On the TechTO stage ×1
First seen on the TechTO stage in 2018. Every talk is searchable — ask the archive about Anthony ↗
In their words
To summarize the cloud, it really is running your stuff on other people's computers — yes, this is true for the public cloud when you distill it down to its simplest aspect.
Many privacy standards, including ones Canada-wide emerging towards the end of this year, are going to have mandatory incident response notification — and what that means is you're going to be liable in the event of a breach.
Should you need to exit that cloud environment, what would that look like? Are there any lock-in provisions you need to look at? Are there proprietary technologies that are preventing you from exiting? So have that exit strategy ready before your organization makes that decision to pivot.
Quick answers
Who is Anthony Galfo?
An information security and privacy specialist. On the HealthTO stage in June 2018 he introduced himself as a senior cybersecurity consultant at Scalar Decisions and said he was a member of the Association of Privacy Professionals. No current role is published here because none could be verified from a first-party source.
What did he recommend before moving health data to the cloud?
Start with a governance, risk and compliance structure and a written security or privacy policy. Then audit the provider by asking for SOC 2 and ISO attestations, understand your role as data controller or processor, encrypt or tokenize the data, meet the privacy laws of every jurisdiction where it is collected and stored, test web-facing applications, have an incident response process, check the terms of service, and plan an exit strategy before committing.
Why does it matter where health data is stored?
Data sovereignty. He told the HealthTO audience that many local healthcare privacy laws in Canada forbid moving data into the United States, where laws such as the Patriot Act conflict with individuals' privacy rights, and that Ontario's health privacy rules had recently added breach reporting and annual reporting to the Information and Privacy Commissioner. As presented in June 2018.
What happened to Scalar Decisions?
CDW acquired it. The deal was announced in late 2018 at a price BetaKit reported as $188 million, and CDW Canada confirmed completion on 1 February 2019.