Why Application Service Provider (ASP) models are more, not less, secure than traditional models.
Thursday, June 12th, 2008Most people that have objections to Internet-based software applications usually cite a lack of security as the reason. Particularly when it comes to applications that deal with protected health information (PHI), even some technology-savvy professionals feel safer if they have the server on-site under their control, with data only being transmitted on an internal network.
This feeling of security is, for the most part, illusory. Client servers located in offices or institutions rarely have the same level of security that ASPs are able to afford their servers due to economies of scale. Plus, having your server on-site means that you are responsible for maintaining it. Not only does this require extra resources, but it can be problematic if there’s a disaster – your on-site server is vulnerable to floods, tornadoes and fires in a way that good ASP servers are not, because they are usually situated at several diverse locations with data replicated across them. If a disaster befalls one of them, the other ones are still safe and so is your data.
Additionally, having to make your own data backups provides another opportunity for a security breach, as the University of Utah Hospitals & Clinics found out recently, when the backup tapes with medical billing information for 2.2 million patients went missing from a courier’s car. They could have taken a leaf out of the book of the university’s student health center, which unlike the hospitals and clinics division uses Nuesoft Xpress, an ASP model medical management and billing system, meaning their data remains secure and HIPAA compliant without university staff worrying about maintenance, backups or disasters.
