Column

---

Cloud computing in general practice – what needs to be considered?

---

Cloud computing is becoming an increasingly popular tool in general practice, and for good reason.
 
Engaging with a cloud-based service often provides practices with an effective, cost saving and all-round convenient information storage solution. However, doing so comes with a unique set of risks.
 
Before delving into some of the considerations practice teams need to keep in mind when engaging with cloud-based services, let’s begin with the basics.
 
What is cloud computing?
Cloud computing involves using external servers to store your practice information and data.
 
Essentially, using cloud computing means storing your practice information online via a cloud computing service of your choice, relieving you from having to own and maintain servers and other data storage hardware.
 
How are practices using cloud-based services?
This will most often depend on a practice’s specific needs and what they feel comfortable with.
 
Some practices are only dabbling in the technology by using a cloud service provider to host their website, while others are fully embracing the technology and using it to store all of their patient and practice data.
 
Some clinical software vendors are also now offering cloud-based alternatives, allowing practices to move even more of their business functionality into a cloud environment.
 
What are some advantages of cloud computing?
Using a cloud-based service: 

• can, over time, reduce the costs involved in managing and maintaining your own local IT systems
• helps to ensure business continuity during natural disasters, power failures and other emergencies
• will, in time and as cloud technology becomes more commonly used within the healthcare sector, facilitate more simplified sharing of information with third parties
• allows your team to easily access patient records when working off-site
• eases the burden of protecting and maintaining practice information (as part of your contract, the nominated cloud service provider should organise regular, automated updates and upgrades of their technology). 

What sort of risks do I need to be aware of?
Seeing as we are dealing with highly sensitive and confidential information every day, engaging with a third-party cloud service provider may entail risks, such as: 
 

• an inability to access information if your cloud service provider is experiencing technical issues
• the potential for privacy and data security breaches to occur, especially in cases where practices are not aware of their obligations and the cloud service provider’s responsibilities under the Privacy Act 1988. For example, practices need to know where their cloud service provider intends on storing their data – if, for any reason, practice data needs to be sent out of Australia, it is the practice’s responsibility to confirm with the service provider that their data will be managed in accordance to the Australian Privacy Principals guidelines
• the possibility of unauthorised access of your practice data as it travels across networks
• insufficient physical security of your nominated offsite cloud storage facility
• the potential for attacks by malicious software. 

You should also keep in mind that cloud-based technology relies on your practice having a very fast, stable internet connection.
 
Before moving on, I think it is important to remember that all practice data management solutions, whether you’re keeping hard copies of information or utilising online tools, come with an array of risks. While it’s important that all relevant risks are taken seriously and thoroughly considered, cloud computing has the potential to change the way in which your team manages information for the better, especially as we all move towards a predominantly digital healthcare system.
 
Mitigating the risks
To help mitigate some of the risks involved in cloud-based computing, I would recommend beginning by working with your IT provider to perform a risk assessment of your current or planned information management system.
 
Become aware of your practice’s obligations, along with your cloud service provider’s responsibilities under the Privacy Act and understand how your practice information will be stored and kept secure by your cloud service provider.
 
Importantly, the service agreement between your practice and your nominated cloud service provider should detail who has access to your information and how relevant security risks will be managed. Seeking advice and assistance from your practice’s insurer or lawyer in the development of these types of service agreements is strongly advised.
 
My final recommendation is to have written policies and procedures that detail how your team can continue managing your patients and their information, should your cloud service provider experience technical difficulties, or if your internet connection fails.
 
As with all technology, cloud-based technologies continue to advance. At this stage, there are only a few cloud-native clinical software systems available in Australia. Cloud-native systems are developed using cloud-based technologies and are designed specifically to operate in a cloud environment.
 
The advantage of these systems is that they are highly scalable and allow developers to make changes easily without impacting service delivery. However, other clinical software systems that are not cloud-native are still able to be hosted in the cloud and function as cloud-based systems.
 
If you and your team are considering using a cloud-based service to help manage your practice information, I encourage you to visit the RACGP’s Information security in general practice resource.
 
It contains some helpful guidance on using cloud services, securing your network, performing risk assessments, developing policies and procedures and much more. It is an excellent tool to use in collaboration with your IT provider to ensure you and your team are managing all of your practice data appropriately.
 
We are yet to see the full potential of this type of technology and I encourage you to stay in-the-know, perhaps even ahead of the curve, by keeping an eye on developments in this area.
 
Log in below to join the conversation

---

---

cloud computing cyber digital information security managing health information risk assessment

---