Hacker News Reader

That makes sense, cloud infra does reduce risk in that sense. I assume you're allowed to say "we need to be compliant with X, and our cloud provider is compliant with X, therefore we are compliant with X".

When something bad does happen, is the cloud company liable?

View on HN

Most of it falls on the shoulders of the providers not cloud companys. One aspect that's reappy hard to control is the whole human side of things. Most of my time in the "healthcare security" side of things is with employees opening emails with viruses in them and their constitutional incapablility of not clicking on links in emails.

Im a developer who is a CTO for a healthcare company (not like a big corp or anything) and also administers an Office 365 tenant while building out custom apps and an EMR. The office side of things is so much harder to get secure.

Reply on news.ycombinator.com