IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

NHS Digital greenlights off-shore data storage

The guidance says it will reduce costs, but campaigners argue it raises data protection concerns

NHS Digital has said that care providers are allowed to store patient data in the cloud if they wish, as part of new guidelines that attempt to reduce costs and increase data sharing across the health sector.

A handful of providers already use public cloud services to store patient information, including NHS Choices and Code4Health, however, the new guidance gives an official nod to its use.

The report, released on Tuesday, sets out guidelines for organisations looking to move data to cloud services, providing they operate within the European Economic Area (EEA), areas within the US that are covered by Privacy Shield, or other countries deemed to have adequate data protections in place.

Part of the guidance will also ensure organisations are able to handle data securely, particularly given the tougher restrictions soon to be enforced by GDPR in May, according to NHS Digital.

"It is for individual organisations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively," said Rob Shaw, Deputy Chief Executive at NHS Digital.

"The guidance being published today will give greater clarity about how these technologies can be used and how data, including confidential patient information, can be securely managed."

He added that the use of cloud services would help avoid instances where patient data is not available due to local hardware failures.

However, the guidance has received criticism over the areas in which health providers can choose to store data, particularly those services in the US.

Jim Killock, executive director of Open Rights Group, told IT Pro: "Allowing data to be transferred to the USA under Privacy Shield is dangerous. Privacy Shield is open to legal challenge because US law lacks privacy protections, especially for surveillance.

"Allowing the NHS to move data to the USA could open up UK patient data for surveillance purposes, and that could have ramifications for patient health. People might avoid getting care, which would obviously be very bad. Patient confidentiality has to come first."

The guidelines may also be seen by many as an attempt by the NHS to reform its image after a number of data protection scandals. In 2011, five NHS bodiesfailed to take "appropriate steps to secure sensitive information", following an investigation by the Information Commissioner's Office.

The organisation also came under fire last year for an "inexcusable" data sharing agreement that allowed Google's DeepMind to access 1.6 million patient records. Following an ICO review, the NHS's agreement with the AI firm was found to be in breach of data protection laws.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022