The information that health providers maintain is, of course, particularly sensitive, but concerns with cloud computing over privacy and security are common across industries and in government. At the federal level, CIOs have developed a uniform set of standards for certifying cloud providers.
The Federal Risk and Authorization Management Program, or FedRAMP, is intended as a repeatable certification process, so once a vendor has been awarded the credential, CIOs across the government would have the confidence to deploy its technology within their departments and agencies.
Security Concerns Overrated
The security concerns surrounding the cloud are also to some degree a problem of perception, according to Chenok, who counsels federal CIOs that the real issue of security turns on the implementation of a cloud deployment.
"The cloud itself isn't inherently more or less secure, at least in my view ... than other forms of computing. You can implement a mainframe really well or really badly and create lots of holes. And you can implement a cloud scenario really well with lots of continuous monitoring points and real-time response and patching that's done in real time, et cetera, or you can do it poorly," Chenok says. "The cloud has properties that can lend great security to any transaction--health, education, consumer transaction, government transaction."
Additionally, there is an ongoing effort in Congress to rewrite a 1986 privacy law to provide additional legal protections to documents and communications such as Web-based email that are stored in the cloud.
Earlier this month, Sen. Patrick Leahy (D-Vt.) said that he intends to reintroduce legislation to revise the Electronic Communications Privacy Act (ECPA) to require law-enforcement authorities to obtain a warrant from a judge before they can compel a cloud-service provider to release remotely stored emails that are more than six months old, among other reforms.
Kenneth Corbin is a Washington, D.C.-based writer who covers government and regulatory issues for CIO.com.