Multi-tenant SaaS and patient data

The provider should own tenant isolation, platform patching, physical security, backup infrastructure, audit-log integrity and the security of provider-managed encryption keys. The hospitals should own identity lifecycle, role assignment and revocation, review of the 38 local administrators every 90 days, data classification, configuration of their own tenant, and the decision on whether an incident is reportable. The most dangerous ambiguity is the word "security", because it lets each party assume the other performs access review, breach assessment and subprocessor oversight. Multi-tenancy makes tenant isolation a provider control, but local admin rights make hospital-side access governance equally important. The contract should be replaced by a control matrix mapped to the regulatory requirements: notification within 72 hours with defined escalation, audit-log access, key management options, subprocessor approval and data residency. A single responsibility sentence cannot allocate controls that sit across people, process and technology. The 1,200-record exposure and two-day classification delay show that detection and decision rights, not just storage encryption, are the weak points.

Prioritize controls that reduce the likelihood and impact of another reportable breach. First, establish a joint incident escalation path with named contacts and a 4-hour provider notification target, so the 72-hour regulatory clock is not consumed by silence. Second, require access reviews every 90 days for all local administrators, with evidence and removal of unnecessary rights. Third, obtain audit rights or independent assurance reports, and require approval before any new subprocessor or backup location is used. Fourth, require customer-managed keys or a documented key-management compromise procedure. Fifth, agree an exit plan with data export formats and deletion evidence. These are governance controls, not just contract clauses: assign owners, record them in the risk register, and review them quarterly. The priority order reflects exposure: notification delay and standing admin rights can cause immediate harm; exit planning is important but slower. Use supplier management and risk management together so that contractual promises are verified rather than assumed, and keep the service usable by phasing controls instead of demanding an immediate migration.

Treat this as a detection-and-decision risk, not only a provider failure. The customer should define a reportable-breach decision tree with pre-agreed criteria, a named privacy lead, and a maximum 24-hour internal classification deadline once the provider notifies. The provider must supply sufficient evidence at notification: affected records, tenants, time window, containment and log extracts. Test the joint process twice a year with a tabletop exercise, and record the results in the risk register. Risk treatment options include reducing likelihood through automated sensitive-data discovery and bucket configuration guardrails, reducing impact through faster notification, and transferring residual financial risk through cyber insurance where available. Avoidance, such as leaving the SaaS service, is disproportionate if the controls can be fixed and the exit cost is high. The reasoning is that the nine-hour provider delay and two-day customer delay compounded; either alone might have been manageable. A joint service level for notification and a rehearsed decision process turn a vague responsibility into a measurable control.