Draft for Tamir's review. Not published.
Look past the location promise
A residency assurance may cover storage only. Document hosting, backup, support and onward processing locations, and the subcontractors involved. Ask who at the provider can read the data, how that access is authorized and logged, and whether your data is used for analytics or training.
Check exit with the same care: data export, its format, deletion and the time to return each system. These terms are easier to set before you sign.
Get the policy answer first
Classify the data the system will hold, and ask the approving body or your privacy adviser in writing what each class allows. Then check whether the service meets those terms, through regional hosting or data separation. Consider a split that keeps sensitive data local.
If a regulator asks, show that you know what moved, why it is safe and how you would get it back. Map each question to a document. Where a document does not exist yet, say so with a date to produce it.
Depending on your seat
If you're on the board, require the inventory of what moves, written privacy and regulatory opinions, and the contract terms on location, access, breach notification and exit. Approve by stage, with a review before identifiable data moves.
If you're the CEO signing a response or a contract, write it from documents your team can produce. If employee representatives ask where their data goes, answer them in writing from the terms.
What to check before you decide
- Inventory the data and systems that would move, with a sensitivity class for each.
- Get hosting, backup, support and onward processing locations, and the subcontractor list, in writing.
- Confirm who at the provider can read the data, and how that access is authorized and logged.
- Check the terms on using your data beyond the service, including analytics and training.
- Get the approving body's or privacy adviser's position in writing for each data class.
- Define export, deletion and the time to return each system at exit.
- Approve in stages, with a review before identifiable data moves.
Questions people ask
Board must approve moving patient data to the cloud, what should directors require before approving?
Require the inventory of what moves, the privacy and regulatory approvals, the contract terms on location, access and exit, and the hospital's own controls over who accesses what. Approve by stage with the least sensitive data first. It depends on your privacy rules for patient data and on what the regulator permits for hosting.
What should a healthcare board verify beyond a cloud data-residency promise?
Require a complete account of data handling and the requirements confirmed by responsible specialists. Residency and key ownership do not replace assessment of access, further recipients, recovery, and the actual service configuration.
Regulator sent questions about our cloud migration and my CIO's answers are vague, what should the answers contain?
Regulators want to see that you know what moved, why it is safe and how you would get it back: the list of systems and data, the risk assessment for each, the controls in place and the exit plan. Vague answers usually mean those documents do not exist yet. It depends on your regulator's published expectations and on how far the migration has gone.
Signing an HR system hosted abroad, what should I know about employee data before signing?
Know where the data is stored and processed, who at the vendor and its subcontractors can access it, whether it is used for anything beyond your service, and how you get it back and deleted at exit. Check those against your privacy obligations and your labor agreements. It depends on your privacy rules for transfers abroad and on what data the system will hold.
Best software for our agency is hosted abroad and policy is unclear, choose it or the weaker local option?
Get the policy answer before the product answer: ask the approving body in writing what data classes may be hosted abroad and under what terms. Then check whether the foreign service can meet those terms, such as regional hosting or data separation. It depends on the sensitivity of the data the system holds and on the approving body's current position.
How I can help with this decision
- Ask or talk (Free)
- I give my view on what your residency assurance leaves out, and which questions to put to the vendor and the approving body.
- Review (Pay if it was worth it)
- I write an independent assessment of the data, the contract terms, the access evidence and the approvals. I recommend to approve by stage, change the terms, choose another option or defer.
- Retain (When it makes sense)
- I stay available at each stage, or when the service changes, to review the evidence before the next approval.