Hospitals, faced with growing amounts of electronic records and digital images, would seem a good fit for cloud storage services -- but security and other concerns compel health care providers to proceed with caution. One reason for reticence: the government's pursuit of monetary penalties for health care data breaches.
Cloud storage services let customers park data at a service provider that takes on the chore of minding data for a monthly fee. Customers accustomed to buying new file servers or storage devices as data volumes grow can step off that purchasing treadmill. They can also avoid power and cooling expenses and the cost of adding staff to manage storage.
A number of service providers now offer cloud storage for enterprises. Those include Amazon Web Services LLC, with its Simple Storage Service (S3), Nirvanix Inc. and Cloud Files from Rackspace Inc. Meanwhile, providers such as Dropbox Inc. are more consumer-oriented but are edging into cloud storage services for business use.
Also in the mix are cloud gateway vendors whose products let customers extend their in-house storage to external cloud resources. Vendors in that space include Nasuni Corp. and TwinStrata Inc.
Vendors believe storage headaches eventually will overcome the fear of letting data leave the building. "There is always a balance of pain versus risk in a sector adopting a certain technology," said Andres Rodriguez, founder and CEO of Nasuni.
An evolutionary path toward cloud storage services
A hospital's first foray into cloud storage will likely involve moving archival data to a storage services provider, according to industry executives. That initial stage of adoption can help health care facilities with the challenge of keeping data accessible over the long haul, said Rodriguez, noting that hospital personnel might want to go back 10 to 15 years to access records.
Over that time span, an in-house storage operation would need to transfer data from old or failed devices to new storage systems. However, he said, the cloud removes that burden from hospital IT departments. "You don't have to migrate data from one system to the next-generation system."
That archival scenario represents the lowest risk from a retrieval standpoint, according to John Underhill, director of IT infrastructure at Inova Health System. He said an organization may be willing to accept a few minutes or longer to retrieve archival data.
Mike Garzone, chief technology officer for the U.S. health delivery sector at Computer Sciences Corp. (CSC), an IT services company, described using the cloud to archive medical images as a good use case. That approach pulls together images from multiple modalities, providing a centralized storage and retrieval capability. In addition, cloud storage can improve disaster recovery when compared to maintaining copies of images in a data center across town, he added.
In addition, Garzone suggested that test environments could also serve as a health care entity's first step into the cloud, since a hospital prototyping a system could run a virtual machine and associated storage in the cloud.
Once health care facilities become comfortable with their early cloud experience, Rodriguez said they will likely move primary storage to service providers "It's a nice transition," he said.
Cloud storage security assurances necessary
To reach such a level of comfort, hospitals need security assurances. Rodriguez said health care entities should verify a provider's cloud storage security and compliance guarantees, citing both HIPAA and the Statement on Auditing Standards No. 70 (SAS 70) as key considerations.
For their part, cloud vendors pursue various audits and compliance standards.
For example, Practice Fusion Inc., which offers cloud-based electronic health record (EHR) systems, has gone through a SAS 70 Type II audit. The company also undergoes semi-annual security audits conducted by a third-party vendor and is Payment Card Industry (PCI) compliance, according to Matt Douglass, vice president of engineering. "That is about the most stringent data center compliance there is right now beyond SAS 70," he said.
But compliance involves some nuances. Regarding HIPAA, Underhill said health care organizations should require cloud storage providers to host data within the United States. Hosting data outside the U.S. calls into question whether the law can be enforced. The cloud providers Underhill has spoken to will comply with U.S.-only hosting upon request.
Providers interested in, but wary of, cloud storage services
Inova Health, a not-for-profit health care provider in Northern Virginia, is in the preliminary stages of examining cloud storage. Underhill cited security as an issue, saying that the concern goes beyond protecting personal health information. "Security isn't just about confidentiality; it is also the integrity and availability of information."
Bandwidth requirements present another consideration. Bandwidth to an external service provider can prove rather costly, Underhill said, adding that relying on the Internet raises the question of how quickly the hospital can retrieve information at a time of high utilization.
Intermountain Healthcare, a system of 23 hospitals based in Salt Lake City, finds itself in a similar situation. A spokesman said Intermountain likes the direction of cloud storage, but hasn't settled on a strategy.
Still other hospital systems are backing off cloud storage. A spokesman for Geisinger Health System, which serves central and northeastern Pennsylvania, said the organization isn't currently using cloud storage, citing security, privacy and performance as its biggest concerns.
New York City Health and Hospitals Corp., which runs 11 acute care hospitals and other health facilities, is also staying off the cloud.
"Because of our responsibility to patient privacy, at present we do not use cloud storage to store patient records and do not have any plans to so," said Evelyn Hernandez, director of media relations for the integrated health care delivery system.
Cloud economics, I think, resonate particularly with people dealing with large, unstructured objects and files.
Steve Zivanic, vice president of marketing, Nirvanix
Nasuni's Rodriguez acknowledged hesitance in health care. On the other hand, he said, life sciences companies are a bit more willing to move to the cloud. "Life science is slightly ahead of health care because the regulatory environment there for research data can be a little more forgiving."
Early adopters reaping cloud storage benefits
A few health care providers have overcome the sector's general cloud hesitance.
Rodriguez has encountered the greatest level of activity among mid-sized hospitals and imaging facilities serving regional hospitals. "Their business has never been IT. They can't afford the staffing requirements to run the storage systems," he said.
While Nasuni has yet to see cloud storage demand among large health care providers, Nirvanix has. Steve Zivanic, vice president of marketing at Nirvanix, said recent public cloud customers include a top health care system and an academic medical center.
"Cloud economics, I think, resonate particularly with people dealing with large, unstructured objects and files," Zivanic said.
Beyond hospitals and health systems, physician practices and medical students are also tapping cloud storage services.
Practices adopting cloud-hosted EHR systems get storage as part of the deal. Practice Fusion offers a free Web-based EHR that includes records storage and document management. The average practice consumes 50 to 55 GB of document storage per year and about 5 GB of structured medical chart data, Douglass said.
For those practices, Douglass said, cloud storage backup and security are better than what they could provide in-house. "Doctors' offices don’t have to worry about ... somebody walking in and picking up a stack of charts and walking away with it."
The motivation for medical students differs. For them, collaboration via cloud is key.
ChenLi Wang, team lead of business and sales operations for Dropbox, has seen uptake of the company's storage service among medical schools. Students, he said, use Dropbox to collaborate on papers and projects. Wang also noted adoption among pharmaceutical companies, which tap Dropbox to present marketing literature.
The involvement of medical students could seed future business opportunities, Wang suggested. "This is truly your early adopter/evangelist market segment."
John Moore is a Syracuse, N.Y.-based freelance writer covering health IT, managed services and cloud computing. Let us know what you think about the story; email firstname.lastname@example.org.