Risk and Reward in the Cloud

In the regulatory arena, she advises healthcare providers to make sure that cloud vendors are able to comply with state privacy laws, which vary greatly from state to state. Hospitals have to comply with the state laws, where the patient lives, she notes. “Hospitals located in resort areas or offering a specialty may treat many patients from out of state, and must comply with many different laws. You have to make sure your cloud vendor is capable of doing that,” she says.

TESTING THE WATERS

Despite the litany of precautions, the cloud is making inroads with healthcare organizations.

Scott MacLean, deputy CIO of Partners Healthcare in Boston, says his organization is taking a cautious approach to the cloud. “Like most healthcare customers, we are intrigued by it, but we haven’t moved anything to the public cloud” yet, he says. Partners has one major cloud-based application in revenue cycle management that is hosted at the vendor site (Siemens Healthcare, Malvern, Pa.), which he describes as a private, corporate hosting arrangement; as well as software-as-a-service applications, with appropriate business associate agreements, at the departmental level, he says.

In MacLean’s view, the decision to move to the public cloud depends on three factors: cost, flexibility, and security. He adds that Partners recently did an analysis of using the public cloud for disaster recovery and concluded that, based on its concerns about price and security, the health system did not want to pursue it at this time. But he adds: “We do feel that, in the next couple of years, there will be applications where we can come to an agreement with a [cloud] provider to use that.” Those applications will likely be non-clinical, he says.

“Putting PHI [protected health information] on the cloud is not something we are ready for,” he says. “There is not a level of remediation with a [cloud vendor] if we have an incident. They are not going to get the black eye in healthcare; it’s going to be us.”

Scott MacLean

Johns Hopkins Medicine is using the cloud for enterprise-wide imaging. James F. Philbin, Ph.D., is co-founder and chief technical officer of Peake Healthcare Innovations, a joint venture between Johns Hopkins Medicine and Harris Healthcare Solutions, Melbourne, Fla. Prior to co-founding Peake, Philbin, who is a computer scientist, was senior director of medical imaging informatics for John Hopkins Medicine.

Peake was formed to provide a cloud-based solution for managing and sharing images across any enterprise, Philbin explains. The PeakeSecure solution is first being implemented at Johns Hopkins Medicine; Hopkins has been expanding its imaging archive for the last six years, part of a strategy to store images from all the hospital system’s medical specialties in a single replicated archive and make them available to all clinicians using the same viewer, he explains.

As the Hopkins system expanded from three to six hospitals, it began to receive more transfers of complicated cases from community hospitals, Philbin says. “We wanted to get an aggregated imaging record that included all of the ‘ologies’ across all of the hospitals and all of the outpatient centers, and make them quickly available wherever they were needed,” he says. “Because of remote visualization, we can do that more effectively from the cloud than we can by solely using thin clients or workstations.”

James F. Philbin, Ph.D.

Working through Peake, Hopkins is rolling out the imaging archive for two hospitals as a private cloud in its own data centers. The goal is to expand it to the remaining hospitals during the next year, Philbin says. Peake is in the process of transitioning the imaging archive to public data centers, and is close to signing an agreement with a third-party cloud vendor, he says. Peake, which presently stores three copies of each image in two of Hopkins’ own data centers, will move the third copy of the image to the public cloud, with Peake having oversight over hardware, software, and security. The applications will have the ability to fail over to the other data center, providing good reliability, he says.