CHECKLIST FOR THE CLOUD ADOPTION IN THE HEALTHCARE PROVISIONING INDUSTRY

SHOULD MY HOSPITAL MOVE TO THE CLOUD? A synopsis of questions and answers that will help you make up your mind

QUESTIONS & ANSWERS SHOULD MY HOSPITAL MOVE TO THE CLOUD? INTRO Are you involved in the management of information systems in a hospital or other healthcare organization? Are you considering the adoption of cloud computing technologies in your organization? Do you have open issues and questions regarding cloud adoption in the healthcare domain? Undoubtedly the use of cloud computing in healthcare domain can bring significant benefits to the quality of services provided. At the same time, the decision to introduce cloud computing in the healthcare sector is a complex and tricky task. Through deep understanding of the specificities of healthcare sector, this brochure outlines answers to fundamental questions that puzzle the managers of healthcare organizations when it comes to cloud computing adoption.

SHOULD MY HOSPITAL MOVE TO THE CLOUD? Q01. How much will it cost? Each case is different, so it depends. A good approach is to ask cloud providers for a list of every possible cost e.g. data-storage costs; one-time fees for initiating the service or moving data; any costs related to uploads or downloads; network bandwidth fees; and costs relevant to maintenance. Usually most cloud providers give quotes for free which will make it easier to also compare providers. Q02. Is patient data privacy at risk? Privacy is not a problem for cloud only, but a problem of other technologies used as well. So, the risk for jeopardizing the privacy of patient data is similar to the one that patient data currently have (while being stored at the IT infrastructure of the hospital). In fact, in the case of cloud, as security and data protection is agreed through a contract and handled the cloud provider, the cloud provider is likely to have more expertise in minimizing security risks compared to the hospital s own IT department.

QUESTIONS & ANSWERS SHOULD MY HOSPITAL MOVE TO THE CLOUD? Q03. Will I need extra IT help to make the transition? It is not necessary to hire somebody with particular expertise on cloud migration procedure. Basic IT staff in collaboration with the cloud provider can make the transition process simple, efficient and speedy. Shall it is considered as necessary, there are outsourcing IT professionals available in the market which particularly specialize in assisting such transition process and have good knowledge of the problems that may arise. Q04. Do I have to purchase new hardware? It is likely to occur in cases that newer machines (e.g. desktop or laptop) are necessary to support the wider usage of the technology by the staff members of the hospital. Another case might be the need to upgrade the network capabilities. Most of the organizations may migrate to the cloud by taking advantage of cloud offerings without making a substantial investment. Q05. How can I make sure I always have access to my data? A cloud provider should be able to outline access, security, services, support and other specifics in a service-level agreement. These agreements detail what happens if there s an outage or if the cloud provider goes out of business, and protects you in certain circumstances. To be truly confident about data storage, however, experts usually recommend using multiple services instead of a single provider. Some companies, for instance, choose to back up mission-critical data to a cloud provider as well as to a different online backup service.

Q06. What do I need to do to get ready for the cloud? This depends on the solution the healthcare organization plans to use. For example, if it is a simple Software-as-a-Service solution for medical appointments, getting ready could be as simple as having an outsourced IT consultant coming to your company and making the necessary changes. But, for cases such as moving the datacenter to the cloud (e.g. patient health records are on the cloud), there might be a longer transition process requiring also training of staff members in uploading to the cloud provider s infrastructure etc. Q07. How can be the constant access to my data ensured? Signing a service-level agreement (SLA) with the cloud provider should shed light on this matter and clarify matters such as data access, security, services, support etc. Since in the healthcare domain, access to data may be vital for human life, through the SLA it should also be clearly clarified what happens in the case of service failure, network failure, cloud provider going out of business etc. The SLA should define how the healthcare organization is protected by such

circumstances. Duplication of data to other datacenters or having recent patient data also stored locally could be options that cloud service providers may be able to provide in order to ensure that important data is always accessible. Cloud providers specializing in providing services to the healthcare industry, have understanding of the specialized needs associated to the healthcare sector. Hence, they are likely to capture these issues through their SLAs and to be capable of providing support for all such issues. Q08. What happens in the event of data loss? It depends. First of all, cloud providers offering cloud services to the healthcare sector have full understanding of the criticality of data related to the healthcare domain. Hence, they are likely to be able to proposed solutions that deal with data-loss and backup issues. In addition, patient data currently handled and stored by the hospital s IT department could be at higher risk compared to those provided by the cloud provider. This could be justified if we consider that cloud providers have the resources and the expertise for having specialized personnel dedicated to dealing with data loss and security issues.

QUESTIONS & ANSWERS SHOULD MY HOSPITAL MOVE TO THE CLOUD? Finally, cloud providers usually encrypt data before storing them. Hence, in the unlikely event that encrypted data gets corrupted it can be harder to recover, but it's not impossible. The SLA signed between the healthcare organization and the cloud provider will have a policy in place in the event of data loss, which outlines the recovery measures they will take. Asking cloud providers explicitly about such events and their strategies for dealing with them (and possibly asking for examples of how they have recovered data in the past), could assist in ensuring that data loss risks are minimized. Besides, one of cloud s biggest advantages is that data loss risk overheads from the side of the healthcare organization are minimized since the service is outsourced. Q09. How does moving what has traditionally been handled by IT into those parts of the organization change things? The role of the IT is not eliminated but it is reformed. By moving to the cloud, the IT staff can be focused on its core aim: to deliver services to the clients (i.e. doctors, nurses and administrative staff) rather than dealing with backend issues (e.g. servers and infrastructure maintenance). In other words, the role of IT department is just shifting from building and implementing to buying and sourcing. The use of cloud computing in the healthcare domain is expected to change the way hospitals own IT and operate with it and this can provide economic, organizational and technological benefits.

QUESTIONS & ANSWERS SHOULD MY HOSPITAL MOVE TO THE CLOUD? Q10. How should we deliver the solution if we are a chain of hospitals that span across different geographical regions? The rollout procedure could be divided into phases. You establish a way of phasing populations onto the system. This could be relevant to phasing initially small hospital and then moving to larger ones or rolling it out region by region and then gradually ramping up the volume. Through this strategy, it is possible to evaluate what is happening at each phase in order to ensure the system can handle the volume and be capable of handling any migration issues. In this way, issues can be handled on a small scale and hence avoid overwhelming the support staff of the organization. In this way, the IT staff can learn and adjust by phase as the new service is being rolled out until it is fully up and running. Q11. How to choose the geographic location for the data? Considering that the healthcare sector handles patient data, the first thing to ensure is that the location of the data is in accordance to the local or European regulation concerning patient data storage and processing. If the regulation is very restrictive, perhaps a private cloud deployment model could be the only possible solution. Alternatively, another solution would be to choose a cloud provider that offers datacenters at the same country or region. In this case, it is good to ensure that the provider holds a data center location with low risk for natural disasters. Data location should be also prescribed and protected by the SLA. The SLA should also explicitly state that notice will be provided in the case that the data will be moved to another data center

QUESTIONS & ANSWERS SHOULD MY HOSPITAL MOVE TO THE CLOUD? and should provide the option of declining the change (or if declining is no possible, terminate the agreement with penalty and a reasonable transition time). Q12. How is my data protected while it is stored? Is it encrypted? Do I control the encryption key? A review of the policies and procedures of both the hosting provider and the application provider to see how encryption is handled could be requested. However, most encryption is handled at the software level of the application. This begins with the overall application design, and then migrates down to end users and a hosting provider. Data should be encrypted, access to that data should be logged, and reasonable security measures should be in place to protect the data.

QUESTIONS & ANSWERS HOW CAN I FIND OUT MORE INFORMATION ON THESE MATTERS? FOR MORE INFORMATION YOU CAN VISIT THE EUROPEAN COMMISSION DEDICATED WEBSITES: ON CLOUD COMPUTING: http://ec.europa.eu/digital-agenda/en/telecoms-andinternet/cloud-computing ON SLAs: http://ec.europa.eu/digital-agenda/en/news/cloudservice-level-agreement-standardisation-guidelines OR VISIT THE SUCRE PROJECT WEBSITE: THE DEDICATED CLOUD FOR HEALTHCARE SECTION: http://www.sucreproject.eu/content/clouds-healthcare A VIDEO ABOUT CLOUD ADOPTION IN THE HEALTHCARE SECTOR: http://sucreproject.eu/content/2nd-sucre-video-about -cloud-computing-healthcare-sector-now-online THE MAIN PAGE FOR ALL OF THE BROCHURES: http://www.sucreproject.eu/news/brochures

Design: apanicroom.com Additional graphics: Freepik.com A SUCRE PROJECT PUBLICATION / 2014 info@sucreproject.eu www.sucreproject.eu @SUCRE_project

Design: apanicroom.com Additional graphics: Freepik.com

HELLENIC REPUBLIC National and Kapodistrian University of Athens