Modern Pharmacy IT. R x IT as a service. Kodiak service summary. Service features. Hosted Framework. Hosted DocuTrack

Transcription

1 Modern Pharmacy IT R x IT as a service Modern specialty pharmacies face a wide and deepening range of IT challenges. Unlike skilled nursing facilities (SNF), with protected health information (PHI) access and transfer that are generally quite contained, specialty pharmacies deal in a very active PHI environment. Further, with medication management adding such a delicate layer of complexity, the IT needs of specialty pharmacies go far beyond just making Framework software work. Pharmacy IT needs a degree of expertise and 24/7/365 attention that can t be found from typical cloud providers. Singularly, the various parts of pharmacy IT are not overly complex, but when they work collectively in their precise ecosystem, the overall integrated IT needs become highly strained. This is especially true with growing IT systems. Through 16 years of customized healthcare hosting, we at Kodiak clearly see that pharmacy IT has unique and delicate challenges that can only be met by a very high level of specialized service. Kodiak service summary Kodiak Systems has been providing fully hosted, managed application, and IT services since Although Kodiak technical capabilities are not industry specific, 90 percent of the user base is in healthcare. A certified Microsoft Partner, Kodiak also works very closely with a wide variety of non-microsoft healthcare and business software vendors. Service features Each user accesses his or her applications and data through a uniquely profiled virtual desktop. The user can access this Hosted Framework Dedicated Microsoft SQL Enterprise Database Instance, replicated to standby server in secondary datacenter TEST Microsoft SQL Database instance Dedicated virtual Interface Server, replicated to standby environment in secondary datacenter. TEST virtual Interface Server Access to/from the Internet as needed, and up to 10 site to site VPNs Access via Hosted Desktop 2TB Disk storage Microsoft SQL Enterprise Licensing Application patching/upgrading Hosted DocuTrack Dedicated Microsoft SQL Database Instance, replicated to standby server in secondary data enter Dedicated virtual Application Server, replicated to standby environment in secondary datacenter. Dedicated virtual Application Server - FaxCore, replicated to standby environment in secondary datacenter. Access via Hosted Desktop 1.5TB Disk storage Microsoft SQL Enterprise Licensing Application patching/upgrading

2 secure profile through almost any device with an Internet connection. Local hardware needs are minimized, and most customers choose to deploy thin clients instead of desktop PCs. With all software and data residing within Kodiak-owned hardware in carrier-class datacenters, Kodiak is in an ideal position to provide hardware and system redundancies, thorough backup processes, security, and live help-desk services to its customers. As a one-throat-to-choke IT production foundation with a deep commitment to risk management, Kodiak can empower IT departments that are focused on the system optimization they need for overall business growth. Enabling customer expansion is a key element of the Kodiak hosting service. Customers are able to grow both internally and through acquisition in a way that is both cost-effective and operationally painless. Hosting service philosophy Throughout our 16 years of hosting, technology has gone through and will continue to go through considerable changes. Our success, both past and future, is tied to the fundamental principle that risk management lies at the core of every action we take. We divide IT into three separate, yet crucially interwoven businesses within IT: Production Risk management Optimization Risk management Like other cloud providers, we initially began as a technically focused IT services company. Although the typical hosting company still defines itself as such, our experience has taught us not to define ourselves in this way. Through 16 years of hosting, we ve seen a great paradigm shift. The technical capacities of hosting have steadily developed and grown, but the tech advances have now become eclipsed by their related risks. We feel that without a diligent risk-management focus, the production side of IT becomes moot. Every technical move we make is made with regard for risk management, and as a result, we are now better defined as a risk management company that provides IT hosting services.

3 Risk management partnership It s very important to note that as comprehensive as we are with risk management, your company must always be involved with its proper adherence. IT production, IT optimization, and business efficiency have a deeply interwoven relationship. Great efficiency does not occur without optimization, and optimization cannot happen without quality production. Simply put, we take responsibility for production, we share the responsibility for risk management, and as the user, you take responsibility for the optimization of your line-of-business software. However, it must be understood that given the current evolution of cyber liability, risk management is a partnership, and as your cloud provider we thoroughly share your commitment to its governance and execution. Dedicated security and compliance personnel In 2014, Kodiak created a new managerial position, that of Director of Security and Compliance. The DoSC is responsible for creating and ensuring the adherence to policies and procedures that promote HIPAA eligibility and overall secure practices. Security and compliance is the sole focus of this role. Working closely with our teams of IT technicians, our DoSC has implemented a comprehensive defense strategy. This strategy includes measures such as creating layers of security controls that must be penetrated in order to access data and systems. These controls are assessed at least yearly by either our security professional or external resources. Infrastructure Kodiak facilities include its corporate offices located in Piscataway, New Jersey, and a smaller satellite office in Brick, New Jersey. These offices are for business operations only. All server housing or processing of client data, applications, or any services that Kodiak offers are located in carrierclass, SOC Certified third-party datacenters located in Norristown, Pennsylvania, Somerset, and Carteret, New Jersey. Kodiak operations are managed by its senior management team with direct oversight from the president. Kodiak follows a strict separation-of-duties structure and is organized into the following functional groups: Systems administration Network administration Service desk Performs day-to-day operations, monitoring, and support of Kodiak systems; responds to client inquiries and issues; performs security administration; and develops and designs client solutions. Performs day-to-day operations, monitoring, and support of Kodiak network devices; maintains and monitors network communications; responds to client inquiries and issues. Provides services support to clients through support calls or ticket requests and resolves inquiries, issues, and requests by

4 Client care Process design and development Risk management and compliance interfacing with other service-desk team members, systems and network team members, and vendors. Responsibilities include managing projects by coordinating client and Kodiak activities, responding to client inquiries, and facilitating the delivery of service. Supports internal and client needs and requirements through full-cycle project management, workflow development, and evaluation and implementation of software packages. Assesses the system to identify areas requiring controls and implements and monitors controls to maintain security and compliance. Automated IT operations and governance An important focus of Kodiak is to put the customer s operational control securely into the hands of its own internal leadership. The primary tool for this is a proprietary application we ve developed called KAdmin. At its core, KAdmin is a website that provides controlled, audited access to Active Directory. Through KAdmin, you can make group changes, overall and specific permissions changes, account creations and deletions, account modifications, password management, and manage a myriad of details related to administrative control. The system is simple and intuitive, and your approval and auditing processes are built in. Policies and procedures Kodiak has developed and maintained policies and procedures that support the operations and control over the system. These policies and procedures comply with HIPAA eligibility guidelines and are intended to protect the confidentiality, integrity, and availability of data stored or processed on its systems. These include: Kodiak Systems Risk Analysis - Risk Management Policy Kodiak Systems Information Systems Activity Review and Audit Policy Kodiak Systems Sanctions Policy Kodiak Systems Assigned Security Policy Kodiak Systems Workforce Security - Information Access Policy Kodiak Systems Security Awareness and Training Policy Kodiak Systems Password Management Policy Kodiak Systems Incident Response Plan Kodiak Systems Business Continuity Plan Kodiak Systems Disaster Recovery Plan Kodiak Systems Data Backup Plan Kodiak Systems Evaluation Policy Kodiak Systems Facility Access Control Policy Kodiak Systems Facility Access Control Procedures Kodiak Systems Workstation Use and Security Policy Kodiak Systems Device and Media Controls Policy Kodiak Systems Access Control Policy Kodiak Systems Data Integrity Policy Kodiak Systems Data Transmission Security Policy Kodiak Systems Information Security Policy Kodiak Systems Change Management Policy Kodiak Systems Facility Security Policy

5 General information system controls Kodiak chooses its third-party datacenters specifically to meet critical business requirements and has developed controls that provide reasonable assurance that physical access to computer equipment and storage media are restricted to Kodiak authorized personnel only. Kodiak has also received reasonable assurance from its third-party datacenters that they have developed controls to protect our client critical systems and are protected from environmental threats and power interruptions. These controls include: Physical security/access control procedures High availability Incident management and problem resolution Business continuity Environmental controls Documented policies and procedures All datacenters have 24/7 security staff. Entranceways are protected with live guards, smartcard readers, and at least two-factor authentication, including biometrics, visual confirmation, and mantraps to protect against piggybacking attempts. Datacenters maintain access lists, and only authorized Kodiak employees are allowed access. Physical security Kodiak servers are located in its own cages within the datacenters and stored in racks. Racks are kept locked and servers auto-logout after a predetermined period of time. Only Kodiak authorized personnel have access to the cages and racks. Video cameras cover the server room floors, other internal built-up areas, and external areas. Cameras are monitored by security staff and videos are archived for at least 90 days. We respond 24/7 to loss of connectivity after we are alerted by our monitoring systems. We manage the trouble ticket and troubleshooting process with the ISP and work with the onsite staff for hands and eyes work. Network and connectivity We manage the onsite network equipment. We can configure and maintain the onsite routers with multiple ISPs for redundancy, manage the wireless networks in the building including authentication with our RADIUS environment, and work with any devices connected to the network. We fully support the LAN down to the devices. Site-to-site VPN for all print traffic communications are encrypted in support of HIPAA guidelines for ephi traversing the Internet All help-desk personnel are qualified and trained Kodiak employees with the ability to shadow your users to provide a level of support promoting far greater productivity. No aspect of our help desk is outsourced. Support is available 24/7, 365 days a year. Help desk and support Proprietary ticketing system available via phone, web, or . Conventional IT support is based on the reactive response of the support group to fix problems. We base the Kodiak service model on our proactive ability to eliminate problems before they occur. As a Kodiak client, your software resides on high-end infrastructure with a team of experienced, well-trained personnel providing you with superior levels of uptime and performance.

6 R x ITaaS service highlights Hosted Framework Dedicated Microsoft SQL Enterprise Database Instance, replicated to standby server in secondary datacenter TEST Microsoft SQL Database instance Dedicated virtual Interface Server, replicated to standby environment in secondary datacenter. TEST virtual Interface Server Access to/from the Internet as needed, and up to 10 site-to-site VPNs Access via Hosted Desktop 2TB Disk storage Microsoft SQL Enterprise Licensing Application patching/upgrading Hosted DocuTrack Dedicated Microsoft SQL Database Instance, replicated to standby server in secondary datacenter Dedicated virtual Application Server, replicated to standby environment in secondary datacenter. Dedicated virtual Application Server, FaxCore, replicated to standby environment in secondary datacenter. Access via Hosted Desktop 1.5TB Disk storage Microsoft SQL Enterprise Licensing Application patching/upgrading Datacenter resources and services Your applications are hosted in a carrier class, tier-3 datacenter that includes advanced offerings of: 24/7/365 physical security Continuous video surveillance Physical infrastructure Power redundancy Connectivity redundancy Seamless scalability System Hardware at Kodiak For both production and related redundancy: Application hardware Database hardware Network hardware Storage hardware Hardware vendor management Hardware service contracts Hardware upgrade, rotation, and disposal Hosted Windows Desktop Deployment User creation Management Provisioning Inventory management Licensing management Secure remote access Microsoft application hosting Fully hosted Microsoft Office Microsoft Office updates and patching Premier-level Microsoft support Microsoft Software Assurance program Microsoft Cloud Service Provider program Line-of-business and operational software hosting Web enabling of client-server applications All server side hardware Technical administration Maintenance Updating and patching

7 Application troubleshooting hosting Hosted Microsoft Outlook and Exchange Healthcare dictated encryption services DLP services Tape backups Restore capabilities Creation and customization of active synch policies Network services Management of customer site router Management of customer site wireless network if installed 24/7 monitoring of customer site connectivity and response to connectivity issues Full-cycle ISP trouble-ticket management Site connectivity performance/reliability troubleshooting/recommendations Phone troubleshooting for LAN issues VPN creation and management Data services Data protection and security processes Electronic data backup Off-site tape backup (including integrity management) Restoration services HIPAA/HITECH business associate compliance Full-time, in-house compliance officer Ensure appropriate safeguarding of your protected health information Will only disclose protected healthcare information as required Help desk 24/7/365 help desk (staffed with internal US-based Kodiak technicians) o User-shadowing capabilities o Proprietary ticketing system available via: Phone Web Automated administration KAdmin administration system Provides managerial control to: o Create users o Disable users o Reset passwords o Assign efax numbers o Manage groups, applications, and group membership (including rules-based and approval-based) Microsoft compliance No dormant licensing charges only pay for what you use Server licensing O/S licensing Microsoft Office licensing Outlook and Exchange licensing Energy savings Elimination of server power costs Elimination of server room cooling costs Thin client stations generally cost $16 a month less to operate than PC stations Seamless scaling capabilities Facility zero processor environment enables a far more rapid site deployment than conventional hybrid hosting Automated secure user creation and deletion Automated permission assigning

8 Kodiak Systems and Microsoft Kodiak Systems is a certified Silver Microsoft Partner. Our modern healthcare IT solutions are built on the Microsoft Cloud. We offer remote hosting, hosted desktop, business continuity, hosted Microsoft Office and Microsoft Exchange, and Microsoft Office 365.