Is the Cloud Safe for Patient Data? A Lab Manager's Checklist

Lab managers are increasingly asked to approve cloud software for systems that hold diagnoses, images and patient identifiers. The honest answer to whether the cloud is safe is that it depends on the provider, the configuration and how your own team uses it. This cloud security checklist is for lab managers, pathologists and hospital IT staff who need to ask the right questions before signing.

Compared with what?

The cloud is often compared with an imagined, perfectly secured on-premises server. The reality in many hospitals and private labs is different: a server in a storeroom, patched when someone remembers, backed up to a disk on the same shelf, administered by a small team that also fixes printers.

A well-run cloud service can offer stronger physical security, dedicated security staff, consistent patching and geographically separate backups that a single lab would struggle to build. A poorly run one can expose everything at once. The question is not cloud or no cloud. It is whether this particular service, configured this way, protects patient data better than your realistic alternative.

Understand shared responsibility

Security in the cloud is shared. The provider is responsible for the infrastructure and the application; you remain responsible for who gets access, how they use it and what data you put in. A vendor can offer multi-factor authentication, but if your lab disables it or shares one login across a bench, the protection is gone.

Ask the vendor to state in writing which controls they operate and which ones are yours. Under Thailand's PDPA and similar laws, your organization usually remains the data controller, so you cannot hand over accountability along with the data. Our guide to Thailand's PDPA in the laboratory covers that relationship in more detail.

The checklist

Work through these areas with the vendor. Ask for evidence, not just assurances.

Data location and ownership

• In which country and region is data stored, and where are backups kept?
• Can data be moved to another country without your agreement?
• Does the contract state clearly that the data belongs to you?
• Which subprocessors, such as hosting providers or support contractors, can access it?

Encryption

• Is data encrypted in transit between users and the service, and between internal components?
• Is data encrypted at rest, including backups and whole slide images?
• Who manages the encryption keys, and who can access them?

Identity and access

• Does every user have an individual account, with no shared logins required?
• Is multi-factor authentication available, and can you enforce it for all users?
• Is access role-based, so a histotechnologist and a pathologist see and do different things?
• Can you connect to your hospital's existing identity system if needed?
• How quickly can you remove a user's access, and does removal take effect immediately?

Tenant isolation

Most cloud lab systems are multi-tenant, meaning several organizations share the same underlying platform. Ask how one customer's data is separated from another's, and how that separation is tested. A failure here is the kind of incident that affects many labs at once.

Logging and monitoring

• Are views, edits, prints and exports of patient records logged?
• Can your team see and export those logs for audits and investigations?
• Does the vendor monitor for suspicious activity, and who responds out of hours?

Backup and recovery

• How often is data backed up, and how long are backups kept?
• Are backups stored separately, and protected against deletion or ransomware?
• What recovery point and recovery time does the vendor commit to?
• When did they last test a full restore?

Independent assurance

Ask which security standards the vendor follows and whether claims are independently verified. A certificate is only meaningful if its scope covers the service and locations you will actually use, so ask to see the scope. Be precise about wording: a vendor whose practices are aligned with a standard such as ISO 27001 is making a different claim from one that holds certification.

Incident response

• How and how fast will the vendor notify you of a security incident affecting your data?
• Who is your contact during an incident?
• Will they support your own regulatory notification obligations?

Exit and portability

• Can you export all your data, including reports, images and audit logs, in usable formats?
• How long after termination is data retained, and how is deletion confirmed?

Red flags to watch for

Some answers should slow the process down:

• The vendor cannot tell you where data is stored.
• Security documentation is a marketing page with no detail.
• Shared accounts are common practice among existing customers.
• There is no way to export audit logs.
• Restore tests have never been done, or the answer is vague.
• Certification claims do not match the scope or the legal entity you are contracting with.

Don't forget your side

Many cloud incidents start on the customer side. Before go-live, settle the following:

1. Define roles and assign the minimum access each person needs.
2. Enforce multi-factor authentication, especially for administrators and remote users.
3. Agree on a process for joiners, movers and leavers, and review access regularly.
4. Secure the workstations and networks used to reach the service, including shared bench computers.
5. Prepare downtime procedures so the lab can keep receiving and labeling specimens if internet connectivity is lost.
6. Train staff to recognize phishing, since stolen passwords bypass most other controls.

Plan for image volume too. If you use whole slide imaging, confirm that bandwidth, storage and backup arrangements are sized for gigapixel files, not just text reports. Record the decisions you make in your quality management system so they are reviewed rather than forgotten.

Key takeaways

• Compare the cloud with your realistic alternative, not an ideal on-premises setup.
• Security is shared: get the split of responsibilities in writing.
• Ask for evidence on data location, encryption, access control, logging, backups and exit.
• Check the scope of any certification, and note the difference between aligned and certified.
• Your own access management, MFA and downtime plans matter as much as the vendor's controls.

Choosing a cloud system is a risk decision, and good vendors welcome detailed questions. PATHOLOGY+ is a multi-tenant cloud platform with role-based access control, multi-factor authentication, audit logging and security practices aligned with ISO 27001, 27701 and 27799; book a demo to work through this checklist with us.