NHS Digital has said that care providers are allowed to store patient data in the cloud if they wish, as part of new guidelines that attempt to reduce costs and increase data sharing across the health sector.
A handful of providers already use public cloud services to store patient information, including NHS Choices and Code4Health, however, the new guidance gives an official nod to its use.
The report, released on Tuesday, sets out guidelines for organisations looking to move data to cloud services, providing they operate within the European Economic Area (EEA), areas within the US that are covered by Privacy Shield, or other countries deemed to have adequate data protections in place.
Part of the guidance will also ensure organisations are able to handle data securely, particularly given the tougher restrictions soon to be enforced by GDPR in May, according to NHS Digital.
"It is for individual organisations to decide if they wish to use cloud and data offshoring but there are a huge range of benefits in doing so, such as greater data security protection and reduced running costs when implemented effectively," said Rob Shaw, Deputy Chief Executive at NHS Digital.
"The guidance being published today will give greater clarity about how these technologies can be used and how data, including confidential patient information, can be securely managed."
He added that the use of cloud services would help avoid instances where patient data is not available due to local hardware failures.
However, the guidance has received criticism over the areas in which health providers can choose to store data, particularly those services in the US.
Jim Killock, executive director of Open Rights Group, told IT Pro: "Allowing data to be transferred to the USA under Privacy Shield is dangerous. Privacy Shield is open to legal challenge because US law lacks privacy protections, especially for surveillance.
"Allowing the NHS to move data to the USA could open up UK patient data for surveillance purposes, and that could have ramifications for patient health. People might avoid getting care, which would obviously be very bad. Patient confidentiality has to come first."
The guidelines may also be seen by many as an attempt by the NHS to reform its image after a number of data protection scandals. In 2011, five NHS bodiesfailed to take "appropriate steps to secure sensitive information", following an investigation by the Information Commissioner's Office.
The organisation also came under fire last year for an "inexcusable" data sharing agreement that allowed Google's DeepMind to access 1.6 million patient records. Following an ICO review, the NHS's agreement with the AI firm was found to be in breach of data protection laws.
