The Cloud and it's impact on Health IT
Cloud based services have exploded in recent years and many consumer services run on large cloud infrastructures hosted by companies such as Google and Amazon. Many consumers don’t realize how much of the internet runs on cloud services until there is an interruption of service. This article examines the fundamental cloud infrastructure characteristics and how Health IT can be transformed using the different service models available in the industry today.
Fundamental cloud infrastructure characteristics
Although many providers claim to be cloud based, it’s important to apply a common set of characteristics to evaluate their claims. According to the National Institute of Standards and Technology, five essential elements need to be kept in mind:
(1) On-demand self service: This enables a user to sign up for services automatically (email accounts, server computing capacity, storage space etc.) without requiring human intervention.
(2) Broad network access: Services should be available over the internet by a variety of network capable devices (phones, tablets, laptops etc).
(3) Resource pooling: The service provider shares resources in order to effectively serve multiple customers and these could be physical or virtual: the customer generally does not have visibility to how this is managed and the complexity is abstracted away.
(4) Rapid elasticity: Services can be elastically scaled up or down to meet variable demand.
(5) Measured service: Cloud service providers should be able to provide granular control and reporting of services consumed in an appropriate metric (e.g gigabytes for storage, users accounts for email) and provide this transparency to the customer.
The “As a Service” Alphabet Soup
In addition to the characteristics mentioned above, cloud services can also be modeled based on the level of abstraction and control a customer has to the infrastructure.
Software as a Service (SaaS): The lowest level of control is the SaaS model where an application is entirely provided as a cloud service and a customer has very little transparency to the underlying infrastructure. Salesforce.com and Gmail.com are good examples of this consumption model. Although a certain level of customization is possible, the service provider largely assumes the role of maintaining the environment and assumes all the data privacy and security risks.
Platform as a Service (PaaS): At the next level of control is PaaS where a customer can deploy their own application in a service provider's infrastructure. The service provider is responsible for the core programming language tools, middleware applications (like databases) in order to support development of the customer’s application. Risk is shared in this instance as the provider is only responsible for maintaining the platform components and the customer is ultimately responsible for the design and functionality of their application. The Amazon Elastic Beanstalk is a good example of the PaaS model.
Infrastructure as a Service (IaaS): At the highest level of control (and lowest level of abstraction) lies the IaaS model where a customer can consume the basic building blocks of computing power: servers, storage and networking. This model provides the greatest flexibility and carries the greatest risk, as the customer has to carefully design, secure, and backup their cloud infrastructure. With the rapid commoditization of this service model, many providers have scaled back commitments around service level agreements (SLAs) for reliability and redundancy. A good example of this is the Amazon EC2 service.
Current cloud services are thought to be very reliable. Some of the largest current cloud providers (Microsoft, Google, and Amazon) have service level agreements that guarantee at least 99.9% availability.(2,3) Of note, an uptime of 99.95% still results in over 4 hours of systems unavailability each year.(4) Overall, the industry average is reported to be 99.948% (273 minutes of downtime yearly).(5) Potential strategies to minimize downtime include dedication of specific hardware clusters to critical tasks and/or scaling cloud application performance depending on available resources.(6) Given the critical nature of clinical information systems in supporting patient care, it is vital to minimize workflow disruptions in the healthcare delivery environment.
Health IT and the Cloud Transformation
Healthcare has traditionally lagged in the technology domain and cloud computing is no exception. However, for a healthcare system grappling with the challenges of higher quality, better patient outcomes and lower costs, cloud computing is a transformative technology that can help in these areas: (5–9)
Cost Savings: Cloud technology potentially provides a cheaper Electronic Health Record (EHR) alternative for healthcare organizations (e.g., small to medium sized hospitals and clinics) that cannot afford the substantial information technology investment and support staff needed for most EHR implementations. Savings can be derived not only from reducing initial hardware capital requirements but also from a multitude of other sources. For example, cloud vendors (and not clients) deal with costs associated with infrastructure security, maintenance, upgrades, support, and storage. Economies of scale are created secondary to hardware and software elasticity. Extraneous hardware normally required for handling peak resource loads and also for backup purposes (having redundant data stored in multiple locations) can be eliminated. Both power waste and incomplete utilization from idle machines can be significantly reduced. Studies show that on average only 15-20% of available resources are being used at most data centers. From a software perspective, cloud vendor handling of licensing requirements can eliminate the need to purchase and maintain software licenses for individual users.
Electronic Health Records: Several providers have cloud based solutions that can completely bypass the traditional onsite deployment model for software. These provide the benefits of reduced implementation time, lower capital expenditure and better scalability. Athenahealth and Practice Fusion are good examples of a SaaS based EHR solution.
Office productivity: Moving email, file and document sharing and office applications to the cloud have huge advantages over traditional licensed software models. Microsoft’s Office 365 solution is a great example of a legacy software provider recognizing the market need for SaaS as an option to customers looking to minimize their CAPEX in this space.
Backup and archiving: With strict regulations around retaining patient related information, the cloud becomes a cost effective alternative to scaling up internal storage. Image archiving to the cloud has especially gained popularity in recent years as it results in substantial cost savings when compared to scaling up an internal PACS solution
Health Information Exchange (HIE): HIEs are an ideal application for cloud computing as they are generally too cost prohibitive to be built internally and requires cooperation from a number of organizations to function. A full interoperability cloud based EHR has the potential to collect and organize data from multiple independent systems and organize it in a clinically useful view. In comparison, implementing and maintaining point-to-point interfaces for standalone health information systems can be expensive and time consuming. Guaranteeing network security, privacy, and unbiased connectivity are all critically important in the Health Information Exchange cloud model.
Analytics and Research: Many smaller healthcare and research entities do not have the computing or data storage capabilities needed to process, collect, or maintain large datasets such as genomic information. Cloud technology can help manage “Big Data” through its scalable infrastructure and more abundant computing resources. Due to advanced cloud connectivity capabilities, clinical data stored in the cloud as a whole may be more complete across both time and different healthcare settings. By analyzing this data, researchers and clinicians can potentially have a better real-time understanding of population health without having to meticulously gather heterogeneous data from multiple sources. Important health trends such as prescription drug diversion, epidemics, or bioterrorism can theoretically be identified and acted upon before they become large scale issues. Ideally, data analytics within the cloud can also be utilized to extract meaningful clinical research information with regards to effective healthcare practices, delivery models, treatments, and costs.
Disadvantages of Cloud Computing
Lack of Control and Service Variability: Cloud computing offers a trade-off between convenience and control. Due to hardware virtualization and lack of consumer auditing capabilities, day to day cloud system performance may become inconsistent.(10) Some cloud vendors may also try to trim costs by providing older or outdated computer architecture on the back-end.(10) More importantly, cloud architecture is extremely reliant on the ability to transfer large quantities of data. Network downtime or bandwidth limitations may serve as other factors limiting the performance of cloud systems.(10) Maintaining adequate network connectivity particularly in rural areas remains a significant concern. For these reasons, disaster recovery and downtime procedures must be carefully planned for prior to cloud implementation. Daily workflow needs to be thoroughly analyzed in order to identify those systems, applications, and data that are the most critical. The amount of allowed cloud downtime before executing backup systems is another important factor that needs to be considered.(5) Unfortunately, specific policies related to downtime support and disaster recovery tend to be cursory in many cloud provider service level agreements.(5)
Transfer of Services: The lack of interoperability between cloud vendors remains a significant source of worry in the event of provider discontinuation or suspension of services. Healthcare facilities may find it difficult to transfer services and data to another cloud provider or back in-house in the event of a service stoppage.(5,10) Before signing any cloud vendor agreement, consumers need to pay special attention to service termination stipulations, data/service migration assistance options, and flexible data transfer/access rights.(5)
Security Risks: The nature of cloud computing architecture necessitates stringent data security policies. The implementation of the IEC 80001 standard stipulates that the risks associated with incorporating medical devices into healthcare networks lie with healthcare providers (and not with information technology or hardware vendors).(7) Improper control of medical devices may compromise patient data integrity.(5) Like any information system, cloud systems are vulnerable to hackers, encryption failure, computer viruses, and end-user abuse of privileges.(10) In addition, because assets are shared in a cloud environment, special precautions are needed for separation of information. Unauthorized access to protected health information can occur through software design flaws or inadequate deletion of data from shared hardware resources.(10)
Legal Considerations: Cloud data can hypothetically be stored in hardware spread worldwide and across multiple legal jurisdictions. Many healthcare institutions have comprehensive policies regarding local management of data. Yet most lack corresponding rules pertaining to third party (cloud) data storage.(8) The HIPAA/HITECH Act provides only a basic outline for adequate healthcare information governance in the context of cloud computing.(11) Existing regulatory, compliance, intellectual property/ownership, and data jurisdiction laws do not completely cover all the necessary legal considerations associated with this newer technology.(8,10,11)Fortunately, several organizations have recognized these limitations and have provided various cloud-applicable security and regulatory guidelines/standards.(11) Examples include the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Control Objectives for Information and Related Technology (COBIT), the National Institute of Standards and International Organization for Standardization (ISO).(11)
Current State of Adoption
Despite Meaningful Use incentives to move towards electronic healthcare information systems, there are still significant barriers hindering the further adoption of cloud technology.(8,12) Healthcare professionals desire easy, quick, and ubiquitous connectivity to access healthcare information. There has also been a growing desire from patients to be able to access and track their own medical histories.(8) Despite these motivating factors, society and its laws mandate that health information is kept secure and confidential. Significant criminal penalties and fines exist in the event of transgression. For these reasons, the majority of healthcare cloud computing is currently limited to non-protected health information storage, provider communication tools, and personal health records.(6,12) Reservations remain particularly in larger healthcare institutions (where resources are more abundant and there may be less incentive for cloud adoption) with regards to commitment towards cloud applications.(12) Two large surveys have estimated that between 32-55% of healthcare organizations are already using some form of cloud computing and between 58-75% are strongly considering cloud adoption within the near future.(6,12) However, the current healthcare and legislative environments stress the need for privacy over increased access to healthcare information.(8) Legal considerations and trust issues remain significant impediments toward full adoption of healthcare cloud computing.(8,10)
In 2014, the Health Information and Management Systems Society (HIMSS), conducted a survey for the adoption of cloud computing technology in healthcare provider organizations with the following results. A disclaimer by HIMSS states, "...the sample population of healthcare organizations not presently using cloud services is small. As such, the data should be considered as informational and not necessarily representative of the industry as a whole and should be used to promote conversation."(13) This survey was conducted from March 26 through April 30, 2014 via the web and included IT Executives from healthcare provider organizations. A total of 4,400 participants were invited and 150 of these participants responded to the survey, which is a 3.4% response rate. IT healthcare organizations currently using cloud services is 83%, intend to use cloud services is 9.3%, do not intend to use cloud services is 6%, and the remaining 2% do not know if their organization will adopt cloud services. The stratification of cloud services being used by IT healthcare organizations includes applications running on Software as a Service (SaaS) is 67%, Infrastructure as a Service (IaaS) is 15.3%, and Platform as a Service (PaaS) is 2.4%. The value IT healthcare organizations measure their adoption of cloud services includes improving technological capacity or capabilities is 48.2%, positively impacting financial metrics is 46.4%, and time to deployment is 44.6%.(13,14)
Future State of Adoption
In 2015, MarketsandMarkets' research study, "Healthcare Cloud Computing Market by Application(PACS, EMR, CPOE, RCM, Claims Management), by Deployment (Private, Public), by Services (SaaS, IaaS), by Pricing (Pay as you go), by End-User (Providers, Payers) - Analysis and Global Forecasts to 2020 ", reports that this market will grow to $9.48 Billion by 2020 compared with $3.73 Billion in 2015, a Compound Annual Growth Rate of 20.5% between for the reporting period from 2015 to 2020.(15)
1. Mell P, Grance T. The NIST definition of cloud computing [Internet]. 2011. Available from: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf
2. Microsoft and Google: Is 99.9% Cloud Uptime Good Enough for Partners | Public Cloud content from Talkin’ Cloud [Internet]. Available from: http://talkincloud.com/microsoft-and-google-is-99-9-cloud-uptime-good-enough-for-partners
3. Amazon EC2 SLA [Internet]. Available from: http://aws.amazon.com/ec2/sla/
4. 99.999% uptime vs 99.9% uptime: the difference two extra “nines” makes | Intermedia [Internet]. Available from: http://blog.intermedia.net/2014/01/28/99-999-uptime-vs-99-9-uptime-the-difference-two-extra-nines-makes/
5. Impact of Cloud Computing on Healthcare [Internet]. Cloud Standards Customer Council; 2012. Available from: http://www.cloudstandardscustomercouncil.org/cscchealthcare110512.pdf
6. Ahuja SP, Mani S, Zambrano J. A Survey of the State of Cloud Computing in Healthcare. Netw Commun Technol [Internet]. 2012 Sep 19;1(2). Available from: http://www.ccsenet.org/journal/index.php/nct/article/view/19240
7. Kabachinski J. What’s the Forecast for Cloud Computing in Healthcare? Biomed Instrum Technol. 2011 Mar 15;45(2):146–50.
8. Osterhaus L. Cloud Computing and Health Information. U SLIS J [Internet]. 2010; Available from: http://ir.uiowa.edu/bsides/19
9. The Cloud Computing Guide for Healthcare [Internet]. Focus Research; 2012. Available from: http://smb.blob.core.windows.net/smbproduction/Content/Microsoft_Cloud_Healthcare_Guide.pdf
10. Kuo AM-H. Opportunities and Challenges of Cloud Computing to Improve Health Care Services. J Med Internet Res. 2011 Sep 21;13(3):e67.
11. Delgado M. The Evolution of Health Care IT: Are Current U.S. Privacy Policies Ready for the Clouds? IEEE; 2011. p. 371–8. Available from: http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6012698
12. Terry K. Cloud computing in healthcare: the question is not if, but when [Internet]. Available from: http://www.fiercehealthit.com/story/cloud-computing-healthcare-question-not-if-when/2012-01-09
13. Lofstrom J. 2014 HIMSS Analytics Cloud Survey [Internet]. Chicago: Healthcare Information and Management Systems Society (HIMSS); 2014 [ updated 2016; cited 2016 Apr 26]. Available from: http://www.himss.org/library/healthcare-privacy-security/cloud-security/security-survey
14. Columbus L. 83% Of Healthcare Organizations Are Using Cloud-Based Apps Today [Internet]. [Place unknown]: Forbes; 2014 [updated 2016; cited 2016 Apr 26]. Available from: http://www.forbes.com/sites/louiscolumbus/2014/07/17/83-of-healthcare-organizations-are-using-cloud-based-apps-today/#6548f2e16502
15. Mr. Rohan. Healthcare Cloud Computing Market Worth $9.48 Billion by 2020 [Internet]. Dallas: PR Newswire Association LLC; 2015 [updated 2016; cited Apr 27]. Available from: http://www.prnewswire.com/news-releases/healthcare-cloud-computing-market-worth-948-billion-by-2020-511149251.html
Submitted by Edwin Sequeira
Updated by Joseph C. Hung, M.D. (10/19/2014)
Updated by Gene Ren, (04/27/2016)