Cloud computing and general practice

Originally published in GP magazine .

Written for GP magazine around 2013. This is the version I submitted - the published article may have been edited.

What is cloud computing? At its simplest, think of it as computers and/or hard disks that you connect to through the internet, and they can either store your files for you or even run software for you. The key is you buy the service and you don’t need to know anything about the location, the equipment, the software - and even more importantly, you don’t have to do anything to it. You don’t need to run nightly backups or reboot the server; it’s all done for you, in theory by experts.

You use it in several ways. Probably the simplest is as extra storage. Many are familiar with Dropbox or Microsoft SkyDrive, where you can connect your computer to a big hard disk in the sky, often for free to begin with.

If you have a website, you probably use a cloud service to host it. In the good old days, i.e. two to three years ago, people bought their own servers and stored them in data centres. Now it’s more likely you are on a cloud-based host, and you aren’t on one machine but on a virtual machine made up of hundreds of real machines.

However, cloud isn’t just for storage and websites. Its real power is in something called software as a service (SaaS), which is trendy as it can save money.

SaaS means that instead of traditionally having to buy a full copy of Microsoft Office for every computer you own - knowing full well that most people only use Word and aren’t using the Excel and PowerPoint that you have paid for - you pay as you use.

The cloud version usually works through your browser, and to all intents and purposes it looks like any other piece of software, but you only use what you need. It also means you are always using the latest version.

Now, if you were a normal business and I was your computer consultant, this is what I’d be advocating: use cheap computers with great screens, deliver all of your software from the cloud, pay only for what you need and minimise your support and infrastructure costs.

You would then ask me about two things: reliability and security.

Reliability is easy - it’s more reliable than anything you could hope to do. The size and scale of these systems is such that they are often spread over numerous countries with multiple redundancies and failsafes. The most dangerous link in the chain is your internet link. But that’s as good as you are willing to pay for, as you can put in multiple backups, including wireless and even ISDN lines.

Security, for most businesses operating legally, isn’t an issue. They are much more likely to lose data through a disgruntled employee than a hacking attempt on the server farm.

The current thinking is “while the massive concentrations of resources and data present a more attractive target to attackers, cloud-based defences can be more robust, scalable and cost-effective” - i.e. they can afford top-of-the-line security.

The only issue comes if you are a large company like Sony, with millions of credit card details, or the NHS, where we are paranoid about patient-identifiable data. Here we have a problem, as the effort to hack might be worth it.

The NHS works on something called N3, which you can think of as a private network connected to the internet. If you want somewhere to store your practice minutes or even your practice accounts, I wouldn’t worry about internet-based cloud - personally at home I use it all the time - but it’s not going to work for your patient data, and in practice you are going to run into trouble trying to keep the two separate. For example, typing a letter on a patient in online Word will mean the data leaks out onto the cloud.

Here the remoteness, and the fact that it can be anywhere in the world, is a disadvantage. While there are ways of making the link to the cloud more secure, there will always be a worry that governments or other agencies, especially if it is held outside of the EU, can access the data once on the cloud.

Here the answer is a private cloud held within N3. Unfortunately you lose some of the cost benefits of competition and size. But perhaps you can have multiple suppliers and a competitive market that different NHS bodies choose between.

In summary, it’s a fascinating topic that the NHS needs to address, but from a practice point of view you need to be really careful what cloud services you use, especially if there is any patient data involved.