Make no mistake: SaaS is big business. Connecticut-based consultancy Gartner Inc. estimated that SaaS revenues would be about $12 billion in 2011, with projections for it to top $20 billion by 2015. As such, all the major software vendors have their hands in the mix, pushing forward SaaS and cloud options for customers to adopt.

“More and more mission-critical data is being created outside of the firewall,” said Joshua Greenbaum, a principal consultant at Enterprise Applications Consulting in Berkeley, Calif. “So to a large extent you can almost say that it’s a no-brainer to keep it outside the firewall and use it in the cloud.”

Yet despite cloud boosters’ insistence that concerns around data privacy are overblown, they still exist. For example, the University of Massachusetts Medical School was considering setting up a private cloud with a company called OrangeScape, according to Raymond Lefebvre, the director of database and reporting systems. But they decided against it.

“Our challenge is that we are a state-run organization that processes and stores personal health information,” he said. “So we tend to host all of our own applications and business systems in order to simplify HIPAA [Health Insurance Portability and Accountability Act] compliance.”