Is it Time to Get Your EHR System Out of the Data Center?
Over the last few years, a recurring theme in conversations with hospital and health system CIOs has emerged: they continuously share they want to get out of the “data center business.” What exactly does that entail? As noted in a recent whitepaper from the Naperville, Ill.-based consulting firm Impact Advisors, “Historically the vast majority of EHR [electronic health record] systems have been deployed within healthcare organizations’ data centers and are maintained by internal resources. Today’s technology advancements and disruptive business models provide organizations with multiple infrastructure hosting options that should be considered before an EHR implementation or upgrade.”
The paper’s authors added that for CIOs and other key clinical IT decision makers in patient care organizations, “Proper and timely due diligence is very important, as infrastructure procurement and deployment is time consuming and potentially disruptive to the operation. Whether planning for the initial implementation of a new EHR or preparing for a major upgrade of an existing EHR, organizations should begin identifying options well in advance. Currently available options include on-premise hosting, vendor hosting or third-party hosting services provided by an established cloud vendor.”
Erik Gerard, principal at Impact Advisors, recently spoke with Healthcare Innovation about the latest developments in this area, why there is a need for change in EHR hosting, and key decision criteria for CIOs. Below are excerpts of that discussion.
Can you explain the historical context of EHR hosting, and the traditional approaches that hospital and health system CIOs have generally favored?
I first got involved with healthcare technology about 20 years ago when I was a senior systems engineer at Cleveland Clinic. Back then, your options were very limited; you were on-premise and you were hosting [the EHR] in your own data center. That was the standard capability at the time. So the challenge is that you're now having to invest billions of dollars in in servers, routers and switches, and a whole bunch of other infrastructure to support that. It wasn't until a number of years later that some of the EHR vendors started offering to host [the technology] in their data center, so then all you'd have to do is have good connectivity to their data center to make it work.
How has EHR hosting recently evolved and what have been the drivers for that change?
I just had a conversation a couple months ago with some folks at Epic. They were a bit late to the hosting [game], but they now offer hosting in their data center and they have a backup data center they use. They have more than 65 clients that are hosting, but the number that really stood out to me was when they told me that 70 percent of their new clients are electing to be hosted as opposed to hosting themselves on-premise. I think that’s a huge shift compared to what we saw a few years ago; 70 percent of their new customers are going to the hosted solution and that’s a significant difference.
There are some very strong drivers behind this, not the least of which are the cost and maintenance of the infrastructure. When you're hosting an EHR, typically most of the EHR vendors have some sort of incentive program for you to maintain your equipment at a level of currency that might be a bit more aggressive than you would otherwise. So for example, when you're buying servers and switches and things like that for your IT infrastructure, the typical lifespan on a server is about five years. But the EHR vendors are asking you to have a three-year life cycle so that they always have the latest and greatest hardware available. What happens is that they typically build in more and more capabilities into each software upgrade. With your Microsoft Office, for example, it has many more capabilities now than 10 years ago. It’s the same thing with the EHR, and that draws on additional computing and storage resources. So what [vendors] have done is say, OK, if you replace your equipment every three years, we'll give you a discount because our software is going to look better and perform better for you. But that causes a huge challenge for most organizations because the cost of refreshing that infrastructure is extremely expensive. So the ability to get that out of your data center and hand it off to somebody else for a fee is very appealing for a lot of organizations.
The cloud has been around for quite a while, but healthcare has been slow to adopt the cloud. When people look for an alternative to hosting on-premise or hosting at the EHR vendor, where they can still retain a higher level of control, and/or create more integration capabilities for a digital strategy, let’s say—then the cloud is where they have to be. We have a lot of clients right now who are focusing on a digital strategy; the healthcare marketplace is becoming very competitive and there's a tremendous amount of consolidation. So in order to get mindshare and market share, many organizations are relying on digital strategy to allow better engagement with their patients through phone apps, and web interfaces and things like that where they can handle their care, and make their appointments, etc.
The best way to do that is to leverage cloud capability. If you have your EHR data in the cloud, then adding these additional bolt-ons becomes much easier because you now you can build that out in that same cloud and you don't have to pay for data transmission between your cloud and some other source. The challenge is that there are very few vendors that offer cloud-based services. And the challenge you'd have with a lot of the EHR vendors is that will only host their EHR; they won’t in any way support any of your ancillary applications in your data center that you may want to bolt-on. So that becomes a limitation, because now you have your EHR data at their data center, but you want to be able to have a digital strategy that allows you to access that. Why would you want to replicate that data if you can just have a single source of truth? Understandably, if I am an EHR vendor I'm not going to want to take on the responsibility to support one of my customer’s non-EHR applications in my data center, because the cost of that is going to be prohibitive and the support of that will be challenging. So the question then then gets to be, where do you find a cloud vendor that has the capability of supporting both your EHR and your bolt-on application?
It’s fascinating how different organizations have different priorities for what they're looking for. For some, it is strictly about the money. What does this cost me, and how does that compare to the cost of hosting on-premise at an EHR vendor versus a cloud vendor? Another key factor that people should take into consideration is, do I want a managed service out of my cloud vendor? When you host on-premise, you're managing the database, you're managing the application, and you're managing the infrastructure. When you go to an EHR vendor such as Epic or Cerner, or somebody who's hosting for you, they are managing the application in the database and those components for you. It lightens the load for your resource and technology knowledge within the organization because it's a managed service. There are other organizations that want to retain full control, so they purchase infrastructure as a service from a cloud vendor, and handle it and manage it [themselves]. Honestly, right now, of the half-dozen cloud vendors that we have investigated and analyzed, few have a mature service offering.
What are the important security elements that clinical IT executives need to be aware of here?
Obviously, everybody feels most comfortable with their applications residing in their own data center. Right now, there is a concerted attack by outsiders on healthcare organizations’ infrastructure, to the point where the FBI and other federal agencies have gotten involved. So, security within your own data center is no longer a guarantee. Conversely, if you are relying on a hosting vendor, whether it’s an EHR vendor or a cloud vendor, you want to make sure you understand what their capabilities are, what their skillsets are, and what their track record is for this. If you are going to leverage a cloud vendor, and let’s say you are going to use infrastructure-as-a-service with a cloud vendor, then you need to consider that cloud as an extension of your own data center, and handle the security just as if you would if it were sitting in your own data center. I think one of the biggest misunderstandings [with the] cloud by its own by its very nature of being in the cloud is secure. That's not the case.
The nice thing is that most cloud vendors have really robust and really good security tools. In many cases, [those tools] are probably better than what you have in your own data center. But you [still must] apply those tools and use them appropriately; you need the same level of due diligence in the cloud as you would in your own data center.
How do you see this area continuing to evolve in the near- to medium-term?
For the last five years, I can't tell you how many CIOs I have worked with that have flat-out said they want to get out of the data center business. I think the challenge for many of them is that it’s very expensive. They want to focus on healthcare delivery, and they want to focus on [partnerships] to deliver better healthcare and better engagement with their customers and patients. So I think more and more organizations are going to reconsider where they host their services. Right now, cloud is a growing market segment compared to on-premise, [but] it’s still behind EHR vendor hosting.
If you look at it, as the population ages and younger population now has more of a need for healthcare, everybody's used to doing things on their phones; so if I can't communicate with your doctors and I can't check my lab results on my phone, you're going to be slowly put out of business. Having that digital strategy, and the ability to access information that is easily attainable for your patients, will be critical, and I think a lot of that solution sits in the cloud. Now, doing so in a mindful manner is key, and that [means] making sure that the organization asks the right questions and determines what's most important to them. The future state will be out of the data center one way or another.
