Question

A hospital decided to use cloud computing for processing and storage to save costs. After several months, it was discovered that the cloud provider’s storage facilities were compromised and patient information was stolen. The hospital maintained that the cloud provider should be punished and fined for the breach, while the provider responded that it was still the hospital’s responsibility under HIPAA to secure patient information and the hospital was ultimately responsible.

Who do you think should be responsible? The cloud provider or the hospital? If the cloud provider is responsible, then should software companies like Microsoft be held liable for a vulnerability in their software that results in a data breach on a Microsoft server in a LAN? Where does the responsibility for the user end and the vendor begin?

Answer 1