Company was hosting cardiac patient monitoring on EC2

If this story is true (and I have some doubts), you'd think this would have been a no-brainer to not try to keep critical data like this in the cloud.

But even for non-critical medical data, non-tech savvy medical folks (and this includes some physicians, although in general physicians are more tech-savvy than most managed care decision makers) are going to get into increasingly serious trouble if they don't think through these kinds of things very carefully.

Driven by electronic health care mandates and incentives, companies are pushing portable devices for medical data gathering (portable as in tablet, ie without local data store), and some groups are going to be knee-jerk tempted into buying into this without thinking through the ramifications of not owning your own data -- and by that, I don't mean vague marketing-speak hand-waving that "you own your data" through the simple mechanism of password-protected access to your patient's data living on someone's server farm.

By actually owning your patient's data, I mean strongly considering restricting your local practice to use of on-site media.

If you don't, you'd better have complete confidence that putting your patient's data on the web reflects a reasonable standard of care/privacy, that retention policies don't bite you in six months when your cloud provider goes out of business (or changes hands or farms out data storage or backup to some "economical" third-party), that you're going to have access to your data when you need it, that your cloud provider is going to audit access and changes to your patient's data and report the results of that audit to you accurately and regularly, that legal requests for data are not acted upon without you or your patient's consent, that backups are subjected to the same levels of security, etc. etc.

Electronic medical records are a good idea. It can be done right, as systems such as the Veteran's Administration's VISTA system have demonstrated. However, there is a fine line to walk here. Implementing EHR for the sake of government incentive, or for the convenience of insurance companies, or even the convenience of walking into an exam room carrying a light-weight tablet (which have their own disadvantages for data gathering) rather than a laptop with a hard-drive isn't going to cut it when you put your patients and your practice at risk of harm.

I wish they offered some more detail on how important/life-threatening this is. Are we talking monitoring as in "detect signs of impending/occurring cardiac event and notify emergency services"? Or is this monitoring in a longitudinal sense, assisting physicians to look at trends in their patients? If it is the later case, is data stored on the device until it's uploaded, or is it simply lost if the connection fails?

Still, not really forgivable to be 100% AWS, but it's a very different story if this is primarily a recording device vs. a monitoring device.

who was the IT professional that decided to rely soley on the AWS cloud without any kind of "just in case" solution....with people's lives at stake? lol. I think I'm gonna subscribe to the hoax theory

This is very popular. There are several products that take ECG samples at timed intervals and submit them in several different ways.

In addition these devices can be used to take 12-lead EKG measurements in transit (e.g. inside the ambulance) and send them to the doctor for analysis before the patient arrives.

I'm very surprised that they're hosting these services on EC2. The company I worked for recently finished building a huge highly-redundant data center specifically designed for hosting this kind of medically-sensitive information. I'm willing to bet it was a bit more fortified than even Amazon's.