Storing Health Records in the Cloud: 10 Reasons Why Its a Bad Idea

by Chris Preimesberger

This is always the No. 1 issue with any cloud storage. It’s difficult for most people to come to grips with the fact that they do not have their files actually in hand; that someone else has control over them, even if they are easy to access online and the provider is a legitimate, branded vendor.

The concept of cloud data storage, which nearly always means that files are broken into chunks and may be stored on multiple data centers around the world, is difficult for non-IT folks to grasp. This means that physicians and patients have to completely trust service providers, Bertman said.

Check the service-level agreement very carefully: Who exactly will have access to your records? Caregivers, cloud IT personnel, hospital administrators, security staff – the list may be longer then you realize. “You would hope that it’s not personally identifiable data, but you’re never sure,” Bertman said.

As is true for any cloud service, cloud storage is a business that can change at any time. In 2001, GE Healthcare bought health records provider Encounter EHR and eventually ended up shutting it down – giving records holders 30 days’ notice to reclaim their data or lose it. This caused a great number of problems. This is a rare occurrence, however.

For example, Allscripts’ MyWay service costs $700 per month per health care provider. GE Healthcare’s new Centricity Advance service will cost doctors from $300 to $800 a month. Most client-server software packages are much less expensive.

Companies hosting the cloud services control, and thus can monitor, data and communications at will. How much of your health care information should be seen by you and your health care provider only? This information is buried in legal verbiage and is often easily overlooked or misunderstood by caregivers and patients.

To help save their own costs, many physicians are using a free-of-charge cloud EHR system called Practice Fusion that provides pharmaceutical ads to the physician at the point of care. “This is a little bit of a slippery slope,” Bertman said. “For example, a doctor may see an ad for Prilosec while he’s seeing a patient for heartburn.” Because such ads are targeted, tracked and carefully monitored, the question is whether a cloud-based EHR compromises patient privacy as well as the quality of care.

On most EHR setups, every click takes you to a new screen, thus documenting even simple notes can take dozens of screens, Bertman said. Because they are often so slow-moving, many users of these cloud-based EHRs can’t finish a note while seeing the patient. “If you’re seeing 25 patients a day, which is an average, and the system is slow, it can be impossible to finish documentation,” Bertman said.

With a cloud-based service package, just like any other cloud service, the Internet is the thoroughfare and it is subject to service outages, power outages, acts of God and other uncontrollable events. Physicians need to have their charts in front of them at all times; if the patient’s chart is not available because the ISP is down, then patient care could be compromised.

Because of the sensitive health, and in many cases, financial, information in this data, cloud-based EHRs are much bigger targets for hacker attacks from around the globe.