I N D U S T R Y B R I E F

Transcription

1 I N D U S T R Y B R I E F Information Management and Data c enter Availability for Healthcare September 2015 Sponsored by Veritas This IDC Health Insights Industry Brief examines the proliferation of data in healthcare, the pursuit of extracting value, and the impacts of data profileration on IT. The paper is based on briefings with Veritas as well as IT and 3 rd Platform research from IDC Health Insights. The objective of this Industry Brief is to inform healthcare organizations about the challenges of datacenter availability, as well as managing and extracting value from ever increasing data in the healthcare realm, and offer guidance regarding best practices for both areas. Introduction: Information is the Connective Tissue Information and communications technology (ICT) enables healthcare providers to create, acquire, and store an exceptional amount of data in the course of business operations. Nevertheless, because of their siloed organizational structure, healthcare providers are sometimes unable to fully exploit the potential of these pieces of data and turn it into valuable information, especially when the context is different from that in which it was originally created. Collecting and managing the data is not enough, it needs to be turned into actionable information for the creation of clinical protocols and improved outcomes. In addition, this information, once generated, must be available at the right time and to the right healthcare practitioners. IDC forecasts that the total amount of digital data generated annually will reach 44 zetabytes by While some of this data is structured, the majority of it is not. Healthcare systems produce a vast amount of imaging and other types of unstructured data every day at an ever-increasing pace. All types of healthcare data must be stored, organized, and archived for long periods, creating a significant burden for providers. Providers struggle to maximize the value of the broad range and volume of data they produce, and determine what's important and necessary to retain. Healthcare organizations are now starting to use analytics to combine the various data types within the organization to extract insights for improved healthcare outcomes, clinical and operational performance at both the individual and population level. The American Recovery and Reinvestment Act of 2009 (ARRA) and its meaningful use requirements oblige healthcare organizations to collect data electronically and share this information to enable population health management, care collaboration and coordination, and care transitions. Healthcare organizations will have to balance sharing health information to meet these new requirements with maintaining patient privacy and data security. Healthcare systems are trying to transform their service delivery models by adopting an integrated care delivery approach under new fee-for-value initiatives, and information is the connective tissue of this new environment. While Stage 1 meaningful use requirements led to significant financial incentives for providers, as meaningful use requirement progress, late-stage requirements are more challenging for providers to achieve, and financial incentives are smaller, amidst even more pressing IT and security priorities. Healthcare organizations are increasingly recognizing the value of their data, both for improving their own operations and as targets for healthcare and financial identity thieves. By 2018, IDC expects IDC 1987

2 42% of the world's healthcare data that needs protection will be unprotected as the use of data and analytics proliferates and more stakeholders are involved in delivery of care. Today's healthcare organizations are at greater risk of a cyberattack than ever before, in part because electronic health information is more widely available than in the nearly 20 years since the Health Insurance Portability and Accountability Act (HIPAA) was passed in % of healthcare organizations will experience multiple intrusive cyberattacks in 2015, requiring healthcare organizations to invest in a multipronged security strategy. This Industry Brief is intended to inform healthcare organizations about the challenges managing and extracting value from ever increasing data in the healthcare realm, as they develop a sound strategy and plan for IT capabilities to manage risk. Situation Overview Value in Healthcare Big Data One important key to a truly integrated care paradigm is data management. The proliferation of healthcare IT across the enterprise creates both an opportunity and the challenge to harness the power of big data for improving data-driven decision making. Big data and analytics (BDA) technologies can be strategically instrumental to the achievement of integrated care objectives, helping combine data from various sources to extract insights for improved healthcare outcomes on both the individual and population level. Healthcare organizations are challenged to find the important data to analyse, while strategically moving away from the keep everything that is unsustainable. The hospital of the future is a data-driven digital hospital. Combined with advances in clinical process management and enterprise resource planning technologies, 3rd platform technologies (cloud, mobile, social, and BDA) will accelerate the application of advanced management practices to hospital operations. BDA, in particular, will be at the core of new digital hospital strategies, leveraging all data produced within and outside the hospital, with real time, or near real time high performance analytics to assist in decision-making. Key to success will be in managing this data holistically, to blend and reconcile data from on-premise non-cloud and private cloud sources and public cloud sources. Among healthcare IT service providers, "analytics" remains perhaps the hottest area of investment, as many technology suppliers are recognizing the value of new data sources. But the definitions of "analytics" remain diffuse, and investment in healthcare analytics is spread widely across many related fields. These include payer BI analytics and provider clinical and financial analytics, as well as specialty clinical and departmental analytics investment areas within the organization. Vendors are adding analytics to look at unstructured clinical data from the electronic health record; while socioeconomic data is being added from outside the organization to better understand the barriers and determinants of access to care. The strategic value of analytics makes governing the data streaming into analytics systems, ensuring the data's proper use and protection, security and lifecycle management, a critical part of information governance. An Increasing Role for Information Governance Information governance is playing an increasingly critical role in managing a complex regulatory environment, helping healthcare organizations to balance security with convenience and ease of access to mission-critical information, and offering visibility into the information resources of the organization. The key data governance requirements needed to manage the existing and growing IDC

3 heterogeneity of data, and to ensure accurate and reliable information governance, as applied to analytics operations in the health system include: Master Data Management tools to establish an authoritative patient record, resolve duplicates and establish data relationships. Solutions should support clinical and claims data, structured and unstructured data, medical device data, as well as integrate social media and mobile data sets. A configurable solution will enable the provider organization to establish a framework to identify and link consumer, family and related data. Data Quality Tools to automatically and proactively identify and resolve data quality issues using a rules-based configurable solution. Workflow integration enables automated engagement of data quality business owners within the enterprise. Datacenter Management and Availability in an Information Explosion The synergy of cloud, mobile, analytics/big data and social technologies that IDC refers to as the 3rd platform has fundamentally changed the nature of how organizations purchase and use technology. In healthcare organizations, cloud technology adoption is becoming more common, migrating datacenter management from the healthcare organization to the cloud service provider. The major opportunities for cloud come from the development of intelligent industry solutions, which are built on top of a new platform that includes cloud as well as big data and analytics, mobile, and social. Within healthcare providers, for example, this includes process-oriented solutions like patient safety, computerized physician order entry (CPOE), clinical documentation, and clinical decision support. Software as a service, platform as a service, and infrastructure as a service are attractive means of deploying IT solutions in provider organizations because they reduce up front IT costs while accelerating speed to value for the healthcare organization. Provider CIOs are beginning to understand the nuances of cloud, as they compare managed hosting to cloud-native SaaS offerings with an eye on value. Today, most healthcare organizations choose private cloud deployments due to the perceived security advantages and increased control over data and cloud operations, particularly when workloads involve data that includes protected health information (PHI). Healthcare data, whether it is imaging or other types of structured or unstructured data, makes up a significant storage burden for providers. Healthcare organizations are increasingly moving from proprietary storage systems associated with data capture technologies that are siloed within the hospital's departments, to enterprise approaches that centralize storage and allow the application of management policies. Enterprise approaches to managing content allow providers to leverage techniques like scalable, tiered storage systems, to take advantage of efficiencies by sourcing commodity hardware and resources from the cloud when needed, to reduce duplication in data archives, to virtualize, and to manage archiving and eventually disposal of content when it is no longer needed and organizational policies and regulatory requirements allow. To access these storage efficiencies, providers typically aggregate content in application-independent data stores that can also be leveraged in backup and disaster recovery plans and even in application retirement scenarios when organizations re-platform and need to preserve data. The number of high-profile breaches affecting millions of consumers has highlighted the increasing recognition that healthcare data is more valuable on the black market than consumers' financial data. Today's healthcare organizations are at greater risk of a cyberattack than ever before, in part because electronic health information is more widely available today than in the nearly 20 years since the Health Insurance Portability and Accountability Act (HIPAA) was passed in The increasing reliance on EHRs for care delivery has made Disaster Recovery (DR) and Business Continuity (BC) strategies for the applications, infrastructure and data in the health system more important. The approach to providing a reliable DR/BC strategy needs to be as simplistic, automated, & predictable as possible. The more complexity that is driven out of the DR/BC strategy by using technology that 2013 IDC 3

4 supports the heterogeneity of the typical healthcare organization the greater chance of success. Incorporating automation verses relying on manual and sometimes scripted processes give the ability of proper orchestration to the strategy. Predicting the outcome of the DR/BC strategy before an event is available if testing of the strategy is possible. Most organizations fail because they don t test. Technology that allows for non-disruptive testing is essential to a successful strategy. Healthcare organizations have historically invested a smaller percentage of revenue on IT typically 3% or less than other industries such as financial services or retail. With competing priorities such as qualifying for meaningful use of EHR incentives, installing new systems to make the transition from fee for service to fee for value, healthcare organizations find themselves in a role of having to play catch up and are thus increasing spending on IT security and cyberthreats. In a recent IDC CloudTrack Survey, over 65% of decision makers in healthcare agreed that they felt cloud service providers could offer better security than their own organization's IT security team can provide on-premise. Cloud services and mobility can help to support DR/BC efforts by making data and applications ubiquitous and more easily accessed in the event of an event. As cloud adoption continues, security and regulatory compliance concerns will push cloud service providers to embed security, privacy, and compliance into the services offered to healthcare providers. Essential Guidance IDC recommends that healthcare organizations consider the following as they develop their strategy for advancing their management of information: Seek 3rd Platform offerings when getting started. Understand the nuances of cloud, as you compare managed hosting to cloud-native SaaS offerings with an eye on value. Within the 3rd Platform conversation, key attributes include interoperability, open APIs that facilitate integration in the cloud, real-time analytics, security, SLAs, and the underlying application-independent clinical repositories that fuel these offerings in a platform-as-a-service environment. Invest in 3rd Platform technologies to enable agile, mobile-first, and cloud-first strategies. Cloud deployment addresses both the cost of technology and the relative ease of sharing critical data across the healthcare ecosystem that cloud provides. Healthcare has had low priority to adopt cloud technology and for the most part limited cloud to administrative tasks such as . To facilitate transformation, healthcare organizations will need to deploy clinical workflow and data to the cloud. Add visibility and control. Organizations should have processes in place to identify PHI and other critical data and control this information in a secure manner. Tools like automated file classification tools, enterprise information archiving and search and retrieval products can help healthcare organizations to better understand and leverage data in decision-making. Extracting value The data tsunami is here and healthcare organizations must begin to develop plans on how the new data (unstructured, social media, socioeconomic, and other data) can be used and what questions can be answered. Forward-thinking healthcare organizations are hiring data scientists and informaticists to properly analyze data from these new sources. It is important to analyze the correct data, and not try to keep everything forever. Recognize the value of untapped data assets in supporting fact-based decisions of management, healthcare staff, patients, and caregivers IDC

5 Consider how new analytics data stores and tools will fit into and integrate with applications and the existing environment. Look at software, services, partnerships, cloud on- and off-premise options to determine what analytics solutions best meet business needs Identify opportunities to use existing data, technology, and analytics in new ways. While investing in clinical information systems, opt for standards-based solutions and implement them for future reusability in an analytics environment. The success of analytics will depend on the harmonization of workflows and information life-cycle management to reduce variation in data quality as well as the adoption of open standards-based data model that enables data liquidity, accessibility and security. Proliferation of data Create a single source of the truth. Healthcare organizations' greatest asset is the data that is available; they are however situated in silos across the organization and particularly at the enterprise level. The level of effort to normalize data is significant, but vendors of niche healthcare analytics applications are gaining experience in that process. To improve quality and manage costs, access to data is critical. It is also critical that data be governed to ensure appropriate use, security and access to the data. So often time is spent reconciling different data sources that there is no time left to perform the actual analytics. Enterprises will be faced with increasingly complex challenges in attempting to blend and reconcile data from on-premise sources with private and public cloud repositories (including SaaS), in traditional data stores as well as Hadoop and NoSQL. Keys to success will be in managing this data holistically rather than piecemeal. To do this, a unified set of tools governed by common metadata that includes the ability to define, identify, and reconcile data based on a common business glossary will be key. The technologies for such a unified set of tools that require special attention include the following: Dynamic data movement for near-real-time data synchronization Composite data frameworks for universal data access General data quality software for ensuring data consistency and integrity Master data definition and control for ensuring the integrity of master reference data The metadata management component of data access infrastructure software for coordination and reconciliation of data across sources Cloud Cloud adoption among U.S. healthcare providers is widespread and growing, with private cloud as the dominant model. As providers look to move new workloads into the cloud to respond quickly to changing business and regulatory requirements, they should consider the following recommendations: Look for cloud providers with healthcare offerings, plus industry experience and expertise, when sourcing cloud services for provider operations. These cloud service providers will be more likely to understand the constraints associated with handling HIPAA-protected data and with the unique demands of securing vertical applications. Look for cloud providers that offer consulting, training, and implementations services to facilitate the transition to the cloud. While external service providers can be helpful when getting started with cloud and supporting ongoing operations, the on-premise IT staff also 2013 IDC 5

6 needs to understand and develop skills to support and troubleshoot cloud environments. A strong in-house cloud skill set will allow provider organizations options when making the decision to outsourcing or keep clouds on-premise and allow for flexibility to change cloud service providers or bring operations in-house if desired. Continue experimentation and develop best practices related to cloud computing. Each provider IT organization will need to experiment to determine the cloud practices that are best suited to the needs of its staff and end users. Security Manage security risk, but don't rule cloud out. As with on-premise deployments, security issues need to be managed carefully, but should not be a deterrent to cloud strategies. Cloud service providers familiar with healthcare will understand the risks and penalties associated with HIPAA breaches, but cloud service providers with less experience in the vertical may require education. It is important that both customer and supplier have a full understanding of the breach risk and economics before entering into a relationship. Ask for financial indemnification for costs associated with breaches such as regulatory penalties, fines, and required actions, as well as follow-on legal actions by victims. Merge big data into security and governance policies. Most BDA solutions deployed will incorporate multistructured data from multiple sources and deliver sensitive information to an extended ecosystem of organizations and end users, creating security issues and ethical questions about the use of BDA. Dedicate a significant portion of the data management budget to information management, security, and privacy protection. Leverage lessons learned from other industries. While it may sound trite, healthcare executives and IT professionals should look to other industries, such as financial services and retail, that have long been the target of cybercriminals for lessons learned and best practices. Understand where your critical data and PHI lives, regardless of whether it is on-premise or in the cloud. This is a critical component of security understanding your data inventory. Use technology and judgement to determine if the data is acceptable to put in the cloud IDC

7 A B O U T T H I S P U B L I C A T I ON This publication was produced by IDC Health Insights Custom Solutions. The opinion, analysis, and research results presented herein are drawn from more detailed research and analysis independently conducted and published by IDC Health Insights, unless specific vendor sponsorship is noted. IDC Health Insights Custom Solutions makes IDC Health Insights content available in a wide range of formats for distribution by various companies. A license to distribute IDC Health Insights content does not imply endorsement of or opinion about the licensee. C O P Y R I G H T A N D R E S T R I CTI O N S Any IDC Health Insights information or reference to IDC Health Insights that is to be used in advertising, press releases, or promotional materials requires prior written approval from IDC Health Insights. For permission requests contact the Custom Solutions information line at Translation and/or localization of this document require an additional license from IDC Health Insights. For more information on IDC Health Insights, an IDC company visit For more information on IDC visit or for more information on Custom Solutions visit Global Headquarters: 5 Speen Street Framingham, MA USA P F idc-hi.com 2013 IDC 7