Risk and Reward in the Cloud

Scott MacLean, deputy CIO of Partners Healthcare in Boston, says his organization is taking a cautious approach to the cloud. “Like most healthcare customers, we are intrigued by it, but we haven’t moved anything to the public cloud” yet, he says. Partners has one major cloud-based application in revenue cycle management that is hosted at the vendor site (Siemens Healthcare, Malvern, Pa.), which he describes as a private, corporate hosting arrangement; as well as software-as-a-service applications, with appropriate business associate agreements, at the departmental level, he says.

In MacLean’s view, the decision to move to the public cloud depends on three factors: cost, flexibility, and security. He adds that Partners recently did an analysis of using the public cloud for disaster recovery and concluded that, based on its concerns about price and security, the health system did not want to pursue it at this time. But he adds: “We do feel that, in the next couple of years, there will be applications where we can come to an agreement with a [cloud] provider to use that.” Those applications will likely be non-clinical, he says.

“Putting PHI [protected health information] on the cloud is not something we are ready for,” he says. “There is not a level of remediation with a [cloud vendor] if we have an incident. They are not going to get the black eye in healthcare; it’s going to be us.”

Scott MacLean

Johns Hopkins Medicine is using the cloud for enterprise-wide imaging. James F. Philbin, Ph.D., is co-founder and chief technical officer of Peake Healthcare Innovations, a joint venture between Johns Hopkins Medicine and Harris Healthcare Solutions, Melbourne, Fla. Prior to co-founding Peake, Philbin, who is a computer scientist, was senior director of medical imaging informatics for John Hopkins Medicine.

Peake was formed to provide a cloud-based solution for managing and sharing images across any enterprise, Philbin explains. The PeakeSecure solution is first being implemented at Johns Hopkins Medicine; Hopkins has been expanding its imaging archive for the last six years, part of a strategy to store images from all the hospital system’s medical specialties in a single replicated archive and make them available to all clinicians using the same viewer, he explains.

As the Hopkins system expanded from three to six hospitals, it began to receive more transfers of complicated cases from community hospitals, Philbin says. “We wanted to get an aggregated imaging record that included all of the ‘ologies’ across all of the hospitals and all of the outpatient centers, and make them quickly available wherever they were needed,” he says. “Because of remote visualization, we can do that more effectively from the cloud than we can by solely using thin clients or workstations.”

James F. Philbin, Ph.D.

Working through Peake, Hopkins is rolling out the imaging archive for two hospitals as a private cloud in its own data centers. The goal is to expand it to the remaining hospitals during the next year, Philbin says. Peake is in the process of transitioning the imaging archive to public data centers, and is close to signing an agreement with a third-party cloud vendor, he says. Peake, which presently stores three copies of each image in two of Hopkins’ own data centers, will move the third copy of the image to the public cloud, with Peake having oversight over hardware, software, and security. The applications will have the ability to fail over to the other data center, providing good reliability, he says.

“We explicitly designed our cloud as a medical cloud to handle the needs of medical information,” Philbin says. By law, images have to be kept for seven years, even though they get accessed less over time. Peake stores the images on hard disk, which spin down when the images are not being accessed, saving cost and energy use, Philbin says. Image data is encrypted at rest—as they are sitting on disk or in a file—so even if someone penetrated the data center, they wouldn’t necessarily be able to view patient data, Philbin says. The imaging data resides in the cloud, not on the desktop. “From a HIPAA point of view, it’s much more secure,” he says.

He adds that Peake is establishing partnerships with PACS vendors to build virtual “machines” to take advantage of its infrastructure that provides a vendor-neutral archive, while also providing choices of the best systems to healthcare facilities.

Philbin is very enthusiastic about the cloud. “From my experience running imaging archives across hospitals, I realized that the cloud could be leveraged in a way that could significantly improve access to images,” he says.

Looking over the longer term as the cloud gains traction across more applications, he sees the cloud’s real value as an aggregated medical record that can lead to better patient care across providers; as well as an important research opportunity, providing aggregated medical records for large patient populations. “I think the cloud will not only save money and improve care, but provide research breakthroughs in the next five years that we would never be able to do without aggregating that information,” he says.