Cloud analytics for a Hong Kong hospital group
A Hong Kong private hospital group with three acute hospitals and 1,800 beds wants a cloud analytics platform for near-real-time sepsis alerts. Its on-premises warehouse currently achieves 99.7% availability, while the SaaS vendor offers 99.95% but stores primary data in Singapore and trains models in the United States. Fourteen downstream interfaces depend on the warehouse. The data includes HIV status, mental-health records and genetic results. The group has six infrastructure staff, a HKD 12 million three-year budget, and a board paper due in four weeks. The vendor's draft contract allows 30-day termination, deletion within 90 days, and unnamed subprocessors. Clinicians want the alerts; the privacy officer is concerned about cross-border transfer; the security team is concerned about exit and lock-in. The vendor will not accept unlimited liability. The CIO asks you to recommend whether to proceed.
1. What decision framework would you use, and which issues are professionally material?
Read the worked answer
I would frame the decision around four tests: clinical safety, legal and ethical compliance, service continuity, and reversibility. The vendor's 99.95% claim is not automatically better than 99.7% unless the scope, measurement method and dependencies are comparable; 99.95% allows about 4.4 hours of downtime per year, but the hospital must still operate during a regional cloud outage. Material issues include: whether identifiable data must leave Hong Kong; whether the original collection purpose and patient consent cover analytics and overseas processing; how the 14 interfaces are protected; who can access data at the vendor and subprocessors; breach notification; deletion evidence; and exit. Under the PDPO, I would map the flow against the six data protection principles, especially purpose limitation and security, and obtain legal advice on cross-border transfer. Section 33 is not in operation, but PCPD guidance and contractual safeguards still matter. I would not treat this as a binary yes/no. The defensible recommendation is conditional: proceed only with a bounded pilot, data minimisation, named subprocessors, audit rights and a tested exit plan.
2. Propose the target architecture and contractual controls you would insist on.
Read the worked answer
Architecturally, I would keep the identifiable clinical data in Hong Kong and send only pseudonymised or aggregated data to the analytics environment. Sepsis scoring could run in-region, with the vendor bringing the model to the data rather than exporting records. Keys for re-identification should remain under hospital control, preferably in a separate key management domain. Use encryption in transit and at rest, private connectivity rather than public internet, field-level masking, and logging of every export. For availability, require a documented recovery time objective and recovery point objective, a tested failover, and service credits that are meaningful relative to the HKD 12 million contract. Contractually I would require: prior approval of subprocessors; notification of a security incident within 24 hours; audit and penetration-test evidence; data deletion with a certificate within 30 days of termination; return of data in an open format; termination assistance for at least six months; liability that is not capped below the value of a clinical outage; and a right to suspend processing if safeguards fail. The 30-day termination and 90-day deletion terms are too weak for a clinical system and should be renegotiated.
3. How would you test the availability and exit claims before signing?
Read the worked answer
I would ask for evidence, not marketing. For availability: independent audit reports such as SOC 2 Type II or ISO 27001 certification, historical availability data for the proposed region, architecture diagrams showing redundancy across availability zones, and results of the vendor's last disaster-recovery test. I would run a joint failover exercise and a tabletop outage scenario involving the 14 interfaces. For exit: require a sample export of the full dataset and metadata, measure how long it takes, and verify that the format is usable without the vendor's software. Test deletion in a non-production tenancy and require a certificate. Check whether source code or model escrow is needed for continuity. I would also validate the liability and insurance position, because a 99.95% promise is weak if the remedy is a small service credit. Finally, I would record the residual risks accepted by the CIO and clinical lead, because the professional judgement is not only technical: it is whether the hospital can safely operate when the vendor fails.