NHS Digital declares the public cloud a safe place to store patient data

NHS Digital has declared public cloud services to be a safe location for health and social care providers to store confidential patient information.

In its newly-published cloud computing guidance document, the organisation confirmed the public cloud is cleared for use by NHS organisations, provided certain data sovereignty conditions are met.

“NHS and social care organisations can safely locate health and care data, including confidential patient information, in the public cloud including solutions that make use of data offshoring,” the document said.

“NHS and social care providers may use cloud computing services for NHS data. Data must only be hosted within the European Economic Area (EEA), a country deemed adequate by the European Commission, or in the US where covered by Privacy Shield.”

The guidance adds a proviso that the “upmost care is taken when collecting, transferring, storing and processing patient data."

NHS Digital, the technology arm of the national health and social care system, said the overall aim of the guidance is to provide stakeholders with advice on how to use cloud computing services safely and securely in a healthcare environment.

Rob Shaw, deputy chief executive at NHS Digital, said health and social care organisations stand to benefit greatly from using cloud, particularly from a cost and efficiency standpoint.

“It is for individual organisations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively,” he said.

“The guidance being published today will give greater clarity about how these technologies can be used and how data, including confidential patient information, can be securely managed.”

The emergence of the NHS guidance on public cloud use follows similar advice published by the Government Digital Service (GDS) a year ago, where it announced the technology was safe enough for the “vast majority” of the public sector to use.