Cloud EHR vs on premise EHR: security and compliance considerations

Many Montana practices still run their EHR on a server in a back closet. Others have moved to a cloud hosted system, and plenty are weighing the switch. Both can be secure and HIPAA compliant. Neither is automatically safer.

The real question is who is responsible for each piece, and whether anyone is actually doing it. Here is how the two models compare on security, compliance and the questions practices raise most: where the data lives, who controls it, and what happens when something breaks.

HIPAA applies the same way either way

HIPAA doesn't favor cloud or on premise. Your practice is the covered entity in both cases. You are responsible for protecting ePHI, and every system that stores it belongs in your HIPAA security risk analysis.

When a cloud vendor creates, receives, stores or transmits patient data for you, it is a business associate and needs a signed business associate agreement. HHS guidance on cloud computing says this applies even when the vendor stores only encrypted data and doesn't hold the key. "We can't see your data" doesn't remove the need for a BAA.

Shared responsibility: what the vendor covers and what you still own

Moving to the cloud shifts some work off your plate. It does not shift all of it. A cloud EHR vendor typically handles the servers, the data center, the database and the security of the application itself. You still own:

• Who has an account, what each role can see, and how quickly accounts are removed when people leave.
• MFA on every login, especially for remote and administrative access.
• The workstations, tablets and phones staff use to reach the EHR.
• Your office network, WiFi and firewall.
• Phishing, which is the usual way cloud accounts are taken over.
• Reviewing the vendor's access logs for activity that doesn't fit.

With an on premise EHR, you or your IT provider own all of that, plus the server, its operating system, the database and the backups.

Where the data lives: residency and data sovereignty

People often ask about data sovereignty, meaning whose laws apply to data based on where it is stored. HIPAA itself doesn't require patient data to stay in the United States. HHS guidance allows a covered entity to use a cloud provider that stores ePHI on servers outside the country, provided there is a BAA and the risks of that location are addressed in the risk analysis.

In practice, most US EHR vendors host in US data centers, and payer contracts, state programs and federal grants can add their own requirements. Before you sign, ask the vendor in writing:

• Where your data is stored, and where the backups are stored.
• Whether any support staff outside the US can access it.
• How data is encrypted at rest and in transit.
• How you get a complete, usable copy of your records if you leave, and what it costs.

The on premise tradeoffs

A local server gives you control, and it keeps working when the internet is down as long as your server and office network are up. That control comes with work that small practices often fall behind on:

• Patching the server, the database and the EHR application on schedule.
• Replacing the server before its operating system goes out of support.
• Physical security for the closet it sits in.
• Backups copied offsite and isolated from the network, with restores that are actually tested.
• Ransomware exposure, because an attacker who gets into your network can reach the server directly.

The weak point is usually not the model itself. It is an aging server with no replacement plan and backups nobody has tried to restore. Our article on ransomware and Montana practices covers the backup side in more detail.

The cloud tradeoffs

A cloud EHR takes the server out of your closet but makes you dependent on your internet connection and your vendor:

• If the internet goes down, so does access to charts. In rural Montana, a second connection from a different provider, or a cellular backup, is worth budgeting for.
• Vendor outages happen, and you can't fix them. Ask about the vendor's uptime commitment, how it communicates during an outage, and how it backs up and restores your data.
• Account takeover replaces server compromise as the main risk. A phished password without MFA is the usual way in.
• Leaving can be hard. Find out the export format and cost before you commit, not when you want to switch.

Plan for downtime in both models

Whichever you choose, write down what the practice does when the EHR is unavailable: how you check in patients, record care, handle prescriptions, and enter that information afterward. Then set your RTO and RPO, meaning how long you can operate without the system and how much recent data you can afford to lose. Confirm that your backups, or your vendor's commitments, actually meet those numbers.

Which model fits your practice

• Cloud tends to fit small practices and those with several locations, practices without dedicated IT, practices whose server is due for replacement, and providers who need access from home or a satellite clinic.
• On premise tends to fit practices with unreliable internet and no backup connection, practices with specialty systems that need tight local integration, and organizations with IT staff who will patch, monitor and replace the hardware on schedule.
• Hybrid is common. Many practices run a cloud EHR alongside local imaging or lab systems. In that case, both sets of responsibilities apply.

Where to start

List where your patient data lives today, who is responsible for each piece, and when your server or EHR contract is up for renewal. If you are weighing a move, our healthcare managed IT team can review the vendor's BAA, security terms and export options with you before you sign, and plan the cutover around clinic hours.