Cloud Data Security
February 14, 2012, Cloud Connect Conference, Santa Clara, CA—Bill Gillis, director of eHealth Technologies at Beth Israel Deaconess Medical Center described the challenges of data privacy in a cloud environment. The medical center consists of 1500 physicians in 300 separate practices in Massachusetts.
When they created a new data center, they needed it to be scalable and modular. One problem at the beginning was that the deployment schedule and scale were unknown. The constraints on moving into the new system included the willingness of physicians to change to electronic records, and their own ability to provide hardware and software to the various practices. Another variable came into the picture when the federal government started providing financial incentives for doctors to convert to electronic medical records.
They built out their system with a modular architecture to address scalability and security issues. The system is built of consumer-grade hardware tied together through VMware. This design helped to reduce the hardware costs, and as a sidelight also reduced the cost of the records conversions. Additional benefits beyond scalability and flexibility included the ability to enhance security aspects of the system.
Centralizing the security aspects of the system is very important in a medical environment because of the heavy consequences of a data breach. Their system is being attacked about every 10 seconds, 24 hours a day. If any records are breached, there are severe financial penalties for remediation and restitution, and more importantly the loss of the patient’s trust in the system.
As a result, in the process of developing the system, security testing was a critical component. Central control of policies and practices is important, especially when the and users may not have the technical expertise to manage the data security. Although their system is comprised of standard hardware and software, they instituted a number of capabilities for detection and protection within the system. They tested the security functions in many different scenarios and added forensics capabilities to track and manage threat vectors.
Their system is now working and deployed to the full complement of physicians and practices. Their long-term goal is to migrate operations to a public cloud, but the need for end-to-end privacy and security means they will have to continually evolve their security systems.
