Security, disaster concerns don’t evaporate in the cloud

After years of chatter, health systems are finally loosening the reins and moving some—but not all—of their data to servers off-site, sometimes miles away and maintained by today’s biggest tech giants.

In other words: to the cloud.

What was once considered a risky move, plagued by fears over privacy, security and reliability, now shows no signs of slowing down. An average 39% of information technology workloads are already deployed in the cloud among healthcare organizations, according to a survey of healthcare leaders and staff conducted by HIMSS Media last year. Respondents said they expected that proportion to rise to about 50% of workloads, on average, over the next year.

Cris Ross, chief information officer at the Mayo Clinic in Rochester, Minn., said the system’s desire to “find more flexible, powerful environments” for its data and computing led it to begin migrating more data to the cloud. That included a 10-year contract with Google Cloud, which involves both data storage and innovation projects.

“What we discovered in the last couple of years is that the major cloud vendors were beginning to develop specific tools tuned to healthcare” to help manage data, Ross said.

Mayo isn’t alone. Healthcare organizations are increasingly turning to the cloud as a space for innovation efforts, rather than seeing it as just another data center. That’s because cloud providers tend to offer advanced tools for analytics and artificial intelligence, as well as a pricing model that allows organizations to add—and subsequently cut—server space as needed.

Storing data in the cloud can also be a boon for research collaborations. St. Jude Children’s Research Hospital in Memphis, Tenn., in 2018 launched the St. Jude Cloud, a public database of pediatric cancer genomics data that it lets researchers from across the globe access.

But healthcare still lags behind other industries when it comes to cloud adoption.

“Healthcare is definitely behind, but we have to take into consideration the sensitivity of data,” said Prem Somasundaram, principal of healthcare consulting at Perficient. “There’s a lot of data security concerns, and that slows them down (in cloud adoption) compared to other industries.”

Migrating data to the cloud has become a growing area of focus for healthcare organizations, with roughly 46% of respondents citing it as a high or critical strategic priority, according to the HIMSS Media survey.

John Kravitz, Geisinger Health’s CIO and chair of the College of Healthcare Information Management Executives’ board of trustees, in January cited cloud migration as one of his top 2020 priorities for CHIME. “We had a lot of discussions from CHIME with healthcare CEOs, and they stressed that some of the concerns they had were the agility of their IT teams to be able to spin up new systems when necessary, and also the cost transparency” the cloud can offer, Kravitz said. “That really drove our strategy.”

A shift to the cloud can involve different levels of computing services—the primary three being software-as-a-service, platform-as-a-service and infrastructure-as-a-service—and hospitals might be at different points of adoption in each. Altogether, the global healthcare cloud computing market last year hit an estimated $23.4 billion, according to a report from market research firm MarketsandMarkets, and it’s projected to reach $51.9 billion by 2024.

Adoption of software-as-a-service products, such as electronic health record systems hosted off-site in the EHR developer’s cloud, has been underway for years, but fully moving data centers to the cloud on an infrastructure-as-a-service basis is just getting started, experts say.

Beth Israel Deaconess Medical Center is moving most of its applications to the cloud. It began looking into cloud migration about three years ago because the lease on the space it rented for its own data center was running out. “It’s going to give us more than a platform for storage,” said Manu Tandon, the hospital’s CIO. “The cloud is almost like an ecosystem,” he added. “You get access to a lot of innovative platforms.”

Since then, the Boston teaching hospital has migrated more than half of what it plans to move to the cloud, such as its enterprise resource planning systems, and AI and machine learning environments. The hospital’s EHR is on deck to be migrated soon, too.

“We’re in the process of migrating what we can to the cloud from our data center,” Tandon said. Not everything’s a good fit for the cloud; Beth Israel Deaconess doesn’t plan to move images from its picture archiving and communication system out of a concern there’d be a lag in response time when radiologists are trying to download images.

But while the cloud offers opportunities, there are still concerns about protecting the data stored there, chiefly when it comes to disaster recovery, cybersecurity and choosing cloud partners. Having at least a backup data center in a separate location cuts down on the risk of environmental damage, with an organization’s data less likely to be impacted by an event experienced on-site, said Robert Tennant, the Medical Group Management Association’s director of health IT policy.

If you have backup systems in the same location, they’re “incredibly vulnerable to environmental damage,” Tennant said. “What if we had a fire? What if we had a flood? What if we had a theft of our computers?”

Holding data in the cloud doesn’t eliminate risk. Dexcom, a developer of continuous glucose monitoring systems for diabetes patients, suffered a malfunction in a cloud server late last year—creating an outage of the service’s “Follow” feature, which lets users share their blood sugar readings with caregivers, such as parents. That meant a large number of caregivers weren’t able to receive alerts about changes in the user’s glucose levels.

In a statement after the incident, Dexcom CEO Kevin Sayer said the company was reviewing its system architecture and operational support to try to prevent similar problems in the future.

That type of unexpected, off-site outage is something healthcare organizations need to prepare for, too. Getting ready for a cloud-based system failure follows the same principles as for those on-premises, said Joel Thimsen, principal of cloud consulting at Perficient. Backup data centers can be on-premises or in the cloud, but should be geographically dispersed to avoid all sites going down in the case of, say, a natural disaster. There’s also the question of how many backups an organization needs.

Depending on how critical a particular system is for an organization’s operations, healthcare leaders should ask themselves: “Are two data centers, one on the West Coast and the East Coast, enough?” suggested Steve Wretling, chief technology and innovation officer at the Healthcare Information and Management Systems Society. “Or are you willing to pay for a third and fourth site?”

Legacy Health in Portland, Ore., opted to move the disaster recovery site for its EHR system to the cloud in December 2018, while keeping its on-premises data center for daily use. That helped with the geographic diversity of its data. Before, the primary data center and disaster recovery site were only about six blocks apart.

“So if it was a fire, we’re fine—if it was a seismic event, we’d be toast,” said John Kenagy, the system’s CIO. There’s also a cost component. Since cloud vendors tend to only charge customers for systems actively being used, Legacy can turn off portions of its backup cloud servers on a day-to-day basis, and start them up if disaster strikes.

Moving disaster recovery sites to the cloud can provide an estimated 30% to 60% cost savings, according to Eric Foote, a managing director at consulting firm Deloitte.

Even a few years ago, cybersecurity was one of the top worries healthcare leaders cited for not wanting to move to the cloud, said Adam Seyb, a director in consulting firm West Monroe Partners’ healthcare practice. Now, they tend to see cybersecurity as one of cloud’s main benefits.

Improved cybersecurity was one of the reasons Mayo began migrating applications and data to the cloud, Ross said. He described cybersecurity in the cloud as composed of two components: protecting the data held in the cloud and protecting the data center.

That second piece is where Mayo sees a strong benefit in the cloud. “The security of the actual data center itself is an area where we have a lot of confidence that the cloud environments are more secure than what we can do on- premises,” he said. Cloud vendors can “invest 10 to 100 times what I can spend on security. At its root, those environments are going to be more secure.”

Cloud providers certainly offer some cybersecurity benefits, but it’s on the customer to set up and turn on these tools where they’re needed.

Healthcare organizations should be wary of how their agreements with cloud vendors are structured, because that first bucket—protecting the data held in the cloud—tends to stay their responsibility. That means, for example, that a hospital is likely still responsible for configuring how users access data held in a cloud server.

That’s not small potatoes. In 2018 and 2019, an estimated 33 billion records across industries were exposed via misconfigured cloud servers, with 20% of them in healthcare, according to cybersecurity firm DivvyCloud.

Tandon said one of the first steps he took when migrating applications to the cloud at Beth Israel Deaconess was making sure staff didn’t fall into a false sense of security, thinking that the cloud was more secure just because the vendor—Amazon Web Services—had more resources.

Healthcare organizations need to understand what their cloud providers agreed to support—because they’re responsible for everything beyond that. “One of the biggest problems I see is a misunderstanding or confusion about what exactly is the responsibility of the cloud provider, and what’s the responsibility of the tenants using the cloud,” said Jon Moore, chief risk officer at Clearwater Compliance, a cybersecurity risk management company.

There’s also a growing concern over who’s running the cloud infrastructure on which healthcare organizations are moving their data. It’s primarily tech giants like Amazon, Google and Microsoft Corp. that have been embroiled in controversy over data privacy—or lack thereof—in the consumer world.

“Healthcare systems have hundreds and hundreds of business associate agreements, and they don’t always disclose—or typically don’t disclose—who those vendors are,” said West Monroe’s Seyb. “But when you talk about the Amazons and the Googles of the world, it certainly has a different feel, from a patient standpoint.”

That tension came to a head last fall, when details emerged about a partnership between Ascension and Google, drawing public concern over patient privacy and sparking a federal probe. The St. Louis-based hospital giant and Google have said that their work, which includes a contract to move Ascension’s patient data to Google Cloud, complies with HIPAA, as Google signed a business associate agreement. A move to the cloud will help Ascension manage large datasets “needed to improve and consistently deliver high-quality care for our patients,” a system spokesperson wrote in an emailed statement.

“The data resident in that cloud environment is controlled, managed and audited by Ascension,” the spokesperson wrote. “In this secure environment, we are developing applications (our own and those co-developed with technology partners) that are customized to support the delivery of high-quality care.”

The partnership captured the attention of lawmakers, too. Last week Sens. Elizabeth Warren (D-Mass.), Richard Blumenthal (D-Conn.) and Bill Cassidy (R-La.) pushed Ascension to share more details, after deeming a reply to  an initial inquiry from Google inadequate.

Setting up strong boundaries on what a cloud vendor is able to see—and, for data the vendor can access, clearly outlining what that information can be used for—is a fundamental first step when partnering with a cloud vendor, said Nate Ulery, managing director in West Monroe’s technology practice.

For Legacy Health, that meant setting up a “rigorous contract” with Microsoft to delineate what the company could access, before migrating applications to the Microsoft Azure cloud computing service, Kenagy said. “They see the servers,” Kenagy said of Microsoft. “They can’t see or copy the data.”

Healthcare organizations should also think about whether to share information about their cloud deals with patients, and if so, how to educate patients about the agreement. That’s something Mayo prioritized when striking its contract with Google, according to Ross.

“We’ve tried to be very public about our relationship with Google,” which the system announced in September, Ross said. “We wanted to be clear with our patients and others what we were doing.”

Google isn’t Mayo’s only cloud vendor; Ross said the organization will continue to work with companies like Microsoft and IBM, too. For Ross, cloud computing is just the next phase of innovating with data—at Mayo, that traces back more than a hundred years to when the system rolled out its first standardized medical record, albeit a paper-based one.

“When they invented that record form in 1907, they anticipated that the data would not just be used to treat that patient, but we would also extract insights out of that data that would help us advance healthcare,” Ross said. “Here we are, 113 years later, and we’re doing the same thing—it’s just that we’re doing it at a much larger scale with a lot more data.”