Electronic Medical Record infrastructure readiness

Transcription

1 healthcare Electronic Medical Record infrastructure readiness An extended outage of an EMR system has far-reaching implications for patient care and safety as well as operations. An often-overlooked aspect to implementing an Electronic Medical Record (EMR) system is the need for a solid, medical-grade technical infrastructure, and operational readiness. An extended outage of an EMR system has far-reaching implications for patient care and safety as well as operations. For example, in 2009 a system failure shut down the Veterans Affairs North Texas Healthcare System clinical records system for 23 hours at two hospitals and eight outpatient clinics in the Dallas area. For six hours, clinicians had no access to patient records while technicians activated a read-only backup system, and users still had to document interactions on paper until the full system came back online. The failure was due to two aging drives failing within 1.5 minutes of each other and poor maintenance, according to a report from the VA soffice of Inspector General. i

2 Alarmingly, most healthcare organizations do not have a technical infrastructure that s prepared to adequately handle the needs of an EMR system. The typical state of infrastructure includes spotty wireless coverage, poorly maintained servers, inadequate bandwidth, insufficient space and environmental controls in the data center, insufficient security and redundancy, and poor operational management. Unfortunately, many organizations face significant cost to upgrade their technical infrastructure, which results in some healthcare organizations attempting to implement the EMR system while maintaining the inadequate infrastructure. This can only lead to significant issues and failures. Any healthcare organization planning for the implementation of an EMR system should consider the following questions: Is the IT environment ready for an EMR implementation? Does the organization have a plan for identifying the gaps in of its IT infrastructure? Can the data network provide secure mobile access? Can the organization adhere to regulatory compliance mandates such as the Health Insurance Portability and Accountability Act (HIPAA)? The challenges for a health care Chief Information Officer (CIO) or Chief Technology Officer (CTO) are many: providing a 24/7, high-availability network; accommodating fluctuating workloads and wireless devices; supporting the Technology readiness Authentication / authorization Medical grade network Security infrastructure Back-up/recovery Technology standards Business intelligence Service desk tools & process Monitoring Certificate management HIPAA Security Rule mandates for the administrative, physical and technical security of an EMR; and meeting other technology and operational requirements specific to health care. So where does one start in designing such an infrastructure? Below is a list of some technology and operational resources that an organization should be assessing as part of their EMR implementation readiness with some recommended mitigation activities. Operational readiness Incident management Problem management Configuration management Asset management Change management Capacity management Release management Disaster recovery Business continuity Lifecycle management Alarmingly, most healthcare organizations do not have a technical infrastructure that s prepared to adequately handle the needs of an EMR system

3 Bring your own device (BYOD) The dual concepts of BYOD and anywhere/ anytime access to information require organizations to identify secure ways of supporting the mobile workflow of physicians, nurses, and clinicians. Organizations struggle with maintaining compliance with privacy and information regulations without inhibiting mobility or productivity. Recommendations: Desktop virtualization allows hospitals to meet HIPAA security and compliance requirements by ensuring patient information stays within the confines of the data center. Users log onto the laptop, PC or other device to access the data in a virtual instance. The data itself is never stored or transferred to the local device, so the integrity and security of the data is preserved back in the data center. In the case of loss or theft of an individual device, no data is compromised. Virtualization technology also makes security administration easier and more effective. All software updates and patches are managed centrally, and employees have no way of downloading dubious programs or malware from the Web. Keep in mind that virtualized desktops put a heavy demand on computing, storage, and network resources, so performance monitoring must be ongoing to maintain acceptable service levels. Device messaging Many nurses, clinicians, and physicians continue to use text messaging to communicate electronic patient health information (ephi) between peers and/or with their patients, even though it s not a secure method of communication and is against HIPAA regulations. Text messages are typically stored on a smart phone computer or on the SIM card. IT administrators need to be concerned with such devices being lost or stolen and unauthorized users obtaining access to ephi. Recommendations: Organizations should provide physicians and staff with a device messaging solution that is compliant with federal health privacy rules via an application for secure mobile-originated text messages. These solutions encrypt text messages when they go from device to device. The use of strong authentication to identify a user accessing confidential data is recommended. User authentication and access control As part of HIPAA compliance, healthcare organizations are responsible for controlling the flow of patient data and tracking who s accessing their clinical applications. User authentication and information access control are critical components to HIPAA data security compliance. Both require the implementation of procedures to verify that a person or entity seeking access to ephi is the one claimed and has the credentials required to access patient information. ii Access control has become more challenging with the introduction of an EMR system, as ephi gets downloaded onto desktops, tablets, ipads, phones, USB storage, peripheral storage, and enterprise storage systems and other devices, or transported via or web applications. Any access control solution selected must cover a wide range of scenarios to determine where and how data is being transmitted, used, and stored. Recommendations: The use of strong authentication to identify a user accessing confidential data is recommended. Strong authentication, also called two factor authentication, is defined as two out of the following three proofs of identity: a password, a security token (can be a software token or a physical device) and something unique about a user such as a fingerprint. Using strong authentication provides more protection for sensitive information than a simple username and password can provide. Organizations can implement access control through the use of Lightweight Directory Access Protocol (LDAP) role-based authentication. LDAP directories provide two features needed to authenticate a user of an application. The first feature is single sign-on, which allows a user to sign on once and have all his credentials passed through to other applications for authentication. This eliminates the need to sign in to each application individually. The second feature is role definition. Within the LDAP directory, roles can be defined according to one s job competency, authority, and responsibility, thereby limiting the information that certain users see when they log into an EMR application. Many EMR applications offer their own proprietary authentication tables or password files, but one should check to ensure that they are robust enough to meet HIPAA standards. Many are limited to basic functions, such as being allowed or denied access to the application. Large organizations should consider data loss prevention (DLP) software which provides data leakage prevention for ephi in a file, , packet, or storage device, while at rest, in use or in transit. It does this by monitoring and preventing data leaks, encrypting content, moving material to a secured device and blocking unsecured transmissions. Wireless coverage As the organization moves forward with their EMR planning, it s critical to ensure the infrastructure is able to support any future wireless requirements. EMRs rely upon consistent wireless network connectivity to bring the EMR to the point of care. However, most wireless infrastructures are full of problems, including insufficient coverage for saturation of users; low coverage areas in stairwells, elevators, and cafeterias; and inappropriate mixes of protocols, which impacts performance. Recommendation: Complete a full wireless survey of the facility, covering every location and implement the survey recommendations. If the organization has plans to implement or expand real time location services (RTLS) in the future, it is recommended that the wireless assessment be expanded to include the needs of RTLS.

4 Bandwidth Bandwidth denotes the volume of data that can be transferred per unit of time. Technologies such as picture archiving and communication systems, biomedical devices, voice over Internet protocol, real time location systems, unified communications, video and Internet usage, mobile devices and additional applications that use the infrastructure all impact the facility s bandwidth. The available bandwidth needs to support the amount of data being transferred or the end user will experience a delay, which could prevent appropriate care being provided to the patient in a timely manner. Recommendations: Determine what bandwidth requirements are needed, and what standards need to be applied to the facility so that the EMR system is sufficiently supported. Work with your vendor to model the required network bandwidth and then increase it (some would recommend doubling it). Consider upgrading the data network core so you have a scalable, high performance infrastructure to account for growth for end user mobility and emerging technologies in the next few years. Determine how much bandwidth is needed at the desktop for the wired infrastructure. For most applications today, CAT 5e wiring works well; however CAT 6 wiring should be considered for future applications. Provide a secure, dual-channel wireless network that will give physicians and employees secure wireless LAN connections while dedicating a certain amount of bandwidth for patients or guests who want to log on while they re in the facility. It is also important to provide a service loop in the cabling that serves a wireless access point (WAP). That way, if the WAPs need to be moved to fill coverage, there is extra cable length to accommodate the move. Server virtualization Virtualization allows you to consolidate multiple virtual storage resources into one physical server. Consolidating servers reduces the total number of physical servers the organization needs, which in turn reduces physical space demands and energy consumption and increases IT capacity. Any access control solution selected must cover a wide range of scenarios to determine where and how data is being transmitted, used, and stored. The host server allocates resources based on business rules and demand, protecting against hardware failures and leading to improved disaster recovery. Other benefits include improved application performance, streamlined management, and more consistent security controls. There are several clinical systems that cannot be virtualized: picture archiving and communication systems most cardiac-angioplasty procedure systems fetal monitoring systems can be run on standard PCs and laptops but vendors are not encouraging virtualization, perhaps due to liability issues 3-D imaging systems, as they are vendormanaged and should not be virtualized applications that have a lot of SQL queries or are at 70% utilization lastly, the U.S. Food and Drug Administration requires some applications to be on a specific, physical hardware platform Recommendations: Proper planning is the key to successfully implementing a virtual server environment. Complications can arise if the IT infrastructure doesn t have enough memory, CPU or other resources to support server virtualization technology. iii While both physical and virtual servers require ongoing monitoring and calibration, provisioning and configuring a virtual server can be more difficult because virtual servers have more dynamic characteristics and more complex interactions than physical servers do. Experts caution that healthcare organizations may have limited expertise in setting up a virtual server environment and may want to bring in an experienced company to assist with this effort. iv Growth in storage demands A survey undertaken by Forrester Consulting indicates that EMRs and diagnostic imaging systems are the primary sources of growth in storage demand. Beyond images, healthcare organizations also require the capacity to store and quickly access lab results, patient vitals, orders, notes, and medication data. In addition, patient information that is rarely accessed will require archival storage that is secure, scalable and affordable. v Recommendations: Hospitals are increasing their use of storage area networks (SAN). A SAN is comprised of storage devices connected over a high speed optical network used to move data among the various storage devices. Data can be stored and accessed quickly, and because the servers and storage devices all have redundant connections, data remains available during a server failure. Storage represents a significant portion of IT spending, and this trend will continue, so it s wise to utilize an appropriate mix of high and low performance storage. Forrester recommends that a good best practice baseline is around 20% highperformance Tier 1, 40% mid-performance Tier 2, and 40% low-performance Tier 3 or archival storage, but this can vary significantly based on the workloads being served.vi The Forrester report also states that media mix decisions start with an understanding of the requirements of the workloads in performance terms. This understanding can come from reporting and analytics tools that identify bottlenecks or over-configuration in terms of performance.

5 Power source An EMR system is dependent on the 24/7 operation of servers and both wired and wireless network infrastructure, even when utility power fails. Recommendations: Power to all EMR components, infrastructure, and any related systems should be on the emergency power source. In the case of a multiple generator site with paralleling switchgear and load shedding, the automatic transfer switch serving the EMR loads should have a higher, rather than lower, load priority. Each network closet should be powered by non-associated, separate LC emergency power. An uninterruptible power supply (UPS) should be considered for server and network equipment, including wireless network access points that are used for wireless access to EMRs. Desktop-related stations tied to EMR should also be on emergency power. Cooling The eventual number of servers planned for the data center can increase quickly when an EMR system is implemented. Each system and its interface to EMRs might consist of dedicated servers. For example, some systems require separate interface servers for admission, discharge, and transfer system, another for communications interface with VoIP, texting and personal communicators. Mechanical equipment that cools the IT rooms serving EMR servers and network infrastructure must work in order for the EMR to be available. Recommendations: Plan for space and increased HVAC requirements to support the increase in servers. Loads can be minimized by installing a small process cooling loop with redundant equipment. This way, the load can be confined to cooling critical equipment. Since the load is smaller, it also makes it more feasible to put this process cooling loop and its equipment on emergency power. The cooling equipment should have a high load shedding priority on emergency power. Service disruption Typically, hospital campuses have fiber infrastructure coming into the campus from a service provider. The fiber-based core network can support files of any size and the future needs of the organization. It would be unusual if the fiber infrastructure were under the hospital s influence once it left the hospital property; therefore the risk of service disruption is not within the hospital s control. Service disruption can also occur with the internal fiber distribution within network closets. Vertical distribution of data occurs between floors through the network closets. Failure or disruption of the vertical data path is possible due to numerous reasons. Recommendations: The best way to mitigate service disruption associated with the fiber infrastructure is to design the network to be route-diverse and have redundant fiber lines running to and from every key point of presence - consider multiple service providers for your institution. This is easier to do in developed metropolitan areas, as there are usually multiple vendor choices for site connectivity. In less developed areas, alternatives such as redundant lines from a single provider coming from different routes to the hospital can be implemented. To reduce network closet service disruptions, design redundant vertical data pathways that are physically separated from each other so that if one loop fails, there s no disruption in service for EMR or other data applications. This can be accomplished by running the data loops in the same closet but with some separation, or by running them in different areas of the hospital. Network closets In the past, network closets were rarely planned in the design of a building. Core network closets should not be closets and their location should be secure. Many of today s network closets don t meet the standards for data communication rooms or telecommunications rooms (DCR/TRs). Recommendations: A DCR/TR should meet the minimum requirements of the ANSI/TIA/EIA-568-B standard. Each closet should be powered by non-associated, separate LC emergency power. In the event of one room having any type of failure, the other rooms can manage the network load. This type of basic core design allows maintenance to be performed on the network equipment without taking out the entire network. Service disruption can also occur with the internal fiber distribution within network closets.

6 Equipment failure An EMR system supports patient care and if it goes down, patient care is severely impacted. The challenge for IT is to ensure that the end user retains access to EMRs even in the case of an equipment failure. Recommendations: One of the key elements associated with EMR readiness planning is redundancy. Implementing multiple levels of system redundancy stops single points of network failure between any individual user and the EMR application: vii Mesh the network access for each department across multiple network switches. Buy redundant EMR database servers that will continue to work even if the main EMR server fails. Cluster all production environments to allow for one cluster to be down without affecting the other cluster(s). Mirror all data in real time to a second hot data center running a duplicate instance of the production environment for the sole purpose of disaster recovery. Complete data backups to a disk library. Complete data backups to tape and store the tape offsite. Have surplus hot routers available. Implement a distributed read only contingency system that allows providers to view static medical records. This data can be viewed online or printed and distributed. If it is to be viewed online then contingency computers need to be identified. Business continuity plans A business continuity plan is needed to ensure the business can continue operations in the event of a disaster. This includes keeping the business running, recovering lost data, testing of backup procedures and replacement of equipment. It encompasses a coordinated strategy that involves plans, procedures, and technical measures to enable the recovery of systems, operations, and data after a disruption. HIPAA calls for organizations to maintain three separate plans related to disaster recovery. A data backup plan that focuses on procedures for creating and maintaining backups of electronic protected health information. A disaster recovery plan that documents the inventory of all critical data and vital systems and the procedures used to restore data to facilitate the recovery of capabilities at an alternate site in the event of fire, vandalism, natural disaster, or system failure. An emergency mode operations plan that details how the organization will continue to operate after a disaster, such as a fire or flood. The infrastructure to support an organization s business continuity and disaster recovery plan can take on different features depending on the business drivers. Recommendations: The infrastructure to support an organization s business continuity and disaster recovery plan can take on different features depending on the business drivers. The National Institute of Standards and Technology recommends following seven key steps to address the requirements of contingency planning viii These seven key steps for contingency planning are: Develop the contingency planning policy statement. Conduct the business impact analysis. Identify preventive controls. Develop recovery strategies. Plan testing, training, and exercises. Plan maintenance. A CIO or CTO should not underestimate the importance of the processes and technology infrastructure supporting the EMR and clinical applications. The growing adoption of EMR systems and the exponential accumulation of patient data place an increased demand on digital storage. Storage solutions will be critical for managing the increase in data, and virtualization of servers, storage and clients will be necessary in order to maximize the performance and efficiency of IT investments. The compliance and security issues surrounding ephi require the implementation of new policies and procedures and access control solutions that encompass a wide range of scenarios to manage who is accessing what data and how it s being transmitted, used, and stored. The need for 24/7 access to patient data necessitates resiliency and redundancy in the infrastructure.

7 Infrastructure assessments covering the data center, networks, endpoints, desktop storage and virtualization, and the development of an upgrade plan should be performed prior to, or concurrently with, the EMR vendor selection process. Our final recommendation is to engage a vendor experienced in EMR infrastructure readiness and medical grade networks to provide an experienced perspective to the assessments and subsequent plans. Core storage / fabric / virtualization Application delivery Desktop virtualization framework Client access VmWare MS servers OLTP Production/Replica Cache shadow 3rd Party System Relay server Print server SAN storage Replication Cache or SAN SAN storage VmWare ETL VMWare view EHR applications Citrix XenApp Web servers Authentication Disaster recovery OLAP Reporting shadow RDBMS Business objectives Enterprise servers VmWare Virtualization Midrange Virtualization MS servers Relay server BLOB Print server Comm/Proxy Interconnect OLTP Production Training Failover QA Development Authentication VmWare Virtualization VmWare view Citrix XenApp Web servers SSO EHR application Output Printers Customer printers Clients (BYOD) Thin client Terminal client Tablet Laptop Smartphone Workstation Browser Data Center Data Center LAN WAN Wireless / LAN Clinical Delivery Network Audit / Security / Compliance Denotes a single clinical payload, dynamic network layering required to isolate traffic styles ( public, business, guest, medical, biomedical ) BYOD: Ability to leverage Multiple Device styles both secured and non secured for clinical content delivery Virtualization Leveraged to replicate engine payloads across portfolio Synchronized for recovery. Core clinical data replicated to meet SLA agreements. i Healthcare Inspection, VistA Outages Affecting Patient Care, Office of Risk Management and Incident Response, VA Office of Inspector General, December 3, 2009, p VAOIG pdf ii (d) Standard: Person or entity authentication. [Federal Register, 68:34, p. 8379] iii Server Virtualization in Healthcare IT, Colin Steele, Senior Site Editor. iv How is Server Virtualization Technology Used In Healthcare?, Staff Contributor. v Opinion Article: Establishing the EMR Infrastructure, Renzo Taal, March 25,

8 Middle East & Africa Asia Australia Europe Americas Algeria Angola Botswana Congo Burundi Democratic Republic of the Congo Gabon Ghana Kenya Malawi Mauritius Morocco Mozambique Namibia Nigeria Oman Rwanda Saudi Arabia South Africa Tanzania Uganda United Arab Emirates Zambia China Hong Kong India Indonesia Japan Korea Malaysia New Zealand Philippines Singapore Taiwan Thailand Vietnam Australian Capital Territory New South Wales Queensland South Australia Victoria Western Australia Austria Belgium Czech Republic France Germany Hungary Italy Ireland Luxembourg Netherlands Poland Portugal Slovakia Spain Switzerland United Kingdom Brazil Canada Chile Mexico United States For contact details in your region please visit dimensiondata.com/globalpresence