Momentum grows to outsource hospital tech functions in 2021

Hospital executives are considering outsourcing more information technology services as a way to recoup losses and focus on core business functions in the wake of COVID-19, experts say.

By the end of 2020, the proportion of hospitals indicating interest in outsourcing had grown for 44 of 50 common clinical, financial and technology services when compared to before COVID-19, according to data from Black Book Research. The firm polled roughly 1,000 hospitals before the onset of the pandemic in February, and then again near the end of the year.

The six IT areas included in the survey all experienced an uptick in interest between February and November; none remained the same or experienced decreasing interest.

“Intention to (outsource) things that are primarily technology-associated really jumped,” said Doug Brown, Black Book’s founder and president.

That’s at least in part due to possible cost savings organizations could get from outsourcing. Hospitals in 2021 will have to work to replenish some of the revenue lost from low patient volumes in 2020, while also recognizing the need to invest in IT budgets to support virtual care, remote work and other innovations that spread during the pandemic.

That said, executives shouldn’t assume outsourcing will inherently be the most cost-effective option.

“Outsourcing is not something that’s always the cheapest option,” said Andrew Rebhan, expert partner for digital health intelligence at the Advisory Board. In fact, a larger health system might find it more cost effective to keep most of its IT management in-house, if it has the available staff and infrastructure, according to Rebhan.

Before deciding to outsource a service, Rebhan suggested hospitals conduct an audit of their current capabilities and how much it currently costs to run the intended service. That way, executives will know the baseline to compare possible contracts, as well as what specific metrics they’re aiming to improve.

But there are many reasons executives might consider outsourcing, aside from cost.

Some hospital executives hope to gain operational efficiencies by offloading ancillary business segments—like IT—to other companies. In theory, that allows for more time to focus on an organization’s core competencies, like how to provide high-quality patient care, improve clinical quality and manage operations.

“A lot of healthcare organizations—hospitals and health systems—are not in every instance going to have technology be an absolute core competency,” Rebhan said. By outsourcing, they’re acknowledging that “it’s not the case that we’re Amazon or Google,” he added.

Areas ripe for outsourcing are often “commodities” that aren’t significantly different from one organization to the next—meaning a hospital can often purchase it on a less expensive or more efficient basis from a company that sells that service to multiple groups at scale, said David Reitzel, national leader for healthcare IT at advisory firm Grant Thornton. Revenue cycle management is a hot area for outsourcing.

It’s usually easier for hospitals to outsource specialized technology services—such as cybersecurity, application development or creating graphics, three areas that all hospitals indicated they were considering in 2021, according to Black Book’s survey—rather than hiring staffers specifically for those skills or to complete short-term projects.

In those cases, outsourcing tends to supplement, rather than replace, in-house IT teams.

The COVID-19 pandemic has also shown organizations that they can operate without all employees working on-site—opening the door for thinking about different types of workforce arrangements.

“If people can work anywhere, does that mean I’m constrained to this group of people? Or can I look elsewhere?” Reitzel said. 

Below are snapshots of three areas that have captured particular attention from hospital executives interested in outsourcing this year.

It’s an understatement to say the healthcare industry was forced to grapple with cybersecurity last year. Cyberattacks against healthcare organizations spiked in 2020 alongside the COVID-19 pandemic, prompting the FBI, HHS and the Homeland Security Department to issue a joint warning that hackers were targeting healthcare with ransomware attacks.

So it’s no surprise that cybersecurity topped the list of services being assessed this year, with 100% of hospitals in Black Book’s survey considering outsourcing cybersecurity in 2021—a significant jump from Black Book’s earliest data in 2015, when just 16% of hospitals had done so.

Cyberattacks have only gotten more sophisticated in recent years, said Theresa Meadows, senior vice president and chief information officer at Cook Children’s Health Care System in Fort Worth, Texas.

“The challenge for us, across healthcare, is that a lot of our cybersecurity teams are really small,” Meadows said. “It really depends on the size of your organization, but most need additional help.”

Cook Children’s, like many hospitals, is using a mix of a small team of in-house staffers and outsourced services to tackle cybersecurity.

That has included outsourcing services such as monitoring the health system’s IT systems and conducting HIPAA risk assessments of possible business associates.

“There’s no way that we could staff enough people to run an operations center 24/7,” Meadows said. That would have required hiring an additional 10 or more cybersecurity staffers, all of whom would need salaries, benefits, training and ongoing education—not to mention the time it would take to recruit multiple workers with the right technical skills.

That’s in part because of a shortage of qualified cybersecurity workers.

Across industries in the U.S., there’s a workforce gap of roughly 360,000 cybersecurity professionals, according to a 2020 report from cybersecurity professional organization (ISC)². At health systems, specifically, it takes 70% longer to fill cybersecurity job openings compared with other IT jobs, according to a separate survey of HR executives from Black Book.

Because it’s difficult for hospitals to build cybersecurity programs capable of managing the range of threats they’re facing, it’s likely the healthcare industry will see an uptick in outsourcing as a way to fill in those gaps in 2021, according to Rebhan. Cybersecurity is “mission-critical” for patient safety, he added.

Some hospitals are even tapping companies for “virtual chief information security officers”—essentially outsourcing the role to consulting companies that assign a person or team to advise and manage information security at the organization.

It’s particularly difficult to recruit CISOs in healthcare, since hospitals are competing for executives against companies from other industries, Brown said.

A virtual CISO contracted from a company can be helpful for smaller organizations that don’t necessarily need a full-time executive in that role, Meadows said. “In the ideal world, the CISO would be somebody that you would employ and have on your staff full time,” she added, but not every organization has the budget to do so.

Cook Children’s, as a larger health system, employs its own CISO, Meadows said.

IT support services had one of the starkest rises when comparing the start of 2020 to year-end. Eighty-four percent of hospitals in February indicated they were considering or actively vetting a company to outsource IT support to in 2021—that figure jumped to 97% who expressed plans to do so in November, according to Black Book’s data.

But it’s not just the pandemic. Interest in outsourcing IT support has been steadily increasing for years.

In 2020, 81% of hospitals had already implemented or planned to implement outsourced IT support, up from 43% in 2019.

The growing proportion of hospitals outsourcing IT support has been helped in part by companies that develop hospitals’ core software systems—like electronic health record software—offering IT support services to their customers, according to Brown. That’s made tapping a company for IT support “more accessible,” he said.

CoxHealth in Springfield, Mo., outsourced its entire IT department to Cerner Corp. roughly eight years ago. That involved rebadging the health system’s more than 100 IT employees to the EHR vendor—meaning their employment was terminated at CoxHealth and transitioned to Cerner.

Since then, Cerner’s outsourcing business—ITWorks—has run CoxHealth’s IT infrastructure, including managing software and on-site servers.

For CoxHealth, a key benefit of outsourcing its IT was that the health system could request additional staffing support from the company as needed, rather than having a set number of employees.

On a daily basis, there’s about 160 IT workers employed by Cerner but working on-site at CoxHealth. The health system can add more employees from the company if needed, without having to do the leg work of searching for and recruiting a temporary staff member—something that proved particularly helpful during the COVID-19 pandemic.

“The work ebbs and flows,” said Cheryl Hertel, who holds a joint title as chief information officer at CoxHealth and a vice president at ITWorks responsible for CoxHealth’s information systems.

Still, there are more narrowly defined IT areas that hospitals can outsource, rather than handing off the entire IT department to a separate company.

Generally speaking, it’s easier to outsource areas further away from hospitals’ primary business of clinical care to outside companies—such as the help desk or IT service desk, experts say. It’s more difficult to outsource managing a core system, like the EHR itself.

“The more that an IT function is critical to a hospital, the less likely it is to be outsourced,” Rebhan said. “There’s naturally a hesitancy to loosen the grip on some of the core functions.”

Hospitals are continuing to migrate applications and data to the cloud—in other words, to servers managed by other companies off-site.

Roanoke, Va.-based Carilion Clinic is in the process of moving its data warehouse system used to aggregate and analyze data from on-premise data centers to the cloud. Executives expect migrating data warehousing to the cloud will save costs, since the health system will be able to cut down on the physical data center equipment on-site and be more flexible with the server space it purchases.

Carilion is working with multiple companies for cloud services, including Amazon and Microsoft Corp. And about 20% of Carilion’s application portfolio is managed on a software-as-a-service basis, which means a software company centrally hosts and manages applications that customers access via the internet, rather than the customer hosting the application on its own.

As Carilion continues migrating other systems to the cloud, executives are considering whether to outsource aspects of network engineering, security and other skills involved in managing the systems.

Rather than trying to recruit new employees in a competitive market, “we’re looking at managed services for those skills,” particularly for roles that are difficult to fill, said Keith Perry, Carilion’s senior vice president and CIO.

Ninety-three percent of hospitals are considering outsourcing IT infrastructure and data centers in 2021, and 96% are considering outsourcing database management and analytics. That’s up from 83% and 94% who expressed interest in doing so in February, respectively, according to Black Book.
 

Geisinger Health in Danville, Pa., is in the midst of doing a “deep evaluation” to determine which systems and data to move to the cloud, according to the system’s CIO, John Kravitz.

That’s in part to cut down on the cost involved in managing on-site data centers. To ensure an application hosted in an on-premises data center can run properly, a hospital often has to allocate storage capacity that’s not always used, according to Kravitz. That not only costs money to purchase the additional equipment, but also requires hiring personnel to manage it.

Cloud providers, on the other hand, tend to offer a pricing model that allows organizations to add and cut server space as needed.

Geisinger is “looking at all of our costs across the organization—data center costs, storage costs, network costs associated with that—and determining: Is there really a savings to be had by migrating to the cloud?” Kravitz said. “It sounds like it is, but we really want to validate and verify before we start a major initiative.”