Cloud Computing in Healthcare: Is there a Silver Lining?

December 2010

By Jeffrey White
Principal, Aspen Advisors

Executive Summary

Cloud computing is now the technology buzzword of small and medium sized business. There are various services that fall under the term cloud computing. Software as a service (SaaS), data storage and complete server computing platforms are the primary “cloud” services. While the total cost of ownership (TCO) can be modeled, the benefits and risks are more difficult to substantiate. The move toward many of the general market cloud computing services may be premature for healthcare organizations — at least over the next few years. The costs and savings purported by the cloud computing vendors are not well established or measured for healthcare organizations. What follows is an exploration of some of the major considerations for using cloud computing services in healthcare organizations (HCOs), hospitals, and integrated delivery networks.

What is Cloud Computing?

There are references to shared variable computing services as far back as 40 years ago in the mainframe world. IBM started a flexible computing concept in 2004 with their “OnDemand” service in mid-range server platforms which are on-premise systems. This is a pay-as-needed service for performance and capacity. IBM populates the server with numerous CPUs (i.e., 4, 8 or 16 IBM Power CPUs) and large amounts of RAM (random access memory). The customer specifies how many CPUs and RAM to license, and IBM activates when installed in the customer’s data center. Later as computing requirements grow, the customer can request an increase in processing capability, and IBM activates more CPUs or memory with a licensing cost. This flexible model is not only on demand; services can also be increased with no downtime to the server computing environment.

With the advent of virtualized computer operating systems, it was a logical progression to have a computing platform that leverages large technology infrastructure investments. Presently, cloud computing is a service offered by major technology and service organizations such as Amazon.com, Microsoft, Rackspace, and others. The term “cloud” was coined from the Internet as being a cloud of servers. Since the service providers are remote to the subscriber’s organization, they are deemed to be in the Internet “cloud”.

Cloud computing is a form of virtualization that shares server hardware and data storage infrastructure remotely located at the service provider data center. Today cloud computing is comprised of three major services: Software as a service (SaaS), data storage, and server platform; these services are typically offered in a subscription model with various means of pricing.

Software as a Service (SaaS) — SaaS is a software provisioning and delivery model that is almost entirely web-browser software in nature. The software runs in data centers owned by the SaaS service providers. Examples of SaaS include Google Apps, Google Gmail, Microsoft Office Web Apps, Microsoft SharePoint hosting, QuickBooks, and Salesforce.com. These application services are constantly evolving, and many have matured to be relevant and useful in business.

1. Software as a Service (SaaS) — SaaS is normally sold with a monthly or annual subscription on a per user basis. There are some SaaS application services that are healthcare specific including eClinicalWorks and AthenaHealth (EMR and Practice Management) and A Life Medical (coding and billing). Other healthcare specific applications are under development. There are issues and considerations for use of SaaS in large HCOs as a replacement for premise-based applications like Microsoft Outlook, Microsoft Office or IBM Lotus Notes.

2. Data Storage — With the cloud data storage service, data are remotely stored in a database or file directory structure. This has benefits for some tiered data storage models where an off-site copy of data can be placed in the “cloud.” There are still concerns about data security and data availability assurance. These concerns are addressed in the “Benefits and Risks” section below.

3. Server Platform — A server platform is a cloud computing server instance that is measured by processor utilization, transactions, data storage, or a combination of all three. These services can be purchased from various providers with Microsoft or Linux platforms, and most include an application programming interface (API). Each service has its particular technology. Microsoft Azure, their cloud computing offering, is based on .NET and a cloud specific version of SQL. The Amazon Elastic Compute Cloud (Amazon EC2) can be provisioned with Microsoft web services (.NET, SQL, IIS, Silverlight) or IBM (Websphere, DB2, Informix, Lotus Web Content Management).

Instances of the server platform services are virtual in nature, processing and storage can be increased or decreased as needed, and some services offer a guaranteed processing capacity.

The server platform services are fine for standalone applications. However, working within the confines of a vendor proprietary server platform can be challenging. Security, privacy, and other HIPAA related best practices are yet to be proven out with the cloud computing service providers. These concerns are addressed in the “Benefits and Risks” section below.

Security, privacy, and other HIPAA related best practices are yet to be proven out with the cloud computing service providers.

How Does Cloud Computing Differ from Remote Hosting Option Offerings?

Remote Hosting Option (RHO) is a data center space and infrastructure service offered by many vendors including SunGard, Cerner, and others. Cerner offers an RHO service for hosting its Millennium solution at its Kansas City data center and has been very successful with this service. Other EMR vendors such as NextGen and Allscripts also have remote hosting service offerings.

RHO is different from cloud computing since RHO has a dedicated set of servers and data storage devices (SAN) that provide primary or secondary hot-site services. In the example of Cerner, a RHO offering would involve specification of the hardware and software required to support the contracting healthcare organization for a period of five to seven years. These are typically big iron (HP, IBM) Unix environments with reporting and supporting services on Linux or Microsoft based servers.

The RHO service model can guarantee application performance and availability. Furthermore, the infrastructure and application environments are typically supported by the RHO vendor.

The server platform service offered from a cloud computing vendor is greatly different from a RHO service since the former typically does not have service level agreements (SLAs) or availability guarantees that are aligned with HCO needs.

Why All the Market Hype About Cloud Computing?

In just about any technical magazine or healthcare informatics publication, there are articles and advertisements for some form of cloud computing service. These services are very well positioned for start-up companies and also small to medium sized businesses (including smaller physician groups) for a number of reasons. They allow businesses to rapidly provision server platforms for web-based applications for both internal and external use. Subscribing to SaaS applications is relatively easy and, in most cases, rapid in terms of deployment to end users. The cloud computing pricing model avoids large capital outlays and is normally paid with operational budgets.

The market hype about cloud computing is just that: hype. Most of the services offered by cloud computing service providers are not aligned with technologies and computing capacity needs found in most medium and large healthcare organizations. There will be some SaaS application providers that will develop functional and usable healthcare applications like eClinicalWorks and even potentially some ancillary clinical applications. The greatest challenges will be security, privacy, and HL7 data interfacing with premise-based HIS/EMR systems located inside the healthcare enterprise.

Many Healthcare Organizations Already Have a Form of Cloud Computing

Many organizations already have some form of cloud computing technology in the data center. Technologies from Citrix and VMware provide server virtualization and more economic use of previously underutilized server infrastructure. This is not a lot unlike cloud computing concepts. However the HCO has complete control over the environment, and information security and virtual servers can be scaled up or down as needed to satisfy the needs of the healthcare organization.

Benefits and Risks

The benefits and risks with cloud computing services fall into five categories:

1. Information security,
2. Protected health information privacy,
3. Performance,
4. Services availability, and
5. Cost. The cost aspect is addressed in the TCO section below.

Many of the cloud computing providers have services audited in terms of security, both physical and logical access. Even with the audits conducted, these are point-in-time assessments of the computing services. Many changes and forms of access can change without notice from the cloud service provider.

Physical access to the underlying hypervisor (core of the virtual environment) by the vendor’s administrators can be tracked. However, tracking what they do with the virtual environments of data storage or server platforms is of question. This is no different than system administrator access to servers in a hospital’s data center. Yet the cloud vendor is far removed, and it’s difficult to see or monitor physical access to cloud infrastructure.

...........

As can be seen in the tables above, there are many considerations that can both support and disprove cloud computing services as being viable for healthcare organizations.

Service Quality and Availability

One of the most critical considerations whether to use cloud computer services is the quality and availability of a cloud computing provider’s services. Most service level agreements (SLAs) offered by providers are at 99 percent or at best 99.9 percent uptime availability. This means that the services could be interrupted from 8.7 to 87 hours annually without penalty to the service provider, and most penalties are insignificant. For HCOs this is an unacceptable level of service. With EMR systems and CPOE, hospitals need 99.999 percent services availability of core and diagnostic systems. This level of service is not offered by cloud computing providers, and with the Internet in between, there is always the uncertainty of multiple points of data transport weakness and potential failure.

Application Performance and Staff Productivity

The balance between cloud application performance and staff productivity must be carefully weighed. The single largest factor that impacts cloud computing application performance is Internet connectivity speed. While a healthcare organization can contract for specific Internet capacity, there is no SLA for end-to-end Internet speed from the hospital data center to the cloud computing environment. The performance of applications can and will be variable throughout the workday.

TCO Models are Generally Flawed

As mentioned in the Benefits and Risks section above, there are many costs incurred in healthcare organizations that are not built into the vendor TCO models. Relying on the vendor models for estimating costs and benefits for HCOs can present false anticipated gains for proposed future-state operations. Some cost components that should be considered include:

Internet connectivity and redundancy costs
Integration with other HCO applications
HL7 interface challenges with premise-based clinical and business systems
Data migration to SaaS environment at
service initiation
Patient care issues and staff productivity impacts with interruptions in cloud computing accessibility
Duplicative software licensing to support mobile users and special application requirements
Impacts to a simplified, consistent approach to end-user device configuration
Staff productivity impacts and training and opportunity loss costs with SaaS general market software
Change management issues and related costs

Will Healthcare Organizations Put Applications in the Cloud?

The Microsoft Azure web site has a listing of 63 case studies for their cloud computing services. Not a single Microsoft case study involves any type of healthcare organization. This is very telling in that Cloud computing is a great service offering for cross-market industry sectors that have the need to develop applications in-house or have extensive web-based services.

Cloud computing has a place in many organizations. For most HCOs, the role of these new computing services today is probably limited to isolated test environments. There may also be opportunities for remote disaster recovery or business continuance computing services with cloud computing. However, this is limited to the server operating system types offered by vendors and a HCO’s suite of applications.

Another area of opportunity for cloud computing is health information exchanges (HIE). Moving forward there more than likely will be a few dominant HIE service providers, and it would make sense for them to architect services utilizing the major cloud computing providers.

Summary and Recommendations

The present and foreseeable future for cloud computing service offerings is one that can certainly support many industry sectors and sizes of organizations. The offerings by vendors today are clearly directed to small and mid-sized organizations and primarily of interest in supporting Internet-based web services applications.

A move toward many of the general market SaaS and Server Platform services would be premature for healthcare organization over the next few years. The costs and savings purported by the cloud computing vendors are not well established or measured for healthcare organizations. Of more importance, the management of patient PHI on remotely hosted infrastructure can place a HCO at risk.

Clearly healthcare organizations are looking for cost reduction opportunities. There may be more substantial opportunities for HCOs to focus on Information Services operational effectiveness than on cloud computing and SaaS general market application services.

-Microsoft, Azure, Microsoft Office, Silverlight, SharePoint, and Exchange are Registered Trademarks of Microsoft Corporation.
-IBM, DB2, Informix, Lotus Notes, and OnDemand are Registered Trademarks of IBM Corporation.
-Amazon and Elastic Compute Cloud (EC2) are Registered Trademarks of Amazon.com.
-Google, Gmail, and Google Apps are Registered Trademarks of Google, Inc.
-HP-UX is a Registered Trademark of Hewlett-Packard Company.