The Cloud and it's impact on Health IT

From Clinfowiki
Revision as of 04:41, 26 April 2016 by Gener (Talk | contribs)

Jump to: navigation, search

Cloud based services have exploded in recent years and many consumer services run on large cloud infrastructures hosted by companies such as Google and Amazon. Many consumers don’t realize how much of the internet runs on cloud services until there is an interruption of service. This article examines the fundamental cloud infrastructure characteristics and how Health IT can be transformed using the different service models available in the industry today.

Fundamental cloud infrastructure characteristics

Although many providers claim to be cloud based, it’s important to apply a common set of characteristics to evaluate their claims. According to the National Institute of Standards and Technology, five essential elements need to be kept in mind: (1)

On-demand self service: This enables a user to sign up for services automatically (email accounts, server computing capacity, storage space etc.) without requiring human intervention.

Broad network access: Services should be available over the internet by a variety of network capable devices (phones, tablets, laptops etc).

Resource pooling: The service provider shares resources in order to effectively serve multiple customers and these could be physical or virtual: the customer generally does not have visibility to how this is managed and the complexity is abstracted away.

Rapid elasticity: Services can be elastically scaled up or down to meet variable demand.

Measured service: Cloud service providers should be able to provide granular control and reporting of services consumed in an appropriate metric (e.g gigabytes for storage, users accounts for email) and provide this transparency to the customer.

The “As a Service” Alphabet Soup

In addition to the characteristics mentioned above, cloud services can also be modeled based on the level of abstraction and control a customer has to the infrastructure.

Software As a Service (SaaS): The lowest level of control is the SaaS model where an application is entirely provided as a cloud service and a customer has very little transparency to the underlying infrastructure. Salesforce.com and Gmail.com are good examples of this consumption model. Although a certain level of customization is possible, the service provider largely assumes the role of maintaining the environment and assumes all the data privacy and security risks.

Platform as a Service (PaaS): At the next level of control is PaaS where a customer can deploy their own application in a service provider's infrastructure. The service provider is responsible for the core programming language tools, middleware applications (like databases) in order to support development of the customer’s application. Risk is shared in this instance as the provider is only responsible for maintaining the platform components and the customer is ultimately responsible for the design and functionality of their application. The Amazon Elastic Beanstalk is a good example of the PaaS model.

Infrastructure as a Service (IaaS): At the highest level of control (and lowest level of abstraction) lies the IaaS model where a customer can consume the basic building blocks of computing power: servers, storage and networking. This model provides the greatest flexibility and carries the greatest risk, as the customer has to carefully design, secure, and backup their cloud infrastructure. With the rapid commoditization of this service model, many providers have scaled back commitments around service level agreements (SLAs) for reliability and redundancy. A good example of this is the Amazon EC2 service.

Reliability

Current cloud services are thought to be very reliable. Some of the largest current cloud providers (Microsoft, Google, and Amazon) have service level agreements that guarantee at least 99.9% availability.(2,3) Of note, an uptime of 99.95% still results in over 4 hours of systems unavailability each year.(4) Overall, the industry average is reported to be 99.948% (273 minutes of downtime yearly).(5) Potential strategies to minimize downtime include dedication of specific hardware clusters to critical tasks and/or scaling cloud application performance depending on available resources.(6) Given the critical nature of clinical information systems in supporting patient care, it is vital to minimize workflow disruptions in the healthcare delivery environment.

Health IT and the Cloud Transformation

Healthcare has traditionally lagged in the technology domain and cloud computing is no exception. However, for a healthcare system grappling with the challenges of higher quality, better patient outcomes and lower costs, cloud computing is a transformative technology that can help in these areas: (5–9)

Cost Savings: Cloud technology potentially provides a cheaper Electronic Health Record (EHR) alternative for healthcare organizations (e.g., small to medium sized hospitals and clinics) that cannot afford the substantial information technology investment and support staff needed for most EHR implementations. Savings can be derived not only from reducing initial hardware capital requirements but also from a multitude of other sources. For example, cloud vendors (and not clients) deal with costs associated with infrastructure security, maintenance, upgrades, support, and storage. Economies of scale are created secondary to hardware and software elasticity. Extraneous hardware normally required for handling peak resource loads and also for backup purposes (having redundant data stored in multiple locations) can be eliminated. Both power waste and incomplete utilization from idle machines can be significantly reduced. Studies show that on average only 15-20% of available resources are being used at most data centers. From a software perspective, cloud vendor handling of licensing requirements can eliminate the need to purchase and maintain software licenses for individual users.

Electronic Health Records: Several providers have cloud based solutions that can completely bypass the traditional onsite deployment model for software. These provide the benefits of reduced implementation time, lower capital expenditure and better scalability. Athenahealth and Practice Fusion are good examples of a SaaS based EHR solution.

Office productivity: Moving email, file and document sharing and office applications to the cloud have huge advantages over traditional licensed software models. Microsoft’s Office 365 solution is a great example of a legacy software provider recognizing the market need for SaaS as an option to customers looking to minimize their CAPEX in this space.

Backup and archiving: With strict regulations around retaining patient related information, the cloud becomes a cost effective alternative to scaling up internal storage. Image archiving to the cloud has especially gained popularity in recent years as it results in substantial cost savings when compared to scaling up an internal PACS solution

Health Information Exchange (HIE): HIEs are an ideal application for cloud computing as they are generally too cost prohibitive to be built internally and requires cooperation from a number of organizations to function. A full interoperability cloud based EHR has the potential to collect and organize data from multiple independent systems and organize it in a clinically useful view. In comparison, implementing and maintaining point-to-point interfaces for standalone health information systems can be expensive and time consuming. Guaranteeing network security, privacy, and unbiased connectivity are all critically important in the Health Information Exchange cloud model.

Analytics and Research: Many smaller healthcare and research entities do not have the computing or data storage capabilities needed to process, collect, or maintain large datasets such as genomic information. Cloud technology can help manage “Big Data” through its scalable infrastructure and more abundant computing resources. Due to advanced cloud connectivity capabilities, clinical data stored in the cloud as a whole may be more complete across both time and different healthcare settings. By analyzing this data, researchers and clinicians can potentially have a better real-time understanding of population health without having to meticulously gather heterogeneous data from multiple sources. Important health trends such as prescription drug diversion, epidemics, or bioterrorism can theoretically be identified and acted upon before they become large scale issues. Ideally, data analytics within the cloud can also be utilized to extract meaningful clinical research information with regards to effective healthcare practices, delivery models, treatments, and costs.

Disadvantages of Cloud Computing

Lack of Control and Service Variability: Cloud computing offers a trade-off between convenience and control. Due to hardware virtualization and lack of consumer auditing capabilities, day to day cloud system performance may become inconsistent.(10) Some cloud vendors may also try to trim costs by providing older or outdated computer architecture on the back-end.(10) More importantly, cloud architecture is extremely reliant on the ability to transfer large quantities of data. Network downtime or bandwidth limitations may serve as other factors limiting the performance of cloud systems.(10) Maintaining adequate network connectivity particularly in rural areas remains a significant concern. For these reasons, disaster recovery and downtime procedures must be carefully planned for prior to cloud implementation. Daily workflow needs to be thoroughly analyzed in order to identify those systems, applications, and data that are the most critical. The amount of allowed cloud downtime before executing backup systems is another important factor that needs to be considered.(5) Unfortunately, specific policies related to downtime support and disaster recovery tend to be cursory in many cloud provider service level agreements.(5)

Transfer of Services: The lack of interoperability between cloud vendors remains a significant source of worry in the event of provider discontinuation or suspension of services. Healthcare facilities may find it difficult to transfer services and data to another cloud provider or back in-house in the event of a service stoppage.(5,10) Before signing any cloud vendor agreement, consumers need to pay special attention to service termination stipulations, data/service migration assistance options, and flexible data transfer/access rights.(5)

Security Risks: The nature of cloud computing architecture necessitates stringent data security policies. The implementation of the IEC 80001 standard stipulates that the risks associated with incorporating medical devices into healthcare networks lie with healthcare providers (and not with information technology or hardware vendors).(7) Improper control of medical devices may compromise patient data integrity.(5) Like any information system, cloud systems are vulnerable to hackers, encryption failure, computer viruses, and end-user abuse of privileges.(10) In addition, because assets are shared in a cloud environment, special precautions are needed for separation of information. Unauthorized access to protected health information can occur through software design flaws or inadequate deletion of data from shared hardware resources.(10)

Legal Considerations: Cloud data can hypothetically be stored in hardware spread worldwide and across multiple legal jurisdictions. Many healthcare institutions have comprehensive policies regarding local management of data. Yet most lack corresponding rules pertaining to third party (cloud) data storage.(8) The HIPAA/HITECH Act provides only a basic outline for adequate healthcare information governance in the context of cloud computing.(11) Existing regulatory, compliance, intellectual property/ownership, and data jurisdiction laws do not completely cover all the necessary legal considerations associated with this newer technology.(8,10,11)Fortunately, several organizations have recognized these limitations and have provided various cloud-applicable security and regulatory guidelines/standards.(11) Examples include the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Control Objectives for Information and Related Technology (COBIT), the National Institute of Standards and International Organization for Standardization (ISO).(11)

Current State of Adoption

As of 2011: Despite Meaningful Use incentives to move towards electronic healthcare information systems, there are still significant barriers hindering the further adoption of cloud technology.(8,12) Healthcare professionals desire easy, quick, and ubiquitous connectivity to access healthcare information. There has also been a growing desire from patients to be able to access and track their own medical histories.(8) Despite these motivating factors, society and its laws mandate that health information is kept secure and confidential. Significant criminal penalties and fines exist in the event of transgression. For these reasons, the majority of healthcare cloud computing is currently limited to non-protected health information storage, provider communication tools, and personal health records.(6,12) Reservations remain particularly in larger healthcare institutions (where resources are more abundant and there may be less incentive for cloud adoption) with regards to commitment towards cloud applications.(12) Two large surveys have estimated that between 32-55% of healthcare organizations are already using some form of cloud computing and between 58-75% are strongly considering cloud adoption within the near future.(6,12) However, the current healthcare and legislative environments stress the need for privacy over increased access to healthcare information.(8) Legal considerations and trust issues remain significant impediments toward full adoption of healthcare cloud computing.(8,10)

Related Articles

Using a Cloud-based Electronic Health RecordDuring Disaster Response: A Case Study inFukushima, March 2011

References

1. Mell P, Grance T. The NIST definition of cloud computing [Internet]. 2011. Available from: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

2. Microsoft and Google: Is 99.9% Cloud Uptime Good Enough for Partners | Public Cloud content from Talkin’ Cloud [Internet]. Available from: http://talkincloud.com/microsoft-and-google-is-99-9-cloud-uptime-good-enough-for-partners

3. Amazon EC2 SLA [Internet]. Available from: http://aws.amazon.com/ec2/sla/

4. 99.999% uptime vs 99.9% uptime: the difference two extra “nines” makes | Intermedia [Internet]. Available from: http://blog.intermedia.net/2014/01/28/99-999-uptime-vs-99-9-uptime-the-difference-two-extra-nines-makes/

5. Impact of Cloud Computing on Healthcare [Internet]. Cloud Standards Customer Council; 2012. Available from: http://www.cloudstandardscustomercouncil.org/cscchealthcare110512.pdf

6. Ahuja SP, Mani S, Zambrano J. A Survey of the State of Cloud Computing in Healthcare. Netw Commun Technol [Internet]. 2012 Sep 19;1(2). Available from: http://www.ccsenet.org/journal/index.php/nct/article/view/19240

7. Kabachinski J. What’s the Forecast for Cloud Computing in Healthcare? Biomed Instrum Technol. 2011 Mar 15;45(2):146–50.

8. Osterhaus L. Cloud Computing and Health Information. U SLIS J [Internet]. 2010; Available from: http://ir.uiowa.edu/bsides/19

9. The Cloud Computing Guide for Healthcare [Internet]. Focus Research; 2012. Available from: http://smb.blob.core.windows.net/smbproduction/Content/Microsoft_Cloud_Healthcare_Guide.pdf

10. Kuo AM-H. Opportunities and Challenges of Cloud Computing to Improve Health Care Services. J Med Internet Res. 2011 Sep 21;13(3):e67.

11. Delgado M. The Evolution of Health Care IT: Are Current U.S. Privacy Policies Ready for the Clouds? IEEE; 2011. p. 371–8. Available from: http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6012698

12. Terry K. Cloud computing in healthcare: the question is not if, but when [Internet]. Available from: http://www.fiercehealthit.com/story/cloud-computing-healthcare-question-not-if-when/2012-01-09

Submitted by Edwin Sequeira

Updated by Joseph C. Hung, M.D. (10/19/2014)