Hospitals are under constant pressure to share electronic health information, while simultaneously reducing costs and maintaining control over data privacy.

Cloud computing, with its ability to provide rapid access to data when and where needed on any device without requiring a large IT support staff, may look like the perfect solution.

Some experts say, 'Look again'. The risks of exposing sensitive patient data, especially in a public cloud, remains a concern.

A common mistake is assuming the cloud is a solution per se. Cloud computing is the evolution of software as a service. "Organizations often place an inordinate amount of faith in cloud technology and security without doing due diligence," says Robert Parisi, senior vice president, Marsh USA, an insurance broker and risk adviser.

Data security easily is neglected in the rush to adopt electronic health solutions to take advantage of HITECH Act incentives. "Moving your information into a cloud does not simultaneously outsource security management. Hospitals remain responsible," says Chris Steel, PA Consulting Group. Attorney Roy Hadley, of Barnes & Thornburg LLP, predicts that as hospitals move to the cloud, security breaches will become more prevalent. "Security lapses could collectively cost hospitals billions every year," he says.

In public clouds, data can be spread across several locations, or even across continents, depending on where the vendor hosts the information. Mike Garzone, chief technology officer of Computer Sciences Corp.'s health care group, says "hospitals must also consider the potential issues of dealing with privacy laws that vary by jurisdiction."

One solution is to opt for a private cloud, which can be restricted to affiliate organizations as part of a community connecting providers, labs and peripheral services.

In some cases, the distinction between public and private clouds is blurring. Some public cloud providers now offer a ring-fenced portion of the cloud as private. "We see clients taking different cloud services for different needs, integrated seamlessly," says Andrew Greenway, who leads the global cloud computing program for Accenture.

IT efficiencies rather than cost savings are what currently drive interest in cloud computing. Hospitals trying to mitigate data center-capacity limitations or increase disaster-recovery capability see it as an option to expand capacity.

Scott Nichols, IT director and chief security officer of Mission Internal Medical Group, Orange County, Calif., says cloud computing makes sense for delivering information to multiple sites and users. "It gives you a central location to host your service and move away from single-server installations at multiple sites that can cause IT management nightmares," he says.