My problem with this is that the patient information is stored "in the cloud". As such, the terms of any agreements always favor the provider if the information ever escapes.
As opposed to the alternative (data stored locally on servers at the clinic)? I think the amount of buck-passing in that situation is actually a bigger problem. It's easy for the blame to be passed around from the vendor to the local IT staff, to the users, etc.
Actually, yes. HIPAA -- the Health Information Portability and Accountability Act -- is the watchword in medical recordkeeping, these days, and cloud storage is a major point of failure if you don't do it right. Neither DrChrono nor the linked article mention HIPAA, except to say they're compliant. They need to say how they're compliant, give details up front. I'd be more willing to take them seriously if they discussed the topic more like this:
The Nirvanix Cloud Storage Network meets the healthcare industry's need for secure archives. You can use policy-based replication to store data at multiple storage nodes that meet SAS 70 compliance. Nirvanix solutions encrypt data both in flight and at rest and enable you to instantly verify the integrity of your files. You also can make data securely available to selected users. We even seamlessly migrate data to new discs on standard refresh cycles, eliminating the complexities of long-term retention. With its secure long-term storage, the Nirvanix cloud will help you to comply with HIPAA Privacy and HIPAA Security Rules as well as other mandates for data privacy. (http://www.nirvanix.com/solutions/healthcare.aspx)
Here's a few other links that discuss the topic in a more informative manner:
What most of the docs I've seen in the Bay Area do is keep everything on paper. And yeah, that reassures me relative to records kept in electronic form.
