IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

NHS Digital greenlights off-shore data storage

The guidance says it will reduce costs, but campaigners argue it raises data protection concerns

NHS Digital has said that care providers are allowed to store patient data in the cloud if they wish, as part of new guidelines that attempt to reduce costs and increase data sharing across the health sector.

A handful of providers already use public cloud services to store patient information, including NHS Choices and Code4Health, however, the new guidance gives an official nod to its use.

The report, released on Tuesday, sets out guidelines for organisations looking to move data to cloud services, providing they operate within the European Economic Area (EEA), areas within the US that are covered by Privacy Shield, or other countries deemed to have adequate data protections in place.

Part of the guidance will also ensure organisations are able to handle data securely, particularly given the tougher restrictions soon to be enforced by GDPR in May, according to NHS Digital.

"It is for individual organisations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively," said Rob Shaw, Deputy Chief Executive at NHS Digital.

"The guidance being published today will give greater clarity about how these technologies can be used and how data, including confidential patient information, can be securely managed."

He added that the use of cloud services would help avoid instances where patient data is not available due to local hardware failures.

However, the guidance has received criticism over the areas in which health providers can choose to store data, particularly those services in the US.

Jim Killock, executive director of Open Rights Group, told IT Pro: "Allowing data to be transferred to the USA under Privacy Shield is dangerous. Privacy Shield is open to legal challenge because US law lacks privacy protections, especially for surveillance.

"Allowing the NHS to move data to the USA could open up UK patient data for surveillance purposes, and that could have ramifications for patient health. People might avoid getting care, which would obviously be very bad. Patient confidentiality has to come first."

The guidelines may also be seen by many as an attempt by the NHS to reform its image after a number of data protection scandals. In 2011, five NHS bodiesfailed to take "appropriate steps to secure sensitive information", following an investigation by the Information Commissioner's Office.

The organisation also came under fire last year for an "inexcusable" data sharing agreement that allowed Google's DeepMind to access 1.6 million patient records. Following an ICO review, the NHS's agreement with the AI firm was found to be in breach of data protection laws.

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Most Popular

What's powering Britain’s fibre broadband boom?
Network & Internet

What's powering Britain’s fibre broadband boom?

3 Feb 2023
Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
Windows 10 users locked out of devices by unskippable Microsoft 365 advert
bugs

Windows 10 users locked out of devices by unskippable Microsoft 365 advert

3 Feb 2023