Healthcare is in the midst of an IT explosion. Big Data, telemedicine, and AI are all changing how patients receive care. This has made the healthcare industry a very lucrative market for cloud service providers to pursue. It can be difficult to break into though. You need to understand the unique challenges of that industry and how they affect their interest in ITaaS.<\/p>\n
Most hospitals and other healthcare organizations will see both operational and fiscal benefits migrating to cloud services. But the leadership in many of these orgs remain skeptical about utilizing third-party IT services given the heavy regulatory burden placed on electronic patient data. And the hefty fines that come with non-compliance.<\/p>\n
While healthcare IT can be complex, the key concepts you need to know all revolve around managing patient data. Let\u2019s take a look at 4 particular industry acronyms. Understanding them will give you a good handle on what matters most in healthcare IT. Once we\u2019ve covered those fundamentals we can discuss how to approach prospective customers in the industry.<\/p>\n
When it comes to helping healthcare businesses manage data, one thing matters above all else: Protected Health Information<\/strong>. PHI is the legal term for a broad range of individually-identifiable pieces of data collected during patient care and administration. It includes medical histories, lab results, patient demographic information, and insurance information.<\/p>\n ePHI is the acronym used for electronic (digital) PHI, and includes any PHI \u201cproduced, saved, transferred or received in an electronic form.\u201d ePHI is what\u2019s going to come up the most in conversations with customers.<\/p>\n In the US, the primary Federal law regulating how PHI must be handled is HIPAA.<\/p>\n This is the Health Insurance Portability and Accountability Act. Full details about HIPAA are available on the Health and Human Services website<\/a>. For our purposes, the two parts of HIPAA that matter most are the Security and Privacy Rules. The Security Rule describes measures that must be taken to prevent unauthorized access to PHI. The Privacy Rule describes how hospitals, insurance agencies, and other healthcare orgs are allowed to share and use PHI.<\/p>\n Notably, neither Rule dictates specific technologies or technical standards that must be applied. That\u2019s left to healthcare orgs or their IT service providers. More on this point under the HITRUST<\/strong> section below.<\/p>\n The stakes are high for maintaining HIPAA compliance. Penalties for non-compliance, namely patient data breaches, regularly climb into the millions of dollars. In fact, 2018 was a record-breaking year for HIPAA fines, with a total of $23.5 million-worth handed out. The single largest penalty, $3 million, was given to California-based Cottage Health<\/a> for two breaches that occurred in 2013 and 2015.<\/p>\n Under HIPAA, any organization that handles PHI to conduct business is a \u201ccovered entity\u201d that is bound to abide by the Security and Privacy Rules. If you work with a customer who\u2019s a covered entity you\u2019ll be required to sign a HIPAA Business Associate Agreement to manage and administer ePHI on their behalf.<\/p>\n The HHS site has a wealth of resources, including a sample BAA<\/a> you can use if you\u2019re working with a healthcare org that doesn\u2019t have one handy.<\/p>\n If you work with Canadian customers the relevant national law is PIPEDA<\/a>, the Personal Information Protection and Electronic Documents Act. This carries similar security and privacy provisions to HIPAA, but it\u2019s important to know that it permits greater control at the provincial level, whereas US states are all equally bound by the Federal regulations in HIPAA. The Office of the Privacy Commissioner of Canada website has details on all provincial variations<\/a>. Of note, all Canadian provinces, with the exception of British Columbia and Nova Scotia, allow health data to reside in the United States. Which is useful to know when determining which IT resources are viable.<\/p>\n These are Electronic Health Records, some of the most sensitive ePHI that you can be asked to work with. EHRs hold a patient\u2019s entire medical history, including diagnoses, medications, radiology images, immunization records, and test results. One defining feature of EHRs is that they\u2019re designed to be easily shareable between healthcare providers, such as between a general practitioner and a specialist, or a private practice and a pharmacy. This means EHRs will need to be easily, but securely, accessed by all involved providers.<\/p>\n EHRs are critical to the performance of modern healthcare, and also possibly the most challenging to properly manage. Fortunately there is guidance available.<\/p>\n One of the main forms of guidance is the HITRUST Common Security Framework<\/a>. This is a \u201cprescriptive set of controls\u201d for complying with HIPAA and also other major regulations. This framework gives Partners and covered entities actual technical guidance they can implement. The CSF is designed to be very adaptable. It sets baseline controls, but leaves room for entities to customize security measures, or develop alternatives, based on their specific size and organizational type.<\/p>\n One of the main platforms that Sherweb Partners can leverage for healthcare customers is MS Azure<\/a>. While Azure environments aren\u2019t HIPAA\/PIPEDA-compliant \u2018out of the box,\u2019 it is fairly easy to provision them according to the HITRUST CSF using an Azure Blueprint<\/a>. \u00a0In many instances O365 and Microsoft Dynamics tenants can also be provisioned for healthcare orgs seeking HIPAA compliance.<\/p>\n When discussing cloud service options with healthcare customers there are some important points to make. Generally, these customers care most about:<\/p>\n These are all things that cloud services are generally designed to address. And here are some specific industry problems that might be pain points for your healthcare customers:<\/p>\n Final Thoughts<\/strong><\/p>\n We\u2019ve found that the best way to develop business with healthcare orgs is to fully embrace the role of \u2018Partner\u2019 and be a collaborator that helps them figure out which of their IT systems and infrastructure can safely be siloed outside of their own organization.<\/p>\n Healthcare businesses are also more likely to prefer being hands-on with their cloud-based services. Control matters a lot to them, and \u2018black box\u2019 IT services that other industries see as a convenience are scary to healthcare orgs.<\/p>\n Compliant IaaS options that you can help them build from the ground up are likely to be more attractive than either SaaS or PaaS offerings, since they can assert more of that control. Of course there will always be exceptions, but this is a good starting point when beginning talks with a healthcare prospect.<\/p>\n While healthcare IT is a complex field, and there are many things to be aware of, Sherweb Partners might be some of the best-positioned providers to enter the market.<\/p>\n Contact Sherweb\u2019s<\/em><\/a> cloud experts<\/em><\/a> to begin deployment of cloud solutions for your healthcare customers.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Healthcare is in the midst of an IT explosion. Big Data, telemedicine, and AI are all changing ho","protected":false},"author":177,"featured_media":19461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[752],"tags":[],"class_list":["post-19458","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-server"],"yoast_head":"\n2. HIPAA<\/strong><\/h2>\n
3. EHRs<\/strong><\/h2>\n
4. HITRUST CSF<\/strong><\/h2>\n
Talking Points & Take Aways<\/strong><\/h2>\n
\n
\n