Cloud strategy · Field note

What to review before moving diagnostic images to cloud storage

Cloud can improve flexibility and resilience, but only when radiology workflow, security, compliance, performance, and exit planning are evaluated together.

By Greg D. SmithRadiology consultant · 30+ years of experience

ReviewedAugust 28, 2026 · 6 min read

Short answer

Before moving diagnostic images to cloud storage, confirm the complete data flow, business associate relationships, security responsibilities, identity and access model, encryption and key decisions, logging, availability and recovery design, network performance, retention, cost, data portability, and secure deletion. Validate the design through an organization-specific risk analysis and document why the selected safeguards are reasonable and appropriate.

“Cloud” describes an operating model, not a complete answer. The real decision is how a particular service, configuration, contract, network path, support model, and internal workflow will protect and deliver images over time.

The review framework

Six areas that belong in the same conversation

Data and workflow

Identify images, reports, demographics, metadata, credentials, logs, backups, interfaces, viewers, prefetching, prior studies, exchange routes, and remote-reading workflows. Map where each element moves and resides.

Responsibility and contracts

Determine which organizations are business associates, which subcontractors participate, what each party controls, and how the service agreement and business associate agreement address the actual offering.

Identity, access, and audit

Review federation, multifactor authentication, roles, privileged and support access, emergency procedures, account lifecycle, session controls, audit events, log retention, and customer visibility.

Protection and monitoring

Understand protections for data in transit and at rest, key ownership and management, system hardening, vulnerability work, security monitoring, incident coordination, and evidence available to your team.

Availability and performance

Test assumptions about bandwidth, latency, study retrieval, local dependencies, redundancy, backup isolation, region or facility failure, recovery objectives, restoration, and downtime operations.

Lifecycle and exit

Define retention, legal holds where applicable, tiering, retrieval charges, growth assumptions, export formats, migration assistance, termination cost, deletion, and confirmation of data disposition.

No invisible handoff

Make shared responsibility explicit

HHS guidance explains that a covered entity or business associate may use a cloud service to store or process electronic protected health information when it enters an appropriate business associate agreement and otherwise complies with applicable HIPAA requirements. HHS also makes clear that using a cloud service does not relieve either party of its responsibilities.

Put the responsibility model in writing. If the service secures its infrastructure but your organization configures identities and access, say so. If the primary vendor relies on a cloud infrastructure provider, identify how obligations and incident communications flow through that chain.

A control that exists somewhere in the stack is not necessarily a control your organization has configured, tested, or can evidence.

The technology review should therefore connect to the organization’s broader security and HIPAA program, not sit beside it as a separate procurement exercise.

Create a useful record

Document the decision—not just the vendor

A defensible decision record should capture the business and clinical goals, evaluated architecture, material risks, evidence reviewed, contractual commitments, required configuration, remaining risks, approvals, owners, and follow-up dates. It gives operations, compliance, security, and future leadership a common point of reference.

Before approval, be able to answer:

What can fail? Who will know? Who acts? How long can the organization operate? How does it recover? How does it retrieve its data if the relationship ends?

Greg can help radiology leaders evaluate the operational, workflow, and vendor dimensions. For formal risk analysis and ongoing HIPAA compliance management, ExpRad refers organizations to Live Compliance’s gap and risk assessment resources.

Primary sources

Educational information only. This field note is not legal, cybersecurity, architecture, or compliance advice. Cloud and imaging environments vary; obtain appropriate technical, legal, security, and compliance review for your organization.