NHS Digital greenlights off-shore data storage

The guidance says it will reduce costs, but campaigners argue it raises data protection concerns

NHS Digital has said that care providers are allowed to store patient data in the cloud if they wish, as part of new guidelines that attempt to reduce costs and increase data sharing across the health sector.

A handful of providers already use public cloud services to store patient information, including NHS Choices and Code4Health, however, the new guidance gives an official nod to its use.

The report, released on Tuesday, sets out guidelines for organisations looking to move data to cloud services, providing they operate within the European Economic Area (EEA), areas within the US that are covered by Privacy Shield, or other countries deemed to have adequate data protections in place.

Part of the guidance will also ensure organisations are able to handle data securely, particularly given the tougher restrictions soon to be enforced by GDPR in May, according to NHS Digital.

"It is for individual organisations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively," said Rob Shaw, Deputy Chief Executive at NHS Digital.

"The guidance being published today will give greater clarity about how these technologies can be used and how data, including confidential patient information, can be securely managed."

He added that the use of cloud services would help avoid instances where patient data is not available due to local hardware failures.

However, the guidance has received criticism over the areas in which health providers can choose to store data, particularly those services in the US.

Jim Killock, executive director of Open Rights Group, told IT Pro: "Allowing data to be transferred to the USA under Privacy Shield is dangerous. Privacy Shield is open to legal challenge because US law lacks privacy protections, especially for surveillance.

"Allowing the NHS to move data to the USA could open up UK patient data for surveillance purposes, and that could have ramifications for patient health. People might avoid getting care, which would obviously be very bad. Patient confidentiality has to come first."

The guidelines may also be seen by many as an attempt by the NHS to reform its image after a number of data protection scandals. In 2011, five NHS bodiesfailed to take "appropriate steps to secure sensitive information", following an investigation by the Information Commissioner's Office.

The organisation also came under fire last year for an "inexcusable" data sharing agreement that allowed Google's DeepMind to access 1.6 million patient records. Following an ICO review, the NHS's agreement with the AI firm was found to be in breach of data protection laws.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Ubiquiti insider says the company downplayed the severity of a major breach
data breaches

Ubiquiti insider says the company downplayed the severity of a major breach

31 Mar 2021
Forex broker FBS leaves millions of customer records exposed
data breaches

Forex broker FBS leaves millions of customer records exposed

25 Mar 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
University of Hertfordshire's entire IT system offline after cyber attack
cyber attacks

University of Hertfordshire's entire IT system offline after cyber attack

15 Apr 2021
NSA uncovers new "critical" flaws in Microsoft Exchange Server
servers

NSA uncovers new "critical" flaws in Microsoft Exchange Server

14 Apr 2021