Skip to content

ACCA Strategic Professional · Strategic Business Leader · Cloud, mobile and smart technology

Calder Health, a private hospital group, adopts a SaaS patient-records system from a provider whose data centres are in another country. The board assumes that, because the provider runs the whole system, Calder has transferred all risk and accountability for patient data. Which assessment of this assumption is most accurate?

The assumption is incorrect. Even under SaaS, Calder stays accountable to patients and regulators for its data. The board must manage risks such as data location, access controls, security assurance and vendor dependence through contract terms, audit rights and ongoing oversight.

  1. ACorrect, because under SaaS the provider is accountable for all data protection and regulatory obligations
  2. BIncorrect, because the provider only manages infrastructure and Calder must manage the application itself
  3. CIncorrect, because Calder retains accountability to patients and regulators for its data, so it must manage risks such as data location, access controls and vendor dependence through contracts and oversightCorrect
  4. DCorrect, provided the service level agreement guarantees 99.9% availability

Explanation

Outsourcing the operation of a service does not transfer accountability for data. Calder remains responsible for compliance, so governance should address data residency, access rights, security assurance, exit arrangements and lock-in. Option B is wrong because under SaaS the provider manages the application too.

Did you get it right without looking?

One question tells you little. A timed set on Cloud, mobile and smart technology shows your real accuracy, how long you take and where you lose marks.

Practise Cloud, mobile and smart technologyFree diagnostic mock

More Cloud, mobile and smart technology questions