Storing PHI on External Drives and Cloud Services

Introduction

As technology advances, healthcare organizations are faced with decisions on how to best store and protect sensitive patient health information (PHI). Two options that are becoming more popular are using external hard drives and cloud-based storage services. However, there are important considerations around security and compliance that must be taken into account when choosing storage solutions for PHI.

External Hard Drives

External hard drives can provide a simple and cost-effective way to store PHI. The data is stored locally on a physical device that can be encrypted and kept secure. Advantages of using external drives include:

• Low upfront costs compared to other storage solutions.
• Easy to setup and maintain.
• Data can be kept entirely under the organization’s control.

However, there are also downsides to consider:

• Risk of physical theft or damage to the device.
• Scalability limitations for large amounts of data.
• No built-in redundancy or backup capabilities.

Proper measures must be taken to ensure external drives storing PHI are encrypted, password protected, and stored in a physically secure location. Organizations should have policies and procedures in place for managing external drives, performing regular backups, and disaster recovery.

Cloud Storage Services

Popular cloud storage services like Google Drive, Dropbox, and Apple iCloud provide flexible and scalable options for storing PHI. Benefits of using cloud storage include:

• Highly scalable with unlimited storage capabilities.
• Accessible from anywhere with an internet connection.
• Built-in redundancy and backup features.
• Managed and maintained by the cloud provider.

However, there are also important considerations around privacy and security of the data stored in the cloud:

• PHI resides on servers outside the healthcare organization’s network.
• Risk of unauthorized exposure or breach of the data.
• Cloud provider access to unencrypted data.

To use cloud services for PHI, healthcare organizations should take steps to encrypt data, utilize access controls, and conduct risk assessments. It is also essential to vet the specific cloud provider based on their security measures and compliance with regulations like HIPAA.

Compliance Considerations

When evaluating storage solutions for PHI, compliance with regulations like HIPAA must be considered. HIPAA requires technical, administrative and physical safeguards to ensure the confidentiality, integrity and security of PHI. Key compliance considerations include:

• Utilizing encryption technologies to render PHI unreadable without access keys.
• Having policies that limit PHI access only to authorized users.
• Implementing access controls and auditing capabilities.
• Ensuring oversight of third party providers like cloud services.
• Maintaining disaster recovery and emergency plans.

Properly vetting the security measures of any external storage provider or service is critical for HIPAA compliance.

Conclusion

External hard drives and cloud-based services can both enable the scalable and secure storage of PHI if proper precautions are taken. Healthcare organizations must weigh factors like cost, accessibility, security features, and compliance considerations when deciding where to store sensitive patient data. Following best practices around encryption, access controls, policies, and third party oversight can help reduce risks and meet regulatory obligations.

Emerging Storage Technologies

In addition to traditional external hard drives and popular cloud platforms, new technologies are emerging that can also meet PHI storage needs in a secure and compliant manner.

Blockchain

Blockchain is a distributed ledger technology that records transactions in a verifiable, permanent way. For healthcare, blockchain can create an immutable audit trail for PHI access that satisfies HIPAA requirements. However, PHI should be encrypted before being placed on blockchain to enhance privacy protections.

Biometric Authentication Devices

As biometrics become more advanced, wearable devices can provide identity verification based on unique attributes like fingerprints or voice recognition. Biometric authentication devices worn by healthcare professionals could essentially act like external hard drives for PHI while also controlling access. The data could only be retrieved when the authorized user is wearing the device.

Secure Multiparty Computation

Secure multiparty computation (MPC) allows different entities to jointly compute on encrypted data without exposing the underlying content. MPC could enable access to PHI from multiple authorized parties without decrypting data in transit or use. This maintains privacy while unlocking analytics potential.

PHI Storage Responsibility

With various options available for scalable and secure PHI storage, responsibility ultimately lies with the healthcare organization to perform due diligence. Steps that should be taken include:

• Conducting exhaustive risk analyses of different storage technologies.
• Vetting security measures, protocols, and certifications of providers.
• Employing encryption best practices for stored PHI data.
• Having breach notification procedures ready in the event of any failure.
• Maintaining strict oversight of internal access and external sharing.
• Following leading practices to satisfy evolving regulations.

Staying up to date on advances in storage solutions, while also adhering to core security principles, is key for protecting PHI.

Patient Perceptions

Patient perceptions should also be considered around PHI storage. Surveys have shown that a majority of patients are uncomfortable with external third parties like cloud providers accessing their health data. Transparency into security measures and stewardship practices is important.

Conclusion

Protecting sensitive PHI presents significant technical and regulatory challenges. As healthcare data storage needs grow, there is no universal solution. Organizations must take a layered approach that incorporates encryption, access controls, oversight, backups and auditing to keep pace with emerging threats and innovations. Putting patients first through education and transparency can also help ease concerns in an increasingly complex digital landscape.