Considerations & Vendors for hosting healthcare related data & sites in Europe

Question

I am currently researching hosting vendors & services in Europe that I can use to build up websites & related web based applications for healthcare. Eventually we would like the users to be able to enter some personal medical information into these sites, so there is a need to ensure data privacy & confidentiality. Our company is US based, so we also need to adhere to US legislation eg SAS 70 Type II.

Does anyone have any experience of reviewing hosting companies with regard to their data privacy certification? For example I know Rackspace & Verizon have centres in europe with SAS 70 Type II but I would like to find others.

thanks, matt.

Answer 1

In Europe there are Data Protection principles enacted into law by the member countries. Data Protection is the term in English for what you mean by data privacy. The responsibility for Data Protection lies with the "Data Controller", i.e. the owner of the data, to make sure that the data is held in line with local Data Protection law. So that would be you. Even if you store the data offsite, or use another company to process it then it's your responsibility to make sure they are following Data Protection laws in your contract with them.

There's guidance on such contracts here: http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/05/3

However if you look for ISO 27001 accreditation that will get you a long way towards satisfying yourself that they are going to look after your data.