The Healthcare Cloud:

Transcription

1 The Healthcare Cloud: Building a Blueprint for Success With cloud computing offering many advantages over more traditional computing paradigms, businesses across industries are embracing this emerging model. Indeed, the cloud will account for the bulk of new IT spend by 2016, according to a study from Gartner Inc., a Stamford, Conn.-based IT research firm. Cloud models in which third parties host applications, storage and access to computing power via the web provide economies of scale, often giving two to 10 times the cost advantages of computing models that would otherwise require healthcare providers to host servers onsite or hire in-house technical support to maintain systems. Despite cloud computing s acceptance, the healthcare industry often marches to the beat of its own drummer. As such, through a survey of 150 healthcare IT professionals, HIMSS Analytics set out to determine just what impact the cloud is having on IT implementations at healthcare organizations. The executive-level respondents, who work at stand-alone hospitals (55 percent), hospitals that are part of larger delivery systems (22 percent), corporate offices of healthcare systems (15 percent), medical practices (5 percent) and other miscellaneous Produced in partnership with Featuring industry research by

2 environments (3 percent), shared their observations on their cloud technology use, as well as their opinions on how the healthcare industry overall is leveraging the cloud. Healthcare embraces the cloud 2 The fact that cloud services are available and cost effective has allowed many healthcare organizations to leverage electronic health records systems, whereas they might not have been able to because of the costs and the skills necessary for an in-house implementation. Rick Bryant National Healthcare Practice Manager Symantec Industry pundits often describe healthcare as a laggard in IT adoption when compared to other industries, especially pioneer sectors such as banking, airlines and retail. The HIMSS Analytics study, however, found that healthcare organizations are embracing the cloud. Indeed, 83 percent of respondents said that their organizations are currently using cloud solutions and 9 percent plan to do so in the future (Figure 1). Just 6 percent are not using cloud solutions and 2 percent don t know if they will migrate to the cloud. There s been a lot of discussion about how the healthcare industry is slow to adoption with many information technologies, said Rick Bryant, National Healthcare Practice Manager at Symantec, a Mountain View, Calif.-based provider of security solutions for digital information. But more than eight in 10 healthcare organizations are already leveraging the cloud. With the push to adopt electronic health records, the need to exchange data and the call to engage patients, the cloud looks like a perfect antidote to some of the industry s computing challenges. The inherent advantages of the cloud seem to be outweighing security and other concerns, as 67 percent of respondents indicated that their organizations are already utilizing the cloud for software as a service (SaaS) applications. The fact that cloud services are available and cost effective has allowed many healthcare organizations to leverage electronic health records systems, whereas they might not have been able to because of the costs and the skills necessary for an in-house implementation, Bryant said. 9% 6% 2% 83% Currently use cloud solutions Plan to use cloud solutions No use of cloud solutions Don t know N=150 How is your organization using cloud services now?

3 Case in point: Adventist Health System has been leveraging a cloud-based EHR system from Cerner for about eight years, according to Sharon Finney, Corporate Data Security Officer at the 46-hospital system headquartered in Altamonte Springs, Fla. Moving to the cloud emerged as the most practical means to manage the health system s complicated computing needs in the electronic record keeping era. We moved to the cloud because we didn t have the skills sets to host and maintain an EHR on site. We had to ask ourselves what business we wanted to be in. Did we want to host an EHR or dedicate our resources to providing clinical care to the community? Sharon Finney Corporate Data Security Officer Adventist Health System Our primary business is to treat patients in hospitals and in physician practices. That is the service we provide to our community, Finney said. Maintaining an EHR system is not our core competency. We moved to the cloud because we didn t have the skills sets to host and maintain an EHR on site. We had to ask ourselves what business we wanted to be in. Did we want to host an EHR or dedicate our resources to providing clinical care to the community? Citing cost concerns Focusing on core competencies is just one of many cloud benefits. In fact, cloud computing offers a plethora of potential bottom-line advantages, according to respondents. Fifty-six percent of respondents identified less cost than current environment as a top consideration for adopting a cloud solution, while 53 percent cited speed of deployment (Figure 2). The ability to move forward with computing projects despite the lack of internal staff/expertise was noted by 52 percent of respondents. When you put technology on premise, it might cost you $40,000 in capital. If you leverage infrastructure as a service, it costs you $400 a month, but if you utilize software as a service, it can cost you as little as $40 a month. Those are the orders of magnitude we re seeing as healthcare organizations leverage software as a service in cloud environments, Bryant said. But, perhaps just as important, is the need for agility. Organizations can easily ramp up their computing resources and spin up additional capacity, adding additional services in rapid fashion. 3 The bottom line is a pressing concern when leaders at Mary Washington Hospital consider additions to its computing portfolio, according to David Bailey, HIPAA Security Officer at the two-hospital system in Fredericksburg, Va. We look at how large the technology footprint is. And, we ask a lot of questions: What is the cost model? Is it a subscription-based model? Do we have to buy licenses? Do we have to stand up servers and infrastructure? All of these things are part of our decision-making process, Bailey said. After asking such questions, Mary Washington leaders opted to implement Symantec Validation and ID Protection Service, a cloud-based authentication service that enables enterprises to secure access to networks and applications while preventing access by malicious unauthorized attackers. The unified

4 Less cost than current environment Speed of deployment Lack of internal staff/expertise More robust disaster recovery Need for on-demand, scalable solution Regulatory compliance 56% 53% 52% 50% 45% 42% Better information security Mobility of workforce 27% 27% N=124 What was your organization s reason for adopting a cloud solution? solution provides both two-factor and risk-based token-less authentication. Instead of having to manage a token, users simply access an app that sits on a smartphone, making it easier to integrate the authentication into their workflow. 4 While the cloud application provides a user-friendly, cost-effective solution, the greatest advantage was the ease of implementation. It took a few hours to get integrated into our network, Bailey noted. If we had to build out the authentication service ourselves, we would have to build servers and install software. Glancing into the crystal ball But, perhaps just as important, is the need for agility. Organizations can easily ramp up their computing resources and spin up additional capacity, adding additional services in rapid fashion. Rick Bryant Symantec Even though many healthcare organizations are currently utilizing the cloud for SaaS applications, additional utilization looms in the future, as technology is becoming more central to providers missions. For example, hosting back-up and recovery is the top planned future use of the cloud (47 percent), followed by hosting archived data (35 percent) and hosting back-office applications (35 percent), according to respondents (Figure 3). Previously, healthcare leaders would think if my facilities are down, why do I need to access my electronic medical record system? If I can t see patients, I don t need the EHR, Bryant said. But that has all changed as more organizations are better understanding the true intent of EHRs. Leaders are recognizing that, even when their main facility is not operational, they still need to access records at outlying facilities. They also have a fiduciary responsibility to be able to provide that information to the transferring hospitals so that people can still get quality care with the diagnosis and the medical history in the electronic medical record. The patients have a right to access that information.

5 Adventist s need to access records in the event of a disaster played a big role in its decision to host the EHR in the cloud. Many Adventist hospitals have achieved Stage 7 on the HIMSS EMR Adoption Model, the highest designation on the scale, which measures the maturity of a healthcare organization s electronic records implementations. As such, virtually all patient data is electronic in these facilities. We look at how large the technology footprint is. And, we ask a lot of questions: What is the cost model? Is it a subscription-based model? Do we have to buy licenses? Do we have to stand up servers and infrastructure? All of these things are part of our decisionmaking process. David Bailey HIPAA Security Officer Mary Washington Hospital Hosting of archived data 40% Hosting operational applications 31% Backups and disaster recovery 31% Health information exchange 23% Hosting of back-office applications 22% Hosting of communications services 21% Hosting of financial applications 20% Managed services 19% Hosting of HR applications 18% Desktop virtualization 16% N=124 In what areas do you anticipate using cloud services moving forward?** Top 10 We have all this electronic information and we know that many of these hospitals are in Florida, where there is always the threat of hurricanes. So, we need to make sure the data is stored somewhere offsite where we can access it in care of an emergency, Finney said, who added that having a cloud partner makes it much easier to maintain a full-blown business continuity plan. Thinking it through Even though providers are migrating to the cloud at a quick clip, leaders are not jumping in without preparing for the potential challenges associated with cloud computing. For example, leaders are realizing that the IT network itself becomes more important when moving to the cloud. Indeed, nearly half of respondents upgraded their networks in anticipation of implementing cloud services. 5 Since you are no longer hosting services onsite, you must rely on Internet connectivity. You need a lot of resiliency around network access because if the network goes down, the services go down. The network access has to be scalable and perform acceptably, Bryant said. Making sure that data stored in the cloud complies with HIPAA requirements is another concern. While Omnibus rules introduced in 2013 placed liability for protected health information on cloud vendors, healthcare organizations

6 still need to keep a watchful eye on protected data. If we have a system that has patient data in it, we would definitely go through an evaluation of where the data would be and the security around it before we entered into an agreement, Bailey said. If data is in the cloud that means it is not on premise. And if the data Adventist s need to access records in the event of a DISASTER played a BIG ROLE in its decision to host the EHR in the cloud. is not on premise, behind our firewall, under our control, then we do have to understand how a cloud technology company is storing and securing the data. Selecting the right provider also is important. Respondents cited the following factors as top considerations when selecting a cloud company: Willingness to enter into a business associate agreement (65 percent); physical security of cloud service provider (64 percent); technical security of cloud service provider (64 percent); compliance with laws and regulations (60 percent) and customer service (60 percent) (Figure 4). To deal with such concerns, a service provider needs to have an intimate understanding of healthcare. It s much different than working at a federal agency or much different than working with finance. You need to understand the specific industry challenges to be able to come into a health system and install, operate and maintain technology, Bailey said. We chose a cloud provider that truly understands what it means to go into a hospital and implement technology. If your account rep also works for banks or works for the federal government, they might not understand the intricacies of healthcare because the industry operates so differently than others. 6 The HIMSS Analytics survey results reveal that healthcare organizations such as Mary Washington and Adventist are not alone in their willingness to adopt the cloud and in their proclivity to exercise caution. Indeed, healthcare organizations seem to be embracing the cloud in a big way and appear to be willing to expand their utilization of the cloud in the future. These organizations, however, are not moving forward without carefully considering the road ahead and how they will overcome the many challenges that are specific to the healthcare industry, which is a best practice other healthcare organizations should incorporate as they make plans to adopt cloud computing. About Symantec: Symantec understands the unique needs of the healthcare market and is working with providers, industry organizations, and technology partners to find the best possible solution to meet their IT challenges. Symantec s healthcare solutions provide security, data loss prevention, HIPAA compliance automation, business continuity, storage and infrastructure management designed to assist healthcare organizations protect their business critical systems and protected health information (PHI). Produced by