There are also four cloud deployment models users should examine to determine which best suits their needs:

Transcription

1 WHITEPAPER The Benefits of True OnDemand Cloud Computing The business world is excited about cloud computing. But how many understand how it really works? How many truly decipher its advantages and disadvantages? In this paper, we take an in-depth look at a growing paradigm shift away from relying on overburdened in-house IT departments and moving toward leveraging a nimble OnDemand Cloud solution. The result can make critical data more accessible and secure, even as it improves the overall operations and efficiencies for many companies doing business in life science industries. Defining The Cloud According to the National Institute of Standards and Technology (NIST), cloud computing can be defined as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. NIST burrows down deeper to explain that cloud computing isn t quite as simple as it sounds. There are other wrinkles to consider, including what it labels the five essentials that make for true cloud computing: On-demand Self-service Broad Network Access Resource Pooling Rapid Elasticity Measured Service Further, NIST outlines three cloud service models: Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) There are also four cloud deployment models users should examine to determine which best suits their needs: Private Community Public Hybrid With that overview, let s now look at how cloud computing is changing the competitive landscape.

2 The Paradigm Shift: How Cloud Computing Is Changing The Competitive Landscape Many companies, especially those in heavily regulated industries such as the medical device arena, are understandably wary of trying something new when it comes to managing and protecting their sensitive data. Companies regulated by the Food and Drug Administration (FDA) in particular tend to hold back and wait to see if a new technology or tool really works before diving in and exploring. Today, thanks to advances in technology and more experienced service providers, cloud computing is no longer a scary outlier. In fact, it s becoming mainstream. Companies that continue to hold back now risk ceding important competitive ground to others in their industry. When a single day delaying a device or drug from reaching the marketplace can literally cost a company millions of dollars, it s incumbent on those companies to strongly consider the proven benefits of OnDemand cloud computing AssurX understands this hesitation, and our seasoned team comes with the experience and detailed results to make a strong case for using the cloud. The Cloud Can t Do Everything: HIPAA Compliant? If someone tells you the cloud can make you HIPAA-certified, run fast in the other direction. Put bluntly, they don t know what they are talking about. That s because there is no such thing as HIPAA-certified. It s made up of rules and best practices and suggested ways of doing things. Of course, there are auditing provisions to ensure you are up to the mark. That said, HIPAA was published nearly ten years ago and makes very few claims about hardware parameters. In fact, the U.S. Department of Health and Human Services (HHS) is so concerned about these misleading claims, it issued its own bulletin challenging those who make them. We have received reports that some consultants and education providers have claimed that they or their materials or systems are endorsed or required by HHS... In fact, HHS and OCR do not endorse any private consultants or education providers seminars, materials or systems, and do not certify any persons or products as HIPAA compliant. What The Cloud Can Do After many years of working with companies regulated by the FDA, HHS or other regulatory bodies and advisory groups, AssurX has learned a thing or two. For starters, cloud computing is only worthwhile if it keeps data, and users, safe and secure. Any solution must be fully OnDemand and possess the technology required to protect data against hackers, attackers or natural disasters. Although we may reference the cloud in this white paper, when we speak about AssurX s OnDemand cloud offering, it is more accurately described as a privately hosted cloud environment. It s important, first, to understand the distinction between cloud and privately hosted. The AssurX OnDemand cloud option is actually a privately hosted solution for our customers. This means that although AssurX servers are hosted in a data center, the equipment is dedicated to AssurX use only. We don t share hardware or bandwidth with any other cloud provider, company, or website. You can rest assured that your system is not fighting for resources from typical internet applications such as Google searches, ebay purchases, or anything like that. The servers you are accessing with AssurX s OnDemand Cloud are AssurX dedicated. Clear Competitive Advantages The cloud offers some tantalizing benefits. Users who harness the cloud in the right way will begin to see tangible benefits almost immediately. For example, in-house IT costs will drop. That s because OnDemand is a far more nimble and efficient option compared to any other available solution. OnDemand cloud computing makes it possible to employ a smaller IT staff. When AssurX delivers OnDemand services, it comes with experts who are 2

3 well-versed in the solution. Instead of relying on an IT staff with a more general knowledge base, those working with AssurX s OnDemand team will enjoy a tailored solution with vastly improved operational clarity, virtually from day one. Remember, a large IT staff takes time to train. It also usually serves the entire company, not just your particular department. The IT department cannot reasonably be expected to become granular experts in your area of operation. It is usually being pulled in numerous, sometimes conflicting, directions. But the AssurX On-Demand team is already trained and experienced in the installation and usage of the solution. The bottom-line result is more accessible data that is better protected. In the event of a local disaster, whether relatively minor or more serious, your AssurX-protected data is always accessible via any internet connection. You won t need to allocate IT resources to handle that issue. AssurX has got you covered. That frees you up to deal with other important disaster recovery issues. In-house IT departments certainly mean well, but if they don t meet a given uptime standard or goal there is often very little recourse for your department. AssurX takes care of that, too. If its OnDemand solution does not hit mutually agreed upon targets, AssurX will give you money back. That s putting the money where the mouth is and it is hard to imagine a more serious and confident -- guarantee. AssurX works with customers in a number of industries, but let s focus here on how it helps the companies that deal with two of the largest and most complex regulatory bodies in the United States: the FDA and the North American Electric Reliability Coalition (NERC). A Closer Look: FDA As noted earlier, drug, device and other companies that fall under the FDA s regulatory umbrella don t tend to be early adopters when it comes to technology. The FDA and FDA regulated companies have traditionally been conservative as each assesses new technological options available in the marketplace. But that s beginning to change. As evidenced by the agency s recent industry guidance documents addressing social media and remote product usage, the agency is clearly taking important steps toward embracing these new ways of doing business. This presents drug, device, and biotech firms especially small and mid-size operations with a new opportunity. But it s not without risk. In reality, regulated companies must also identify a proven partner that understands their industry. With a track record of over 15 years, AssurX delivers a proven, efficient, cost effective global quality management solution designed specifically to meet or exceed FDA regulatory requirements. Those innovative tools deliver at least four key benefits: Fully Integrated /electronic Quality Management System: Automatically track, trend, resolve, document and report product issues initiated from any source, across all functional areas before they become costly problems. Reduce or prevent quality incidents in a compliant closed-loop system. AssurX eqms solutions include: CAPA, Complaints, Doc Mgmt,, Training Mgmt, Supplier Quality, Audit Mgmt, emdr submissions, etc. Built-in, Guided Compliance: Designed with the flexibility to meet changing cgxp and FDA regulations, the software guides users step-by-step through the process to meet requirements. Preconfigured forms contain all pertinent information blocks required for compliance and smooth operations, dramatically reducing the risk of non-compliance. And, perhaps best of all, every record is easily accessible in one repository. Automatically capture detailed data across all integrated processes in a single repository & instantly access real-time performance metrics: you ll see all issues are being properly handled, documented and reported; and all trends are identified quickly. 3

4 Electronic Signatures, 21 CFR Part 11: : AssurX s solution is designed to meet or exceed this important FDA regulation s strict audit trail and electronic data integrity requirements. That s an issue often on the radar of an FDA inspector. The solution can also provide change control records. Which is critically important whenever an FDA inspector is involved. Another Option: Dedicated Servers The typical OnDemand solution provided by AssurX is a hybrid multi-tenant environment, where web server and application server hardware is shared, but the customer s data and business processes are dedicated to access only by that customer. This is accomplished through the specific way AssurX has engineered their software, offering a low cost OnDemand Solution option by allowing the sharing of equipment that contains no proprietary information, However, some companies may still decide that they need an even stricter form of control. One option offered by AssurX is a dedicated environment. Using this option, web and application servers are dedicated to the individual company as well as their data/workflows. However, the associated costs are higher with the dedicated option. Therefore, each company must determine through its risk analysis whether the system justifies the relatively higher price tag. In most cases, especially with small and mid-size FDA-regulated firms, the best ROI is to use the hybrid multi-tenant option. The AssurX OnDemand Solution AssurX OnDemand starts with security. Database servers are built with multiple redundancies, SQL servers, and clustered environments, among other layers of protection. If one server goes down, another back-up server takes over instantly in a seamless data flow. Data is also secure because each user has its own database and internal access credentials. Data is never exposed to the Internet except through the Web page supplied by AssurX. While the software is multi-tenant, your data is not kept where anyone else stores and accesses their data. You are never sharing data, processes or workflows with anyone outside those to whom you choose to grant access. Finally, the AssurX OnDemand solution delivers rapid deployment, lower costs, full-spectrum access, and much easier administration. A High Standard For Data Protection, Recovery There are two different factors in the approach to data retrieval when it comes to Disaster Recovery: Recovery Time Objective (RTO) Recovery Point Objective (RPO) Both are important concepts to understand when discussing disaster recovery vis a vis a cloud based solution. Broadly speaking, RTO is a target time for the resumption of IT activities after a disaster hits. A business that cannot wait an extended amount of time before the system is available following a disaster requires a short RTO objective. The proper RTO is calculated by identifying the threshold of downtime your business can withstand without it dramatically affecting your daily production or resulting in significant financial loss. Some companies can function without the system for long periods, others must get their data back much more quickly. The RTO represents the amount of time that the system can be down in a disaster without putting the organization at high financial or regulatory risk. Now, let s look at RPO. A company that processes hundreds of transactions a second (e.g. Amazon, ebay, etc.), would require a very short RPO time, where even 15 minutes of lost transactions would represent a major 3

5 financially significant loss. That said, having hardware and software tools in place to minimize this RPO is a very costly endeavor for these types of companies. For other companies, with far fewer transactions per minute, a loss of, say, 30 minutes of data is not typically significant, and can be recovered in a more relaxed manner, without risk of dramatic loss of business or control. AssurX s RTO: This disaster recovery system is redundant, if one data center is devastated, the other data center picks up and takes control with under 15 minute downtime. In effect, users can get back to their system and data within fifteen minutes of the disaster. AssurX s RPO: This disaster recovery system is engineered so that data is mirrored across data centers. In the event of a devastating disaster to a data center, the potential loss of up to 15 minutes of transaction data is the absolute worst case scenario. In addition to these disaster recovery capabilities, the AssurX solution also provides a backup archive with fourteen days worth of data stored onsite, and a total of thirty days of data securely stored offsite. With all these factors you can be assured that your users will never be blocked from their own data, and lost data can be recovered, if needed, from backups. Additionally, customers can have their entire database sent back to them every twenty-four hours. Few customers choose this option, but it s available as another safeguard if local storage of the data is also required. With all of these factors, you can no doubt see that AssurX takes data security seriously. Conclusion Just as the cloud offers a newfound flexibility and exciting possibilities, a service provider must mirror that with its own demonstrated track record. Misunderstood, many of the cloud s benefits won t be leveraged in a way to improve your competitive position in the marketplace. Make the cloud work for you with a proven partner that understands the intricacies of regulated industries, and get ready to thrive. Click here to request a live demonstration of the AssurX OnDemand system. Copyright AssurX, Inc. All rights reserved. C PDFO AssurX, Inc. Tel info@assurx.com