At a Glance
There are three major trends in the use of cloud-based services for healthcare IT:
- Cloud computing involves the hosting of health IT applications in a service provider cloud.
- Cloud storage is a data storage service that can involve, for example, long-term storage and archival of information such as clinical data, medical images, and scanned documents.
- Data center colocation involves rental of secure space in the cloud from a vendor, an approach that allows a hospital to share power capacity and proven security protocols, reducing costs.
In the 1970s, IT timesharing worked well and saved money for some applications, especially large mainframe systems. In the 1990s, the move to client servers began. Faster, higher capacity, less expensive computing became the norm. Hospitals began building their own data centers with “on premises“ servers and local area networks.
Today’s hospital IT departments have come full circle. The costs of data centers have exploded, and hospitals are now moving back to what is conceptually a timeshare model—only this time it is called a “cloud.” In the simplest terms, cloud computing is defined as a hospital having its own data center, but at somebody else’s location and under someone else’s watch, accessible through secure Internet connections. Relieved of the burden of managing hardware, storage, and maintenance, IT departments that use the cloud are able to focus solely on applications and servicing their end-users.
With so much software moving to the cloud, however, it is important to go beyond basic concepts and closely assess the cloud’s true value for each organization. Some hospitals will use cloud services for archival, storage, and backup only. Others will take a bolder approach by completely outsourcing their applications to a cloud services provider.
Hospitals should take five steps in assessing the value of cloud computing—and determining the right approach.
Step One: Understand Your Data Center Costs
Many capital dollars are invested in meeting a hospital or health system’s IT goals, including those related to duplicating data centers, supporting data sharing, accommodating archival storage, supporting business continuity, and establishing a disaster recovery plan for IT. Therefore, it is critical that healthcare finance executives understand data center costs and quantify them annually.
For example, a large academic medical center in Atlanta recently received a $1.5 million quote just for the electrical power component of establishing a data center. This amount did not cover cooling, networking, personnel, and build-out costs. Furthermore, this amount is expected to double over 10 years, contributing to high capital expenditures and exorbitant ongoing operating budgets.
Instead, the hospital chose to colocate its data center, renting secure space in the cloud from a vendor. This approach will allow the hospital to share power capacity and proven security protocols with the vendor. In colocating its data center, the hospital expects to save 20 to 30 percent in typical cloud computing costs.
Step Two: Know Your Options
There are three major “cloud trends” in health care: cloud computing, cloud storage, and data center colocation.
Cloud computing. Cloud computing refers to the hosting of health IT applications in a service provider cloud. The hospital’s applications are hosted within a public cloud or housed completely within an exclusive, private cloud.
Outside of core financial, clinical, and electronic health record (EHR) applications, hospitals average up to 200 ancillary or second-tier applications. Hosting one, two, or several second-tier applications in the cloud is the most practical and cost-effective way for hospitals to venture into the cloud.
The cost savings from cloud computing are primarily hardware related and are fairly small for each application placed into the cloud. However, if a hospital moves a large number of its third-tier applications into the cloud, the savings multiply, and proof of concept can be achieved easily.
Cloud storage. Cloud storage refers specifically to storage as a service—for instance, where the cloud is used for long-term storage and archival of information such as clinical data, medical images, and scanned documents. Storage takes many forms, including fast-performing primary storage, lower-performing archive storage, medical image storage, and vendor-neutral archiving for medical images. Cloud storage can be private, public, or a combination of the two (a “hybrid” environment).
Cloud storage also is relatively easy to develop. For most organizations, it can simply mean the use of a cloud-based storage target that providers can point to for data storage and management, or the use of an onsite device that links with the storage target and manages the sending of data to cloud-based storage.
Data center colocation. Up-time requirements for advanced clinical applications—along with an explosion in data access requests from health insurance marketplaces, accountable care organizations, EHRs, and the federal government—have mandated higher availability and redundancy in data centers. This trend is fueling the need for hospitals to consider colocation and remote-hosted services.
Furthermore, increased costs of data center security, construction, and personnel are making it cost prohibitive for hospitals to develop their own a data centers. Rather than invest in such an undertaking, some hospitals are partnering with colocation service providers as a cost-effective alternative.
Step Three: Respond to Organizational Concerns
In general, concerns related to the use of cloud computing, storage, and data centers in health care fall into two categories: finance and security.
Finance. In general, financial concerns about use of the cloud in health care relate to timing and amortization. In the past five years, the healthcare industry has witnessed an explosion of application purchases to meet the challenges of economic recovery and reform. These IT systems are still being amortized. The hardware and data center changes required by these applications represent large capital investments that are still on the books.
A cloud approach should begin with new systems and applications. As a cloud-based data center depreciates and software becomes fully amortized, older applications can be folded into the cloud. This approach will build confidence in the cost-effectiveness of incorporating use of the cloud as a healthcare IT strategy.
Security. In both 2010 and 2011, the Health Information and Management Systems Society’s annual leadership survey revealed increases in internal breaches of security among healthcare organizations, making HIPAA compliance and data security support top concerns in healthcare IT. Although these concerns are legitimate, they are just as problematic for internal IT as for cloud-computing providers.
Securing information stored in the cloud is virtually the same as securing data stored in a physical environment. Finance executives should conduct due diligence in vetting cloud solutions providers to ensure the highest levels of physical and technical security, as well as monitoring and auditing capabilities for hospital-based IT staff, will be provided. Key questions to ask cloud solutions providers regarding the security of a solution include the following:
- Can the level of security provided be scaled according to the hospital’s needs?
- What service-level agreements are included in the contract?
- Is application-level monitoring available for our internal IT department?
- What are the security measures for the cloud infrastructure and data center?
- Does the vendor meet or exceed HIPAA and HITECH technical security and audit requirements?
Step Four: Plan Your Final Destination
Although the first three steps in this process can be accomplished one at a time, the best ROI will be achieved by undertaking them concurrently. The fourth step is to plan the organization’s destination within the cloud: Where does it want to be with respect to its cloud strategy a year from now—or in three years, five years, 10 years, and 20 years?
When the organization understands its go-forward cloud strategy, each stakeholder will be empowered to help the organization achieve its near-term and long-term cloud goals. IT departments and finance executives work collaboratively through each step of cloud migration—and in doing so, can more rapidly reduce expenses and support a superior end-user experience.
Step Five: Choose the Right Cloud Partner
All clouds are not created equal. Many cloud providers exist, especially in the consumer or commodity-based cloud market. A true enterprise-grade cloud solution with the appropriate service-level agreements is not easily constructed, especially for health care. This is particularly true in today’s healthcare market, which is increasingly overlaid with considerable privacy, security, and governmental regulations.
Key questions to ask cloud providers include the following.
Will the cloud vendor sign a business associate agreement (BAA)? This question is important for liability coverage. Cloud vendors that focus on health care should be willing to sign a BAA or should already have such an agreement available.
Will the cloud vendor work with your existing application vendors to ensure that systems are working properly? A responsible vendor will work directly with existing application vendors to ensure systems are configured correctly for the cloud and vice-versa. If the cloud vendor does not ensure a successful transition, it will cost the provider more in time and internal resources.
What does the vendor’s service-level agreement look like? In health care, software applications are downtime intolerant. It is therefore best to seek out an industry-leading service level agreement and study the recompense structure for downtime specifications and remedies.
Does the cloud vendor have a security officer focused on HIPAA compliance? A security officer designated for cloud solutions in health care demonstrates dedication and commitment to the industry. A healthcare cloud-computing vendor should be cognizant of the challenges providers face and offer an appropriate environment to safeguard personal health information and mitigate potential risks.
What other related services does the cloud vendor offer? An organization should think long-term when selecting a cloud vendor. The organization will be spending resources to build and privately connect to this cloud. It should seek to scale other services across the network to maximize ROI and cloud management efficiency. Medical image archiving, cloud storage, enterprise storage equipment, dedicated hosting, and data center colocation are additional services that should be considered.
Finding Confidence in the Cloud
The budget required to create and manage effective hospital IT departments has burgeoned in recent years, leading many hospitals to create their own personal IT clouds. However, hospitals find it difficult to achieve economies of scale in healthcare IT. Hardware, storage media, and application lifecycles are too short to quantify a long-term return.
Cloud computing has the potential to help hospitals realize substantial IT savings. A KLAS survey of clinics and hospitals found that 55 percent of the respondents already had at least one application or cloud-based storage solution, while 58 percent said they planned to adopt increased cloud computing (Path to Cloud Computing Foggy: Perception Study 2011, KLAS, November 2011).
Furthermore, cloud technology has matured to the point where hospital confidence in the cloud as a computing, storage, or data center resource can be justified. As the healthcare industry moves toward a world with multiple entities, overlapping physician practices, information exchange among providers and purchasers, and accountable care, simpler and more secure ways of sharing information are necessary. Cloud solutions provide the conduit to greater data sharing and stronger patient information protection.
Janakan Rajendran is chief information officer, GNAX Health, Atlanta.
Dipping a Toe into the Cloud: A Practical Approach to Cloud Computing
Moving noncritical, second-tier applications into the cloud is the simplest way to get started with cloud computing. Under this approach, hospitals create a private cloud with a service provider, start with one application, and ensure that the transition is successful before gradually moving more applications into a private cloud. Because the cloud is supported by a partner, it can be scaled on demand. This approach saves money and allows for gradual reallocation of IT resources to more mission-critical roles, such as ICD-10 migration and EHR deployment.
Publication Date: Wednesday, May 01, 2013