So if this is wrong (I am not a HiPAA expert nor a sys admin) then Verizon is wrong, although perhaps there are other reasons that it decided to host this service in the manner it has, that it didn’t want to explain, and so it used HIPAA as an excuse.

Alexander Lopez
blog.carecloud.com

As someone that has actually managed IT and software development in the healthcare industry for many years and navigated all sorts of regulatory hurdles, I think you are wrong on this point. HIPAA is not even remotely technically prescriptive, certainly nothing that would allow you to make these sorts of bold assertions and I’m aware of no other privacy regulation in the US that would make this illegal. Furthermore, multi-tenancy is not inherently insecure, particularly not if designed for security. Your bank, for instance, stores your transactions in the same database tables even as many other customers and yet offers a level of security greater than almost any on-site EMR system at a physicians office or hospital. Likewise, millions of EDI transactions containing PHI are transmitted over the internet and used in massively multi-tenant configurations routinely for years (see WebMD, Zirmed, etc)…. about all HIPAA has to say on the matter is that it uses some form of encryption.

You are hardly to first, but I’ve seen too many people blindly repeat these sorts of claims without doing any research of their own (of course, self-interested vendors, consultants, and others promote mis-information to peddle their wares).

FYI-The greater privacy issue, to my mind, is having vast quantities of PHI available online in a commonly accessible (mono-culture technology/access methods) and trying to balance ease of access by multiple clinicians with tight security. These are not inherently insurmountable obstacles and, further, would probably be best managed in a few (read: multi-tenancy) systems, where they can be stored in proper secure datacenters with full-time professionals, versus tens of thousands of separate systems staffed by consultants, part-timers and IT generalists in backoffices around the country.