SaaS Adoption Lifecycle in Life-Sciences Companies

Transcription

1 A White Paper Presented By ArisGlobal SaaS Adoption Lifecycle in Life-Sciences Companies by Achal Verma, Associate Director - Program Delivery, Cloud Services

2 Abstract With increasing globalization and competition from across the globe, businesses have little choice but to accelerate their adoption of new technologies to stay competitive in this complex business environment. This has huge cost implication and the CEO / CIO (s) of these corporations are forced to look for solutions that can act as catalyst for key business drivers, accelerators for increased productivity, and pave the path to industry leadership. SaaS based solutions can act as a source of strategic business advantage by the virtue of their shorter implementation cycles, lower TCOs, and high ROIs. The organizations also benefit from their ability to be agile and move to a different solution in case they are unable to reap the promised benefit as investment based on SaaS models are often associated with lower upfront investments. SaaS Marketplace SaaS marketplace has witnessed a rapid growth of vendors in the recent past with a race to garner a bigger pie of this growth segment. The solutions that are being currently offered range from being fairly lightweight to very complex in nature. While these light weight solutions tend to be inexpensive and attract buyers at the outset, the limited capabilities offered by them can act as a drag and limit business process improvement that can be achieved through their adoption. At the other end of the spectrum are these fairly complex solutions featuring a rich array of capabilities. However, embracing these solutions can entail longer deployment cycles and significantly higher upfront investments. Businesses need to make a judicious choice based on the complexity of their own business processes, their cost of capital, and the deployment cycle times that they can adhere to move ahead of the competition. For a highly regulated industry changes in key legislation can be another determinant for the choice of solutions. Drug Development and Healthcare Industry Healthcare continues to be a highly regulated industry. Pharmaceutical companies have developed fairly complex ecosystems to manage the drug development process. At the same time, they have to be compliant with the norms laid down by leading global regulatory authorities like FDA, EMA, PMDA, etc. The caveat in all this is that data must be de-identified to comply with global patient protection and privacy regulations. As companies analyse large samples of data from multiple sources and collaborate with other organizations, they must ensure they have the authorization to actually leverage and share that data. SAAS service providers have to ensure that they are compliant with these requirements. 2

3 SaaS Adoption Lifecycle 1. Cloud Vendor assessment and purchase 2. Implementation 3. User Acceptance Test (UAT) 4. Transition 5. Go-Live 6. Post Go-Live 1.Cloud vendor Assessment: For a highly regulated industry such as life sciences with strict compliance requirements, choosing a cloud vendor can come with certain challenges. Privacy, compliance and security are key concerns. The Cloud vendor needs to comply by various compliance requirements such as adhering to HIPAA requirements and GAMP5 guidelines. The cloud vendor needs to comply with certain policies and procedures so that the security of data (both data-at-rest and data-in-transit) is never compromised. Complying to various standards requires knowing the geographical location of data with stringent security policies in place to comply with HIPAA requirements. This includes dedicated personnel to manage the cloud infrastructure, restricted access controls with electronic identification to control physical data access, data encryption during transfer and at rest, periodic data backup, 24x7 data monitoring to record and report any malicious activities through well-defined incident management processes and robust disaster recovery plans. Apart from adhering to various compliance requirements, there are some other requirements that the cloud vendor needs to abide with. It is critical to choose a company that is stable, has been in the business for a considerable period of time, supporting large business applications on secure, reliable and scalable platform and providing stringent SLA-based service levels and 24x7 customer support. This will mitigate risks associated with handing over business-critical applications to inexperienced SaaS providers. 2.Implementation During the implementation phase, the solution iterates through the following stages from data centre qualification, pre-validation, application configuration, post qualification and validation. 3

4 a.) Data Centre Infrastructure Qualification As a first step in the implementation cycle, the data centre infrastructure has to be fully qualified so that they are ready to install business-critical life science applications. Infrastructure Qualification includes areas specific to Network Security (Routers, Firewalls, VPN tunnel), Hardware platform (Servers, Memory, Storage), & Software platform (Operating System, Database, Web services, Virtual machines). b.) Pre-validation All applications that are deployed for this highly regulated industry have to be validated for the standard functionality as per Industry Standard practices (ISP). The standard validation deliverables are as per GAMP5 and meet the norms followed by best in class in the industry. Early detection of defects, reduced deployment time for customers, and ability to see the products in real time at time of purchase are some of the key benefits of this approach. c.) Application Configuration, Post Qualification, and Validation The application is then configured and validated for any incremental changes during this implementation cycle based on customer business needs. The configuration changes would include any customer-specific configurations and workflows to support their business processes. Once Post Qualification has been completed for the configured system, User Acceptance Testing is performed by the customer. On successful completion of all validation activities and setup of the production environment, the system moves to the transition phase (depending on whether the application is a standard out-of-the-box application or a large scale implementation) and then go-live state and is ready for use 3.User Acceptance Test (UAT) After completion of post qualification for the configured system in the validation environment which is replica of the real-world usage of the SaaS application, the customer performs the UAT. Real-world test scenarios are created to conduct UAT. User Acceptance Testing validates the end-to-end user access, business process and system transactions. It confirms that the application is functionally fit for use and behaves as expected. A UAT Summary Report is made to document the results of the User Acceptability Testing (UAT) performed on the application installed in the customer s Validation environment. It describes any process deviations and script failures and assesses any possible impact upon the validation process. The conclusion of this document will outline the recommendation (or otherwise) for the upgrade to the production environment of the application subsequent to go-live decision. The customer then signs off indicating that the application has been delivered to their satisfaction. 4

5 4.Transition For an out-of-the-box solution implementation, the transition phase is almost negligible. For a highly configured solution, the typical methodology of transitioning from the implementation team to the transition team mentioned below is followed. Transition planning overlap before go-live timeline Transition team responsible for seamless go-live Implementation team members move to support team to ensure acquired knowledge availability for client Transition planning activities - before go-live (parallel to User Acceptance Test) The Transition methodology consists of 4 tracks that run in parallel and ensures a robust framework to mitigate all risks of performing processes The tracks are: Knowledge Track activities related to business (or process) knowledge capture and documentation of the processes that are being considered for off-shoring Technology Track activities that relate to planning and implementing the necessary technology infra structure for offshore processing Operations Track activities pertaining to readiness of physical infrastructure and availability of people Program Management Track overarching activities aimed at managing the entire transition program across the other transition tracks. 5.Go-live After the customer signs off the UAT, the application in the validation environment is then replicated on to the production environment. Post transition, the application is handed over to the managed services team, the objective of which is to achieve business as-usual for the customer seamlessly through high class support based on the principle of Simple Process - Swift Resolution - Smart Outcome 5

6 Simple processes are ITIL aligned, Regulatory compliance, 3-Layer Support, Customer-specific Knowledge Management Database and seamless transition. Swift resolution is achieved through 24x7x365 coverage, Onsite Engagement Manager, Subject Matter Experts and Hyper care support. Metrics-driven SLA s, Governance framework, continual improvement, CSAT Survey, CAB and Escalation registers, when used appropriately can deliver smarter outcomes. 6.Post-go-live / Steady State Support Post go-live, the system is under steady state support after a brief period of hyper care. Any change to the validated system has to go through a change management process and the validation has to be established based on the impact of change. The objectives of the change management process are to Perform modification to any IT resources in logical or orderly fashion Achieve the expected result, without undesired service disruption within the agreed timeframe Ensure that changes to the validated environment is documented and tested accordingly Perform Root Cause Analysis for any failure in the implemented change A well-defined change management process is aligned with ITIL guidelines. The process is defined with CSV and GAMP 5 as basic framework and is more inclined to ensure these aspects are met during the processing changes in Validated Environment. Established guidelines and training is provided to the team for preparing assessments, for pre and post implementation review of changes in the environment and for review of deliverables by technical and compliance team. Change Management process is to ensure the minimization of re-validation of the environment. Internal audits need to be performed annually to verify the validated state of the system. The cloud vendor team should also support the customers during external regulatory agency inspections. Conclusion SAAS based solutions are leading to a new wave of disruptive innovation in the pharmaceutical industry and companies can no more choose to ignore their value proposition. It is imperative upon them to identify the appropriate solution based on their business need, growth choices, competitive scenario, and investment options. Partnership with the right vendor can unleash the infinite potential of their business and help them take leadership position in the coming years. 6

7 About ArisGlobal ArisGlobal is the leading provider of integrated solutions for pharmacovigilance and safety, regulatory affairs, clinical research and quality and compliance for medical inquiries. Life science companies using ArisGlobal s solutions can better build and maintain the trust they need with their customers, medical practitioners and regulatory bodies around the world ArisGlobal LLC. All rights reserved. aginquirer, agtracker, agresponder, agbiblio, and the ArisGlobal logo are trademarks or registered trademarks of ArisGlobal in the US Patent and Trademark Office and other jurisdictions. Other marks may be trademarks or registered trademarks of their respective owners and are acknowledged as such. The information you see, hear or read on the pages within this presentation, as well as the presentation s form and substance, are subject to copyright protection. In no event, may you use, distribute, copy, reproduce, modify, distort, or transmit the information or any of its elements, such as text, images or concepts, without the prior written permission of ArisGlobal. Trademarks, service marks, and logos (collectively the trademarks ) displayed on the pages within this booklet, are the property of their respective owner. No license or right pertaining to any of these trademarks shall be granted without the written permission of ArisGlobal, LLC (and any of its global offices and/or affiliates). ArisGlobal reserves the right to legally enforce any infringement of its intellectual property, copyright and trademark rights. 7