Reconciliation of the cloud computing model with US federal electronic health record regulations

• Published in: Journal of the American Medical Informatics Association : JAMIA Vol. 19; no. 2; pp. 161 - 165
• Main Author: Schweitzer, Eugene J
• Format: Journal Article
• Language: English
• Published: England BMJ Group 01.03.2012
• Subjects: Computer Security - legislation & jurisprudence; Computer Simulation; Computers; Electronic Health Records - legislation & jurisprudence; Electronic Health Records - organization & administration; Federal Government; Government Regulation; Health Insurance Portability and Accountability Act; Hospital Information Systems - organization & administration; Information Storage and Retrieval; Internet; Privacy - legislation & jurisprudence; Software; United States; United States
• ISSN: 1067-5027; 1527-974X
• DOI: 10.1136/amiajnl-2011-000162

Cloud computing refers to subscription-based, fee-for-service utilization of computer hardware and software over the Internet. The model is gaining acceptance for business information technology (IT) applications because it allows capacity and functionality to increase on the fly without major investment in infrastructure, personnel or licensing fees. Large IT investments can be converted to a series of smaller operating expenses. Cloud architectures could potentially be superior to traditional electronic health record (EHR) designs in terms of economy, efficiency and utility. A central issue for EHR developers in the US is that these systems are constrained by federal regulatory legislation and oversight. These laws focus on security and privacy, which are well-recognized challenges for cloud computing systems in general. EHRs built with the cloud computing model can achieve acceptable privacy and security through business associate contracts with cloud providers that specify compliance requirements, performance metrics and liability sharing.