features and functionality that they offer. However, moving patients' medical information to the Cloud implies several risks in terms of the security and privacy of sensitive health records. In this paper, the risks of hosting Electronic Health Records (EHRs) on the servers of third-party Cloud service providers are reviewed. To protect the confidentiality of patient information and facilitate the process, some suggestions for health care providers are made. Moreover, security issues that Cloud service providers should address in their platforms are considered.
  
  
  OBJECTIVE
  To show that, before moving patient health records to the Cloud, security and privacy concerns must be considered by both health care providers and Cloud service providers. Security requirements of a generic Cloud service provider are analyzed.
  
  
  METHODS
  To study the latest in Cloud-based computing solutions, bibliographic material was obtained mainly from Medline sources. Furthermore, direct contact was made with several Cloud service providers.
  
  
  RESULTS
  Some of the security issues that should be considered by both Cloud service providers and their health care customers are role-based access, network security mechanisms, data encryption, digital signatures, and access monitoring. Furthermore, to guarantee the safety of the information and comply with privacy policies, the Cloud service provider must be compliant with various certifications and third-party requirements, such as SAS70 Type II, PCI DSS Level 1, ISO 27001, and the US Federal Information Security Management Act (FISMA).
  
  
  CONCLUSIONS
  Storing sensitive information such as EHRs in the Cloud means that precautions must be taken to ensure the safety and confidentiality of the data. A relationship built on trust with the Cloud service provider is essential to ensure a transparent process. Cloud service providers must make certain that all security mechanisms are in place to avoid unauthorized access and data breaches. Patients must be kept informed about how their data are being managed.
authors: Instituto de Telecomunicações, University of Beira Interior, Covilha, Portugal. joeljr@ieee.org
authors: Joel J P C
authors: 0000-0001-8657-3800
authors: JJ
authors: Rodrigues
authors: Isabel
authors: I
authors: de la Torre
authors: Gonzalo
authors: G
authors: Fernández
authors: Miguel
authors: M
authors: López-Coronado
mesh_terms: D016494:Computer Security; D019451:Information Management; D016347:Medical Records Systems, Computerized; D018907:Privacy
keywords: cloud-computing; eHealth; electronic health records (EHRs); privacy; security
references: J Am Med Inform Assoc. 2007 Jul-Aug;14(4):478-88
references: 17460139
references: J Med Syst. 2012 Oct;36(5):3019-27
references: 21947856
references: Telemed J E Health. 2010 Mar;16(2):167-76
references: 20082592
references: J Med Internet Res. 2011 Sep 21;13(3):e67
references: 21937354
references: Telemed J E Health. 2008 Apr;14(3):210-4
references: 18570543
references: J Med Syst. 2012 Dec;36(6):3543-53
references: 22366976
references: Bioinformatics. 2009 Jun 15;25(12):1475
references: 19435745
references: J Med Syst. 2012 Oct;36(5):3233-41
references: 22205383
references: Am J Prev Med. 2011 Jun;40(6):629-32
references: 21565655
references: Telemed J E Health. 2008 Apr;14(3):284-8
references: 18570554
references: J Med Syst. 2012 Dec;36(6):3777-82
references: 22492177
references: J Med Syst. 2012 Oct;36(5):3375-84
references: 22351166