Security and Other ChallengesBy Bob Violino | Posted 06-08-2009
Virtualization Delivers on Health Records Project
See also: 10 Reasons to Build Your Own Cloud.
Delivering electronic health records (EHR) to physicians and patients securely and efficiently can be a challenging proposition for health-care facilities. So can implementing virtualization in the data center. Beth Israel Deaconess Medical Center in Boston undertook both endeavors at the same time.
The medical center recently implemented the VMware server virtualization platform from VMware Inc. as part of an effort to deliver EHR to more than 200 independent physician practices throughout Massachusetts via a software-as-a-service (SaaS) offering. Beth Israel Deaconess is providing EHR to physicians through its Beth Israel Deaconess Physician Organization (BIDPO), which provides a variety of services to support hundreds of independently owned member physician practices.
Among the keys to the project's success were careful planning to address challenges, and the use of expert help when needed. The SaaS delivery solution was designed by Beth Israel Deaconess with help from Concordant, a provider of consulting and managed services for the health-care industry. Concordant fully deployed the virtualization software and also provides ongoing help desk and system management services for BIDPO.
The project is geared toward physician practices that are associated with Beth Israel Deaconess but not owned by the medical center, says Bill Gillis, manager of clinical application services at Beth Israel Deaconess. "Because they are not owned, it was apparent at the start that the EHR SaaS would not be placed in the medical center's IT environment," he says. Placing it in a central facility "provided us with flexibility and dynamic mobility to change the direction of the project as we needed."
With records now available via SaaS, participating physicians don't need to deploy any hardware in their practices. Beth Israel Deaconess, in turn, doesn't need to provide physicians with ongoing, on-site technical support, Gillis says.
The medical center has seen other benefits to both SaaS and virtualization. The SaaS offering allows Beth Israel Deaconess to provide EHRs to physician practices at an affordable cost, Gillis says. Server virtualization is expected to generate ongoing operational savings for BIDPO.
"We've saved substantial dollars not only in hardware, but also in other costs such as data center rack space," Gillis says. "By consolidating our servers, we've been able to keep our data center footprint as small as possible, saving us considerable monthly recurring costs."
Another benefit is related to disaster recovery. "We had a very fixed budget for the entire project," Gillis says. "While a fully replicated and synchronized hot site would be great for [disaster recovery], we where limited by budgetary constraints. Utilizing VMware, we're able to provide a non-hardware specific recovery in the event of a lost building-type disaster."
Security and Other Challenges
Implementing virtualization and SaaS was a big job. One of the most significant challenges was providing adequate security to safeguard the sensitive medical records.
"Security is always a challenge in the health-care environment," Gillis says. "Medical records are closely regulated by state and federal law." The medical center had to consider security in terms of its data center, at the physician practice level, for the EHR application, over the network, and for various interfaces.
Beth Israel brought in VMware partner Third Brigade, a security software company that specializes in server and application protection for data centers, to help. "We created a best practices defense-in-depth security architecture, knowing that we were going to be putting patient data on the Internet," Gillis says. "We created a multi-layer security protocol, including various perimeter devices-- from firewalls to network-based intrusion detection systems.
Another challenge was convincing the EHR vendor Beth Israel Deaconess uses that the application would support visualization via VMware. The EHR vendor's previous experience with other virtualization software showed that the technology was too unstable for a clinical platform, Gillis says. "However, VMware brought the right pieces to the table and delivered on the promise of seamless integration," he says.
Among the key steps in deploying the technologies, Gillis says, were understanding the end-user requirements up front, envisioning the delivery model, implementing EHR in a way that truly transforms the practices' experience, and building an affordable, supportable and sustainable model moving forward.
"We have a core team made up of technical, application/implementation and EHR vendor staff," Gillis says. "Every facet of the team had a hand in the planning and process. I'd say this approach held true for all of the vendors associated with the project as well. We really worked toward a true partnership with everyone involved. It's been a real-world example of true collaboration."