## 4 Drivers and Challenges for Cloud Based HIS
### Security, Governance, and Compliance  
Information security is a critical issue in HIS. Security breaches in HIS may expose very sensitive data [58] and put patient privacy at risk [59]. [PERSON] et al. [58] also recommend that that data security should be applied to all stages of the data lifecycle to ensure data security though measures such as encryption at movement and encryption at rest. High security costs can be an organizational barrier for overall cloud adoption for HIS and implementation [60], since the infrastructure resides outside the physical boundaries of the organization. Physical access to infrastructure is an important aspect of security for healthcare organizations. However, using cloud computing can actually reduce the costs of compliance with regulations like Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH). Many cloud providers being cognisant of the security concerns of hosting sensitive data outside the organization provide services that are HIPAA compliant [61]. Operating a operate fully redundant, always on fault-tolerant and secure datacenters is also a part of the HIPPA requirement. However, compliance with some aspects of HIPPA by the cloud providers does not guarantee the compliance of the overall system, and more work is needed for a practical framework to implement HIPAA-compliant HIS on the cloud. Furthermore, relying on pre-built cloud SaaS or PaaS solutions may lead to vendor lock-in [28], which also couples the HIS security with the security state of the cloud provider. Vendor coupling may be overcome using opensource or in-house developed solutions, which transfers the security responsibility to the owner but can prove to be resource intensive. Qualitative studies can be done to arrive at security considerations for adapting cloud SaaS and PaaS solutions and customized opensource and in-house solutions. Another risk that is related with the cloud vendors is the inheritance of security vulnerabilities from the vendor [62]. Vulnerability in a cloud provider tool affects all tenants. This can be a major challenge due to the lack of control on the infrastructure and the platform by the healthcare organization. Research is needed that can examine the agility of the vendors in mitigating such security risks. Internal threats and data leakage within the cloud may cause violation of data privacy and is a major risk factor for HIS [63]. Patient and medical data ownership is one of the primary legal issues related to HIS. There is no direct interpretation of data ownership [64] and the limits for organizations on the usage of this information. This raises an issue that requires work to arrive at clearer boundaries that define each party's responsibilities in the shared responsibility models of security proposed by the cloud providers [65]. Shared responsibility principle of cloud providers splits the responsibility of protecting the infrastructure and the data of a system between the cloud provider and consumer [66], and clear boundaries needs to be defined. [PERSON] et al. [67] stated that one of the issues regarding healthcare technology and wearables privacy concerns is the lack of governmental regulation about the ownership of the generated data and boundaries to access the user health records. Compliance requirements and regulations may often pose challenges to the use and implementation of HIS in the cloud [35], or may limit the data processing and analysis [58]. To resolve such issues, collaboration between academic and governmental parties in addition to industry leaders is needed to arrive at a framework for secure implementation of HIS and to provide international standards for implementation and responsibility sharing between parties. It should be stated there though that as new regulations and compliance requirements are put in place, the agility provided by DevOps in the cloud computing environment will enable cloud-based HIS to change faster than the traditional HIS.