Business Strategy: IDC MaturityScape Cloud in Healthcare Provider

Transcription

1 Business Strategy Business Strategy: IDC MaturityScape Cloud in Healthcare Provider Judy Hanover IDC HEALTH INSIGHTS OPINION This IDC Health Insights report presents a maturity model for healthcare provider organizations that are beginning to invest in cloud, have projects in progress, or have significant portions of their IT infrastructure in the cloud. According to IDC's 2013 CloudTrack Survey, over 50% of healthcare organizations indicate that they will be piloting, using, or otherwise managing some form of cloud public, private, or hybrid as a part of their IT infrastructure in the next 24 months. However, the use of cloud computing as an increasingly business-critical technology is quickly changing how healthcare providers evaluate, procure, and deploy IT assets. Healthcare provider IT departments will operate in an environment that is centralized and focused on service delivery and more predictable expenditures. Individual departments will gain ready access to centralized IT resources at defined service levels and cost. This Cloud MaturityScape is for healthcare organizations that are interested in understanding how they can take the necessary actions to move forward successfully with cloud computing or to improve the results from existing cloud projects. The model has the following functions: Identifies the business benefits that providers can realize in each of the stages, and guides the CIO in envisioning and developing the next-generation systems that leverage cloud and other key emerging technologies, including big data and analytics, mobile, and social. Addresses the key changes that must occur in people, process, and technology, expanded as eight core measures IT roles; business roles; vendor management; service management; architecture, security, and integration; infrastructure; platform; and software. Shows that each stage requires increasing investment and increasing value not just from IT organizations and IT budgets but more broadly across the provider organization. Companies may advance at their own pace and to the stage that best works for their business needs, which is not necessarily Stage 5. May 2014, IDC Health Insights #HI247819

2 IN THIS STUDY Methodology In this study, we identify a Cloud MaturityScape that identifies the stages, critical measures, and actions that are required for organizations to transform the way that they operate their IT organizations as well as source and deploy their IT resources. IDC Health Insights' Cloud MaturityScape is for organizations that are interested in understanding the impact that cloud deployments can have on their business outcomes so that they can take the necessary actions to move forward in a step-by-step process. This model is designed to address all types of cloud deployments (private, public, and hybrid) across all resources (software, infrastructure, and platform). IDC's cross-industry Cloud MaturityScape was published in IDC MaturityScape: Cloud A Guide for Success (IDC # March 2013); this version of the model applies to the healthcare provider industry and adds specific guidance for healthcare providers. Provider organizations should use IDC's Cloud MaturityScape to incorporate cloud into their overall IT strategy and to drive higher return for the business from cloud investments. Additionally, organizations will be able to do the following: Gauge the maturity of their own cloud deployments and strategy, and then use that baseline to plan for future improvements Use the Cloud MaturityScape as a basis for discussing and agreeing on a future state, and develop a road map to reach it Please note that a significant portion of the data discussed in this study, specifically that from IDC's October 2013 CloudTrack Survey, is from a study that includes both payers and providers in the sample of 153 healthcare participants. While the majority of respondents are from provider organizations and the content of this report is targeted to providers, those who are examining the data should take the details of this study into consideration. Note: All numbers in this document may not be exact due to rounding. Executive Summary Based on IDC's 2013 North American Global Technology and Industry Research Organization IT Survey, we know that 51% of all healthcare companies are in the process of using, planning, or researching cloud. In the process, they will transition to a shared, dynamic, automated, "elastic" IT environment that is delivered through a private, public, or hybrid cloud. The "mature" cloud-centric IT organization will achieve improved application performance, greater staff productivity, more operational cost efficiency, and increased opportunities for business innovation. The most important work that a healthcare provider CIO or CMIO can do over the next several years is to collaborate across the company to envision and develop these next-generation systems that include cloud and other emerging technologies such as big data and analytics, mobile, and social. IDC's Cloud MaturityScape helps guide the CIO along that path IDC Health Insights #HI

3 With cloud computing, healthcare organizations will transform the way they staff and manage their IT organizations while better optimizing the way they source and deploy their IT resources. To maximize the value from investments in cloud, companies must be aware of the potential benefits and the pitfalls. Companies must also regularly measure their performance and quantitatively assess their progress. IDC's Cloud MaturityScape will assist organizations in assessing their current capabilities and identifying their gaps. The model specifically defines the stages, critical measures, business outcomes, and actions that are required to effectively move through the stages and increase value as investments increase. In Table 1, we indicate the key business goals and benefits of each stage. TABLE 1 IDC's Cloud MaturityScape for Healthcare Providers: Overview of Maturity Stages Stage 1: Ad Hoc Stage 2: Opportunistic Stage 3: Repeatable Stage 4: Managed Stage 5: Optimized Business goal Develop highlevel knowledge of the business value of cloud computing for immediate, tactical needs Scale up access to standardized IT resources via cloud, at lower costs or increasing speed Understand cost and business value of technology options (across spectrum of cloud and noncloud) Create business transformation opportunities with cloud, associating risks with reward Enable managed risk taking including HIPAA assessments to deliver innovative ITenabled products and services 2014 IDC Health Insights #HI

4 TABLE 1 IDC's Cloud MaturityScape for Healthcare Providers: Overview of Maturity Stages Stage 1: Ad Hoc Stage 2: Opportunistic Stage 3: Repeatable Stage 4: Managed Stage 5: Optimized Description Evaluating vendor and technology options for cloud Beginning pilots for specific use cases; little to no PHI or HIPAA risk is involved in early pilots Making deployment comparisons across public, private, and hybrid Increasingly identifying and testing applications and workloads to transition to cloud Gathering input across the business to eliminate redundant efforts Workloads may begin to include HIPAAprotected data, but risk is still low Following a documented approach to cloud Tracking and reporting progress and performance; growing benefits justify more risk associated with PHI in the cloud Gaining acceptance through internal cloud champions Incorporating structure, with quantitative performance management Increasing influence on cloud standards, compliance requirements, and technology development Risk is carefully managed, and will begin to include PHI and HIPAA risk, BAA agreements, and risk indemnification when working with cloud service providers Achieving a level of excellence that includes feedback loops for continuous improvement Identifying the best option for the business, whether through cloud computing or not The benefits of the cloud clearly outweigh HIPAA risk; all internal and external cloud players are well versed in HIPAA-related responsibilities and BAA constraints Business outcome Increasing exploration of cloud technology options and key considerations as well as their contribution toward IT efficiency Promoting buy-in to cloud computing and need for companywide approach, experimentin g with shortterm improvement s in access to IT resources via cloud Enabling more agile access to IT resources through aggressive standardizatio n and measurement, identifying cloud best practices, and increasing governance Expanding a consistent, best practice enterprisewide approach to cloud, speeding iterative cycles to increase cloud adoption and value Driving business innovation through seamless access to IT resources, making informed decisions based on true cost and value with internal and external partners Note: The term business refers to the entire hospital, practice, clinical, health system, or other institution. Source: IDC Health Insights, IDC Health Insights #HI

5 Like most new technologies, cloud requires significant change management, particularly for healthcare provider organizations. Cloud will provide the most value to those organizations that consider not just cloud's technical capabilities but also the necessary changes to people and processes. Change is ongoing in the healthcare industry constantly, whether it is regulatory change or new business models, but change is easier to facilitate when the goals and outcomes are clearer and have significant business value. Although we've identified individual stage goals, we also think that the journey may be presented even more simply, with priorities transitioning as cloud matures in the organization through three core priorities: IT efficiency: This is the first priority in the early stages but continues throughout the maturity model. It is addressed through IT resources that are delivered quickly and efficiently when and where the business needs them, at an acceptable price point. Often, cloud operations goals at this stage are to realize efficiency goals without attacking data containing protected health information (PHI) or incurring HIPAA risk. IT agility: Increasing as a priority in the next few stages, IT agility is addressed through IT resources that are available in easily consumable, consistent, and standardized services. At this stage, the agility added by cloud becomes more apparent to the organization, and more HIPAA-governed applications containing PHI may begin to migrate to the cloud. BAA agreements are in place with cloud service providers, with cloud service providers offering risk indemnification and HIPAA-aware environments. Business innovation: This priority peaks in Stage 5, enabling the business to address customer opportunities and optimize business performance, with business agility. In Stages 4 and 5, organizations are fully aware of and developing expertise in managing HIPAA-related risk, and all applications and innovative approaches become candidates for moving to the cloud. We believe that the real opportunities for cloud come from the development of intelligent industry solutions, which build on top of a new platform that includes cloud as well as big data and analytics, mobile, and social. This includes process-oriented solutions like patient safety, computerized physician order entry (CPOE), clinical documentation, clinical decision support, pharmacy operations, delivery of test results, mobile health, remote health monitoring, patient administration and billing, patient and provider engagement, and other critical functions in clinics and hospitals. SITUATION OVERVIEW Based on results from IDC's October 2013 North American CloudTrack Survey, more than 50% of U.S. healthcare organizations expect that within five years, they will be delivering IT capability through the cloud. The majority of healthcare organizations are planning private cloud implementations, with 33% planning private cloud within the next 12 months. Onsite private clouds are more common than offsite. However, public cloud services are also planned, and an additional 20% of healthcare organizations plan cloud deployments within the next 12 months. However, a full 37% of healthcare organizations are still in the evaluation stage, and it is still early on in the move to cloud for these organizations with private being the most common, but also public and hybrid clouds entering the conversation. The use of cloud computing as an increasingly business-critical technology, as healthcare organizations 2014 IDC Health Insights #HI

6 transition to new payment models and value-based care, is impacting how companies and institutions evaluate, procure, and deploy IT assets. However, the transition to cloud computing to deliver significant resources requires change throughout the organization in people, process, and technology. Healthcare IT departments will operate in an environment that is based on service delivery and more predictable expenditures, and organizations will gain ready access to IT resources at defined service levels and cost. Implementation plans of healthcare organizations are described in Figure 1. FIGURE 1 Use of Cloud in U.S. Healthcare Organizations n = 153, among the 51% indicating use of cloud Source: IDC's CloudTrack Survey, October 2013 The Cloud MaturityScape We've based our healthcare provider cloud model on a combination of IDC's horizontal and healthcare market research, IDC's knowledge of the CIO and CMIO and dynamics in the IT organization in the provider setting, IDC's experience in the healthcare provider industry as well as the payer and other related industries, and IDC's knowledge of IT vendors and the healthcare provider IT industry itself. Here are some of the key influencers of the criticality of cloud computing: There's unprecedented growth in data and content that must be stored, organized, and archived for long periods. IDC forecasts that the digital universe will reach 40ZB by Healthcare data, whether it is imaging or other types of structured or unstructured data, makes up a significant storage burden for providers. Cloud provides an ideal option for storing this data IDC Health Insights #HI

7 Cloud will emerge as the primary platform for supporting mobile and analytics (big data) efforts. With mobile devices and analytics tools gaining importance in provider settings, cloud technologies will be critical in supporting and securing these new devices and applications. IT and the rapid availability of IT resources are essential to the success of business. IT represents an increasing component of the products and services that are sold to customers and contributes to how we make, source, and deliver healthcare services in collaboration with other providers as well as patients and suppliers. Learning and knowledge transfer continue from technically innovative companies such as academic medical centers and integrated delivery networks that have invested significantly in cloud, mega datacenters, and converged IT infrastructure, including cloud-based service providers. Healthcare providers increasingly prefer to buy IT resources in a pay-as-you-go model and through operational expenditures rather than capital expenditures. IDC's 2013 CloudTrack Survey found that 48% of respondents stated that it was important or very important to restructure the IT financial footprint and shift from a capital-intensive model to an operating expense model. The most valuable IT skills are best reserved for projects that require a high-level understanding of business needs, but most IT organizations find themselves overwhelmed by operational needs and challenged to accommodate specialty projects on the timeline that the business wants. With the growing demands of healthcare reform, agility is of prime concern. Cloud computing is very simply defined as accessing shared IT resources "on demand" and over the Internet. IDC further defines cloud services through eight key attributes from the perspective of the end users of the service: shared, standard services; a packaged solution; self-service; elastic resource scaling; elastic, use-based pricing; ubiquitous (authorized) network access; standard UI technologies; and published service interface or API. The specifics of these attributes vary based on the deployment models: public, private, and hybrid. Perhaps one of the most important points is that cloud is much more than just a highly virtualized environment. Furthermore, hybrid clouds are generally defined as blending private and public cloud resources, or hybrid may refer to a blending of noncloud and cloud resources. (See IDC's Worldwide IT Cloud Services Taxonomy, 2012, IDC #233396, March 2012, for a detailed definition.) The future state of IT will combine the use of IT resources that are deployed in the company datacenter with resources (infrastructure, platform, or software) that are deployed through the cloud (refer back to Figure 1). The delivery of these services combines a service catalog, a service broker, and a service portal to provide the user with seamless access to IT resources from internal or external sources, with a clear understanding of the cost, value, and service levels that they will receive (see Figure 2). In the hybrid IT environment, a service catalog is created and refreshed; a service broker discovers, costs, and rationalizes new services; and service users access IT capabilities through a self-service portal. Organizations are already making use of cloud computing, not only to support IT efficiency and agility but to co-innovate with partners and provide new products and services. For example, Aetna, a leading U.S. payer, was among the first movers to recognize the impact of the changes on IT and to assemble a portfolio of forward-looking health and technology solutions under its Healthagen business. The set 2014 IDC Health Insights #HI

8 of solutions Aetna Healthagen provides for coordinating care and facilitating value-based medicine made strong use of online and mobile approaches and solidifying its cloud-based strategy for delivering these solutions. Other healthcare collaborations provide examples of collaborations between providers and technology suppliers, such as Peake Healthcare Innovations, which is a joint venture between industry leaders Harris Corp. and Johns Hopkins Medicine, that offers PeakeSecure, a cloud-based image archive platform. Peake offers a managed service solution to assist providers with storing and managing medical images and related healthcare information, under the trusted name of both Johns Hopkins, a renowned Baltimore-based academic medical center, and Harris, a technology supplier. Hybrid IT models are becoming the rule for healthcare provider organizations. Figure 2 illustrates the types of models undertaken in the hybrid IT model. As we can see from the data at the bottom of the chart, healthcare may have 36% of its IT budget in traditional on-premise IT as of 2013 (as compared with 31% across all industries), but respondents expected that number to drop from 36% to 28% over the next 24 months, and even further, with just 25% of budgets in traditional on-premise IT by As you can see from the budget shifts shown in Figure 2, for healthcare organizations, the largest shift will be to self-run private clouds, but managed, dedicated, and virtual private clouds will all be important in the migration to the cloud IDC Health Insights #HI

9 FIGURE 2 Budget Change Expected in the Hybrid IT Model Q. How much of your company's IT budget is allocated to buying/managing these different types of IT services, today and 24 months out? n = 153 for healthcare; n =1,109 across all industries surveyed Source: IDC's CloudTrack Survey, October 2013 THE APPROACH Highlighting the Stages IDC's Cloud MaturityScape traces the increasing value and investment of cloud computing across five stages, from Ad Hoc to Optimized, and these stages are adapted to healthcare provider organizations. The sections that follow feature descriptions of the stages and highlights of the fundamental outcomes of each stage, elaborating on the summaries that were already presented (refer back to Table 1). Stage 1: Ad Hoc Healthcare providers are beginning the exploration process to increase their awareness of cloud technology options, key considerations, and cloud's contribution toward IT efficiency. There is limited 2014 IDC Health Insights #HI

10 enterprisewide awareness of these activities, and some instances may be unauthorized. Some are turning to cloud because of the immediacy of the need and the ability to procure capacity with minimal monthly or one-time investments that require little or no outside approval. The majority of cloud exploration occurs in workloads that do not involve PHI or HIPAA risk as the technology model is explored and IT and departmental staff learn more about the model without incurring risk. Stage 2: Opportunistic Healthcare organizations are experimenting with more standardized offerings and developing shortterm improvements regarding access to IT resources via cloud. They are also promoting buy-in to cloud computing across the hospital and acknowledging the need for an enterprisewide approach. They are testing their ability to transition workloads from existing traditional in-house or outsourced IT deployments as well as new ones. IT considers private and public cloud for new solutions or isolated computing environments with minimal impact on existing business processes, lower implementation costs, and/or faster delivery for commodity resources. HIPAA-related risk is still avoided, although some experimentation may occur in private clouds and participants may explore BAAs and other riskindemnification offerings with external cloud service providers. Stage 3: Repeatable Providers are seeing the benefits as they are enabling more agile access to IT resources through aggressive standardization, identifying cloud best practices, and making good use of internal private cloud use. The need for external cloud service providers is growing, and in response, IT organizations are increasing governance, particularly concerning HIPAA-protected data. Departmental and IT users are beginning to rely on self-service portals to access cloud services based on cost and quality of service as well as to automate approvals and workflows that are necessary to rapidly provision and activate services. Users have access to a wider range of resources with more predictability, transparency into the cost of those resources, and the ability to more easily forecast their IT resource requirements. Stage 4: Managed Provider organizations are expanding the boundaries of how and why they use cloud. This is a consistent, best practice enterprisewide approach to cloud, speeding iterative improvement cycles to increase cloud adoption and business value in the private and, sometimes, the public cloud. Companies in this stage are orchestrating service delivery across an integrated set of resources and collaborating internally and externally to support their future technology needs. Well-established relationships include both internal and preferred external cloud service providers with established BAAs and risk indemnification for ongoing projects. Users can procure additional services, add new users, and increase or decrease compute capacity as needed through self-service portals, expanding the organization's ability to operate not just more efficiently but also more strategically. Stage 5: Optimized Companies are driving business innovation through seamless access to IT resources from internal and external service providers and making informed decisions based on the true cost and value of those services. They are using cloud to lower the costs and speed up the delivery process. The business 2014 IDC Health Insights #HI

11 impact is most noticeable for new initiatives as well as for high business value or highly innovative projects, where some level of customization of IT resources is critical and risk sharing creates an environment that fosters innovation. These organizations have the ability to leverage their IT capabilities as a component of new products and services. IT is an equal partner in achieving longterm business goals, and IT is responsible for ensuring the successful delivery of IT capabilities throughout the life cycle of those technologies. Defining Progress Across People, Process, and Technology We track the five stages through people, process, and technology, with eight measures that are applicable to private, public, and hybrid cloud deployments. These stages, in many ways, are analogous to the critical success factors that providers have seen when implementing clinical applications. The best EHR cannot succeed if leaders are not on board and the organization's processes are not prepared for the change. As with clinical applications, cloud implementations require deliberate attention and change to maximize the value from investments. People: We've segmented "people" into two core measures IT roles and business roles because we see an evolution in how the IT and business groups develop separately and in their increasing coordination through the adoption of cloud. Through the five stages, we consider attributes such as skills, culture, leadership, organizational structure, and interdepartmental relationships for these two measures. Process: We've segmented "process" into three core measures: Vendor management: We've selected this measure because organizations will need to change the quantity and mix of vendors that they work with as well as the way that they work with them, considering attributes such as procurement, contract definition, compliance, incident management, innovation, and business continuity. This may refer to both internal vendors for private clouds and external vendors for public clouds. Service management: We've selected this measure because managing cloud services requires a transition from a traditional model to an end-to-end service delivery focus that defines and manages IT capabilities in terms of policies and service-level agreements (SLAs). Elements of service management include service definitions, configuration standardization, SLAs and policies, service performance and consumption measurement, forecasting, and chargeback. These measures are most likely to involve external service providers, but internal cloud service providers should also consider these service management goals in healthcare organizations. Architecture, security, and integration: We've selected this measure because cloud represents a fundamental shift in the way that IT environments are designed and managed. Cloud environments rely on well-defined standards to enable workload and information portability across a wide range of heterogeneous internal and external resources. This will not come naturally for healthcare organizations accustomed to nonstandard legacy applications and may complicate cloud deployments as a result. The ability to create, deploy, and optimize end-to-end services that can fully exploit the selfservice, portability, and elasticity capabilities that are provided by cloud architectures is fundamental to achieving a mature cloud environment. Most legacy healthcare applications do not offer standards-based integration, but providers increasingly need to demand openness from their vertical industry suppliers in order to fully leverage the power of cloud IDC Health Insights #HI

12 Technology management: We've segmented technology into three core measures because we see adoption of cloud-enabled platform, infrastructure, and software occurring at different rates. However, we also expect the technology to continue to evolve over time, so these measures are less about the technology itself and more about management, considering attributes such as adoption rates and ease of adoption, deployment models (public, private, or hybrid), interdependencies, technology maturity and risk, and transparency into a vendor's technology stack. The three core measures are: Platform: Encompasses functionality enabled by application development, testing, database, analytics, middleware and related packaged, open source, and custom software including public PaaS services. Infrastructure: Encompasses functionality enabled by physical and virtual systems, storage, and network hardware and public IaaS services as well as functionality enabled by packaged, open source, and custom software and SaaS services providing infrastructure software functionality including operating systems, hypervisors, cloud system software, security and identity management, system management, storage management, and network management. Software: Encompasses functionality enabled by packaged, open source, and custom application software including SaaS-based application software solutions. Examples include collaborative apps, content apps, CRM, ERM, SCM, ops and manufacturing apps, and clinical apps. Note: Although we've described platform, infrastructure, and software as three clearly delineated categories, many cloud-based offerings will span multiple technology categories. For example, virtual private cloud services delivered via third-party cloud service providers may combine infrastructure hardware with remote SaaS management and development capabilities all for a single monthly fee. All references to specific functional software markets are consistent with definitions used for those functional markets in IDC's Software Taxonomy, 2013 (IDC #241527, June 2013). Table 2 adds more detail across the five stages for people, process, and technology IDC Health Insights #HI

13 TABLE 2 IDC's Cloud MaturityScape for Healthcare People, Process, and Technology Stage 1: Ad Hoc Stage 2: Opportunistic Stage 3: Repeatable Stage 4: Managed Stage 5: Optimized People IT roles Business roles Traditional IT and business roles persist Cloud skills development scattered across the company No coordination on cloud requirements or pilots No clear guidance or leadership on cloud internal to the organization New IT roles developing to support cloud and identify priorities IT and business groups make independent decisions but share knowledge and requirements Cloud leaders beginning to emerge within the IT and business groups IT reorganizes with cloud-focused roles and leaders Skills acquisition becomes a process Increasing transparency and consistency in decision-making Coordination between IT and business strengthens IT roles reflect service culture to deliver IT resources IT and business collaborate on service management strategy Processes accelerate learning and knowledgesharing (including needs and capabilities) between IT and business The IT and business organizations collaborate to empower business with cloud and services, to achieve business goals efficiently, drive business innovation, and satisfy business policies 2014 IDC Health Insights #HI

14 TABLE 2 IDC's Cloud MaturityScape for Healthcare People, Process, and Technology Stage 1: Ad Hoc Stage 2: Opportunistic Stage 3: Repeatable Stage 4: Managed Stage 5: Optimized Process: Cloud vendor management Cloud service management Architecture, security, and integration IT has a traditional vendor management strategy, and reviews best practices for outsourcing, with little to no input from business units. Multiple service catalogs and configuration templates develop for single projects, with only basic support for internal standards. There is minimal consideration for impact on architecture but recognition that planning is required for security, risk, and compliance concerns. Informal lists of preferred vendors circulate but inconsistencies in procuring cloud services and defining contracts persist. Favored workloads for cloud emerge (generally for new IT resource requirements and tactical needs), standard configurations and reusable blueprints are shared, and the adoption of automated provisioning and deployment begins. Traditional IT practices, like life-cycle management, are applied to cloud, and enterprise architecture starts to play a role in RFPs, but cloud-related data management and security considerations still need attention. Procurement occurs through a centralized and increasingly automated process; vendor and contract reviews reflect service delivery, architecture, and other policy requirements. Service-level agreements expand, performance measurement accelerates, and services extend to ongoing operations of newer and more strategic investments. IT architects enforce key requirements and standards (internal and external) for service delivery, and cloudaware IT practices extend across all IT resources. Vendor management embraces risk management to balance IT cost efficiency and agility with business continuity and innovation. Service delivery and management encompass the entire IT environment, with endto-end performance monitoring and ongoing optimization. IT architects ensure a dynamic provisioning of workloads between internal and external IT resources securely, providing workload portability as well as data control and governance. Vendor management uses well-documented requirements and performance measurement, with processes for bringing in alternative providers (internal or external). Service management and service catalogs maximize the value of existing IT resources, with processes to support new service requests and the ability to associate cost with consumption and service levels. IT architects ensure seamless access across IT resources and the ability to take advantage of new technologies that will benefit the business IDC Health Insights #HI

15 TABLE 2 IDC's Cloud MaturityScape for Healthcare People, Process, and Technology Stage 1: Ad Hoc Stage 2: Opportunistic Stage 3: Repeatable Stage 4: Managed Stage 5: Optimized Technology management: Platform Infrastructure Software Early public cloud use generally relies on a single vendor stack (combination of software, platform and/or infrastructure). Early private cloud use often focuses on the datacenter. Public cloud may require customization, and vendors' details of technology, policies, and processes show gaps. Cloud investments test best use cases for cloud deployment models (public, private, and hybrid) and IT and business needs. Evaluations of cloud begin to link with other IT efficiency efforts, such as virtualization, IT resource rationalization, and application reviews. Cloud projects remain fairly independent from the broader IT environment. Focus on rapid scale up or scale down for IT agility, flexible pricing models, and more complementary services. Testing new services becomes routine, with increasing attention to supporting missioncritical requirements. Cloud-based services increasingly combine vendors and technologies. Service investments and delivery (performance) are associated with economic value. Service-based access to IT capabilities crosses vendor, technology, and deployment model boundaries. Managing risk with reward and enabling innovation across portfolio of IT assets. Bringing new technology into the self-service portal to maximize innovation is a core competency across public and private cloud and traditional IT options. Offerings achieve a mix of completeness, consistency, and coherence. Source: IDC Health Insights, IDC Health Insights #HI

16 FUTURE OUTLOOK When IDC introduced its cross-industry Cloud MaturityScape in 2013, IDC estimated that less than 10% of companies are in Stages 4 and 5 combined (based on 2012 North American Global Technology and Industry Research Organization IT Survey). According to IDC's CloudTrack Survey in 2013, 20% of respondents across all industries reported they were in the managed or optimized stage (Stage 4 or 5), while 15% of healthcare organizations reported the same. Progression from Stage 1 to Stage 5 requires increasing financial and organizational investment as it creates increasing business value in any industry. We see additional investments in cloud ahead, but provider organizations must address key inhibitors, including security, availability, risk, and the need for a multiyear road map. Increasing Investment in Cloud Ahead Not all companies may want or need to progress to Stage 5. However, the changing nature of technology and its increasingly fundamental contribution to business strategy and tactical execution requires companies to seriously consider the fact that Stage 5, or at least many of the Stage 5 measures, may be absolutely necessary to succeed in 10 years. By 2016, 70% of CIOs will have a "cloud first" policy, up from just 23% today (IDC's CIO Study). Finally, cloud computing is an increasing component of a company's IT investments and IT budget (see Figure 3), with 12% of IT budgets shifting from traditional IT to cloud deployment models in just two years. In the healthcare industry, the demand for agility in the IT organization as providers transition to value-based care makes cloud, whether private or public, a natural fit. Private cloud holds the most appeal in the short term, and public cloud presents the greater long-term appeal for IT efficiency and agility. Addressing the Key Inhibitors The continuing development of cloud computing requires companies to evaluate the steps that they need to take now and in the coming years. Based on IDC's 2013 CloudTrack Survey and conversations with decision makers, we expect that security and regulatory compliance will be an ongoing concern. In the 2013 CloudTrack Survey, security (58%) and regulatory compliance (38%) issues were top of mind. However, with the introduction of the HIPAA Omnibus Rule in early 2013, the tide is changing. In the 2013 CloudTrack Survey, we also asked respondents if they felt that cloud computing/saas solution providers can offer better security than the level their own organization's IT security team can provide, and a majority over 65% in healthcare agreed that they felt cloud service providers could offer better security than they could on-premise. Security and regulatory compliance concerns will continue to impact cloud adoption, and buyers will push providers to embed security, privacy, and compliance into the services. However, with clear risk-indemnification options via BAAs, and a growing number of horizontal cloud service providers willing and able to serve healthcare providers, the tide is turning toward cloud. Although we expect regulatory clarifications and technology improvements to help alleviate the security concerns, these issues are also very much about policies and planning. How companies address these issues will impact how quickly they can move forward IDC Health Insights #HI

17 Making Progress in IDC's Cloud MaturityScape As time goes on and business needs evolve, IDC expects provider organizations to continue to mature in their adoption of cloud. Although we expect IT and business roles will progress over time, the majority of IT and business organizations will find it a challenge to progress as quickly as they'd like and as quickly as the business moves. IT's ability to build their learning processes into their everyday tasks will give them the opportunity to learn faster than the business. This means that they will increasingly have the responsibility to educate the business. For our process measures, we expect providers to invest significantly in defining services requirements and service levels as well as in architecture, security, and integration as a means of enabling progress. The health system's ability to control its own architecture will lead to the greatest improvement in process, and while the company will make progress in service management, the selfservice portal and the service catalog's inclusion of internal and external resources and resulting dependence on service providers may add delays. Some of the key challenges for progress in service management will be related to required collaboration between IT and business (including procurement and the CFO) to define services, assign service options by role, and allocate costs and set prices. Similarly, the inherent difficulties in communicating and collaborating with vendors (including negotiating contracts and pricing) will slow down progress in the vendor management measure. Early investments in virtualization and converged infrastructure, investment plans in cloud-enabled infrastructure, and the standardized and commoditized nature of most infrastructure give this technology area an edge. Platform's IT-centric nature means that progress in bringing this technology resource into the organization via cloud should move quickly. Software has an early edge today, but its more visible connection to business requirements could keep its pace at a more moderate level than other technology areas. In general, we expect companies to invest more cloud computing in technologies that are seeing faster innovation cycles. ESSENTIAL GUIDANCE Cloud adoption among U.S. healthcare providers is widespread and growing, with private cloud as the dominant model. As providers look to move new workloads into the cloud to respond quickly to changing business and regulatory requirements, they should consider the following recommendations: Look for cloud providers with healthcare offerings, plus industry experience and expertise, when sourcing cloud services for payer operations. These cloud service providers will be more likely to understand the constraints associated with handling HIPAA-protected data and with the unique demands of vertical applications. Require business associate agreements and healthcare-specific SLAs. Best practices for constructing these SLAs should include both compliance with HIPAA rules and service metrics specific to the demands of the application and end users. For many organizations, concerns about security and, more generally, the uncertainty of cloud raise significant risk challenges. Technically, many of the risks can be managed, though not eliminated with appropriate SLAs. Ask for financial indemnification for costs associated with breaches such as regulatory penalties, fines, and required actions, as well as follow-on legal actions by victims. Cloud 2014 IDC Health Insights #HI

18 service providers familiar with healthcare will understand the risks and penalties associated with HIPAA breaches, but cloud service providers with less experience in the vertical may require education. It is important that both customer and supplier have a full understanding of the breach risk and economics before entering into a relationship. Manage security risk, but don't rule cloud out. As with on-premise deployments, security issues need to be managed carefully, but should not be a deterrent to cloud strategies. Look for cloud providers that offer consulting, training, and implementations services to facilitate the transition to the cloud. While external service providers can be helpful when getting started with cloud and supporting ongoing operations, the on-premise IT staff also needs to understand and develop skills to support and troubleshoot cloud environments. A strong in-house cloud skill set will allow payer organizations options when making the decision to outsourcing or keep clouds on-premise and allow for flexibility to change cloud service providers or bring operations in-house if desired. Expect to see new cloud service providers catering to healthcare and, perhaps, to pay a premium for the risk involved in serving the industry. The HIPAA Omnibus Rule, published in early 2013 by HHS, clearly spells out the risk-sharing obligations that exist between cloud service providers and customers when it comes to operating as business associates. Providers should be certain that cloud service providers understand this obligation before entering into partnerships and should expect the pricing of healthcare-specific services to reflect the shared risk. Transition to a service-centric organization. When making the move to the cloud, the IT organization will change. Cloud will require different skill sets but standard services and platforms typically allow staff to retrain and specialize to support the new environment, allowing additional efficiencies with improved service levels. Set key IT goals that lead to new levels of existing IT services and new services. Cloud should present an opportunity for the IT organization to improve service levels and offer more services to end users with the same staffing levels. To ensure that the organization captures these efficiencies, planning the transition to cloud and setting goals should be part of the process. Continue experimentation and develop best practices related to cloud computing. Each provider IT organization will need to experiment to determine the cloud practices that are best suited to the needs of its staff and end users. The transition in staffing and service roles will take time, and organizations should allow for experimentation as best practices emerge. The final stage of cloud maturity, optimized, refers to an organization that has standardized policies around the use of cloud, has made cloud a best practice, and has the ability to not only move services to the cloud, but also to capture efficiencies and benefits that could not be achieved in traditional deployments. Connect cloud to other new technology investments. Cloud environments need to be embraced as an extension of existing on-premise and other new technology investments. Ensure that users can dynamically access internal and external resources via a common selfservice portal and service catalog and that legacy vendors align with this strategy whenever possible, even when hurdles exist. Evaluate and document the technical and business risk of specific workloads shifting to cloud. Providers should weigh the benefits and risks of moving specific workloads to cloud. The business impact of cloud is most noticeable for new initiatives as well as for high business 2014 IDC Health Insights #HI

19 value or highly innovative projects, where some level of customization of IT resources is critical and risk sharing creates an environment that fosters innovation. Exploit the capabilities of cloud to create opportunities for business, including new cloudenabled products and services. Optimized cloud implementations will drive business innovation through seamless access to IT resources, and allow provider organizations to make informed decisions based on true cost and value with internal and external partners. Actions to Consider Taking Steps Now and Over the Long Term In addition to using IDC's Cloud MaturityScape to guide your progress, we also provide the following guidance in various time frames: Now: Assess the current cloud and service-oriented skill sets across the business and in IT, engage with peers and vendors, and inventory ongoing pilots and projects. Next budget cycle and over the next one to two years: Build skills and knowledge in cloud and cloud service management, and use early wins to demonstrate potential and justify budget allocations. Identify cloud champions that not only promote cloud in the business (with measured performance reports) but also gather feedback on the transition and build a bridge between IT and business, expand projects, define architectural standards and risk requirements, review vendors, and budget for cloud investments. Midterm refresh in three to five years: Review your progress to date. Report on the business and technical successes as well as areas needing improvement, ensure that your IT staff and vendors are satisfying the requirements of a service-oriented IT delivery model (or find new ones), and update your architectural assumptions to sync with technology advances. Table 3 presents our guidance specific to the five stages of IDC's Cloud MaturityScape. Regardless of their current stage, companies should consider smart on-ramps as a strategy to make intelligent decisions when moving from one phase of the cloud to another. Finally, companies must recognize that the most significant opportunities for cloud come from the development of intelligent industry solutions, which build on top of a new platform that includes cloud computing as well as other key new technologies, such as big data and analytics, mobile, and social. The most important work that a CIO or CMIO can do over the next several years is to collaborate across the company to envision and develop these next-generation systems, taking a path that considers people, processes, and technologies together IDC Health Insights #HI

20 TABLE 3 IDC's Cloud MaturityScape Guidance: Advancing to the Next Stage Stage Guidance Ad hoc: Increasing the exploration of cloud technology options and key considerations as well as their contribution toward IT efficiency. Classify and validate the benefits of cloud deployments and identify key hurdles in the form of people and processes. Understand the technology and the cloud services providers, and transition pilots to production for services that maximize IT efficiency. Inventory all current cloud usage (including "shadow IT"), detailing how much is being spent on cloud and which development platforms are in use. Lay the foundation for more deliberate decision making, and develop policies and procedures. Opportunistic: Promoting buy-in to cloud computing and the need for companywide approach, experimenting with short-term improvements in access to IT resources via the cloud. Create a dedicated fund to encourage and learn from (managed) experimentation. Design and implement a range of organized pilot projects that can deliver quick value to specific user groups and conduct a structured analysis of lessons learned. Identify the gaps in current IT resources and consider cloud as a means of filling those gaps to facilitate more rapid adoption of cloud. Take deliberate steps to operate with standards. Experiment, select, or set standards, internally and externally. Initiate a set of cloud-related policies and procedures governing future deployments, and develop a cloud road map to maximize the value of investments. Repeatable: Enabling more agile access to IT resources through aggressive standardization and measurement, identifying cloud best practices, and increasing governance. Begin to incorporate cloud standards into the overall IT architecture and monitor developing cloud standards. Consider making support for key standards a requirement for all new in-house and public cloud acquisitions. Evaluate and document the technical and business risk that is associated with different cloud services and platforms, and develop standard policies for data portability and reclamation, service-level reporting, and security. Add cloud services options to the list of available options and incorporate cloud decision making into overall IT architecture plans and policies, looking ahead to how cloud will serve future needs and viewing cloud and traditional IT as a continuous resource. Rationalize the IT procurement process to support a shift to subscription, pay-as-you-go pricing. Extend your vision of architecture beyond the enterprise, introducing new services to the customer and partner base IDC Health Insights #HI

21 TABLE 3 IDC's Cloud MaturityScape Guidance: Advancing to the Next Stage Stage Guidance Managed: Expanding a consistent, best practice enterprisewide approach to cloud, speeding iterative cycles to increase cloud adoption and value. Build on current strengths in IT efficiency and agility to explore the role of an extended cloud-based architecture in supporting new ways of doing business. Require compliance with industry standards for cloud interoperability, workload portability, performance monitoring, and data management, as well as influence developing cloud standards. Ensure that users can dynamically access internal and external resources via a common self-service portal and service catalog. Communicate the business value of cloud, providing performance and speed metrics that reduce costs and increase agility and productivity. Exploit the increasing technical capabilities of the market and/or the value chain (because of cloud). Identify the relationship between risk and reward in cloud investments, and explore new ways to manage risk, including risk sharing. Optimized: Driving business innovation through seamless access to IT resources; making informed decisions based on true cost and value with internal and external partners. Stage 5 is not a resting state. Excellence requires incorporating key and emerging technologies, so continue to allocate funds for continued innovation. Foster a mature business/it governance process to continually review and update internal configuration and service standards, comply with industry standards, and continue to review opportunities to take greater advantage of hybrid cloud architectures. Use cloud to create opportunities for revenue, and integrate business and technology capabilities for innovation, using IT as a launching point for new products and services. Foster IT's collaborative role with business and provide guidance on how to increase business value through technology. Source: IDC, IDC Health Insights #HI

22 LEARN MORE Related Research Best Practices: High-Level Infrastructure Achievements Drive EHR Success at Mercy Health System (IDC Health Insights #HI244935, December 2013) Cloud Business Transformation in Healthcare (IDC Health Insights #HI244851, December 2013) U.S. Healthcare Provider IT 2014 Top 10 Predictions: IT Priorities for the Post-EHR Era (IDC Health Insights #HI244741, December 2013) Technology Selection: The Cloud in Healthcare Provider (IDC Health Insights #HI243491, September 2013) Cloud-Based Business Transformation: Industry Case Studies (IDC #243275, September 2013) A Path to the Cloud for Epic Hospitals: VMware Horizon View Announces Target Platform Status for Epic (IDC #lcus , May 2013) Business Strategy: Accountable Care MaturityScape (IDC Health Insights #HI240916, May 2013) IDC MaturityScape: Cloud A Guide to Success (IDC #239772, March 2013) IDC's Worldwide IT Cloud Services Taxonomy, 2012 (IDC #233396, March 2012) Synopsis This IDC Health Insights report discusses IDC's Cloud MaturityScape for healthcare provider organizations that are interested in understanding how they can take the necessary actions to move forward successfully with cloud computing. Healthcare providers have unique constraints as well as compelling business needs that make cloud attractive. This healthcare provider maturity model is updated to include results from IDC's 2013 CloudTrack Survey, which shows that over 50% of healthcare organizations indicate that they will be piloting, using, or otherwise managing some form of cloud public, private, or hybrid as a part of their IT infrastructure in the next 24 months. IDC's Cloud MaturityScape is for healthcare organizations that are interested in understanding how they can take the necessary actions to move forward successfully with cloud computing or to improve the results from existing cloud projects. According to IDC research director Judy Hanover, "The use of cloud computing as an increasingly business-critical technology is quickly changing how healthcare providers evaluate, procure, and deploy IT assets. Healthcare provider IT departments will need to operate in an environment that is centralized and focused on service delivery and more predictable expenditures as they face the challenges of healthcare reform." 2014 IDC Health Insights #HI

23 About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA USA idc-insights-community.com Copyright Notice Copyright 2014 IDC Health Insights. Reproduction without written permission is completely forbidden. External Publication of IDC Health Insights Information and Data: Any IDC Health Insights information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Health Insights Vice President. A draft of the proposed document should accompany any such request. IDC Health Insights reserves the right to deny approval of external usage for any reason.