As hospital systems of all sizes struggle with the question of how to cope with rapidly increasing data storage requirements, the cloud is becoming an increasingly attractive option. Nonetheless, the prospect of storing data—especially clinical data—with a third-party service provider, does not sit well with many hospital CIOs. Yet the cloud comes in more than one flavor, and while the so-called public cloud services offered by companies such as Amazon, Google and Microsoft are still off-limits to many hospital systems, some CIOs say that the private cloud, in the form of hosted solutions with their software vendors, is an option worth considering.
One CIO who takes this stance is Tom Gordon, senior vice president and CIO of Virtua, a 1,178-bed provider organization, based in Marlton, N.J., with four acute care hospitals. Gordon dislikes the word cloud as a catchall term, which he says conjures in people’s minds a wide open and unsecured service. Yet while he eschews the public cloud, Gordon says that Virtua, which he describes as a risk-averse organization that operates its own data center for production data and disaster recovery, also makes use of the private cloud that is based on the application service provider (ASP) model.
In Gordon’s view, hosted solutions offer definite economies of scale in terms of shared bandwidth and shared staff to monitor the equipment, and he also notes that a major advantage of hosted solutions is the speed with which applications can be deployed. Nonetheless, he says that the provider sets a high bar in evaluating the vendors it works with. “We don’t think of our vendors as just vendors,” he says. “The people who are our vendors are our partners. We want them to feel that they are part of the solution and we are part of their solution.” Gordon recently spoke with Healthcare Informatics about Virtua’s use of hosted solutions and how it evaluates vendors that house its data.
- Conduct a thorough vetting process. Before entering into an agreement for a hosted solution, Virtua requires the vendor to fill out an extensive questionnaire covering issues such as data divorce, auditing, encryption, and audits. “Sometimes it requires conversations, but then we know we have our bases covered,” he says.
- Make best practices a two-way street. Gordon notes that Virtua “always follows best practices and acts in good faith,” and expects the same from vendor partners that have hosted solutions. “If you work with vendors that understand HIPAA [Health Insurance Portability and Accountability Act] and HITECH [Health Information Technology for Economic and Clinical Health] Act, and the responsibilities around business associate agreements, you are in a good place,” he says.
- Have an iron-clad contract. Make sure that vendors of hosted solutions have redundant disaster recovery and production data backup solutions, with the ability to replicate data, Gordon advises. He adds that when Virtua draws up contracts with its vendors, it looks to assign penalties around unplanned downtime. “We are looking to get 99.99 percent uptime,” he says, with monetary penalties attached to anything below that specified in the contract. He adds that contracts should prohibit overseas hosting of data.
- Consult with other areas of the organization regarding data storage decisions. Gordon says that Virtua began its “digital journey” in 2006, when it set a goal to become a paperless organization. (He now describes Virtua as “paper lite.”) At that time it also set up key councils to help make decisions around data. The IT department still leads those decisions, but also consults with the health information management department (HIM), as well as a privacy and security committee, with representatives from IT, HIM, legal, risk management, and clinicians, he says.
While Virtua’s work with the “private” cloud in the form of vendor-hosted solutions has helped the organization meet its data storage requirements, it is also strategizing around data storage in its own data center. Those data volumes are growing rapidly. It operates its own health information exchange (HIE), which uses a solution provided by Alere, Waltham, Mass. The HIE is clocking about a million transactions a month, but the data are hosted in Virtua’s data center, he says. Clinical data at Virtua are growing at a rate of 70 percent year over year.
To help manage that kind of growth, Virtua is in the early stages of an information lifecycle management (ILM) project to define the types of business and clinical data it houses and to store it appropriately, while complying with regulatory requirements for retention of clinical data. “Having that 70-percent year over year growth, it’s very expensive to maintain storage,” Gordon says. “We are looking to start ILM to find some efficiencies within our data center for record retention.”