• Overview
• Health Care
• Cloud Computing
• IT Strategy
• Unified Communications

Healthcare IT Trends: Cloud Computing and Compliance

In 2010, it is hard to find an industry more in the midst of an IT revolution than healthcare. There are a number of healthcare IT trends to follow; but this article will focus on only two: an old favorite, compliance, and a new favorite, cloud computing.

The Health Information Technology for Economic and Clinical Health (HITECH) Act has a lot of words and does a lot of things. But, in terms of healthcare compliance, let's consider the ways in which it makes HIPAA a bit more ornery.

Enforcement: Most people in healthcare agree that HIPAA has not been rigorously enforced. But, although words will never hurt us, in HITECH, new language is meant to make us take notice. "Willful Neglect" is introduced. Though a subjective term, it is assumed to mean that Covered Entities that have a cavalier attitude about HIPAA now take-on an even higher risk. Civil penalties for willful neglect rise to $250,000 and to $1.5 million for repeat violations. State Attorneys General can now bring actions on behalf of State residents. But, if you're more concerned with sticks and stones, HHS is now required to conduct periodic audits of Covered Entities.

Breach Notification: Many States, including Maine, have data breach notification laws. HITECH imposes similar rules specifically on healthcare Covered Entities. The Act requires that Covered Entities notify patients if there is an unauthorized use or disclosure of the patient's "unsecured PHI." If a breach impacts 500 patients or more, the covered entity must notify HHS. HHS will post the name of the Covered Entity on its website. Under certain conditions, local media must also be notified. HHS has yet to define "unsecured PHI." But, most assume unsecured PHI means PHI that is not encrypted. Data encryption may be a Covered Entity's get out of jail free card.

Business Associates: Before HITECH, certain HIPAA Privacy and Security requirements were indirectly imposed on Business Associates through a contract, a Business Associate Agreement. Now, HITECH directly imposes HIPAA Security requirements on Business Associates. In addition to compliance with HIPAA Security, Business Associates must report security breaches to Covered Entities and may be directly subject to HIPAA civil and criminal penalties. Life as a Business Associate has become more challenging. It is even more important for Covered Entities to put their Business Associate partners on notice.

The technology industry often feels cold and overly logical. But every so often, an IT engineer's natural zest for romance molds a confusing concept like Internet Infrastructure into a more poetic mystery, Cloud Computing. Though equally confusing, doesn't Cloud Computing sound more intriguing?

Cloud computing is computing using the increasing web of computers connected by the Internet. The cloud metaphor suggests that if you could step back and look up, you would see a vapor of computer connections and data, rising up and condensing in a cloud of information in the sky. It's an okay metaphor, but to keep it simple, just consider that you compute in the cloud every time you use the Internet to connect to your bank account.

In practical terms, cloud computing means that organizations no longer need to have their own servers, networks, or even data, stored locally, in their own building, in their own server room, or perhaps more accurately, in the old broom closet down the hall. Organizations can store their data in their vendor's building and server room and simply use the Internet to access the information they need when they need it. This will not only free up the old broom closet, it will also free up the old budget.

Think of cloud computing as a technology co-op. Instead of everyone buying their own network, servers, and software, organizations can share technology, and the cost of implementing and maintaining it, with their peers.

Imagine an Electronic Medical Record (EMR) co-op. According to the Certification Commission for Healthcare Information Technology (CCHIT), there are several hundred vendors that currently offer some form of EMR in the cloud. The EMR vendor hosts and manages the software and technology infrastructure; while your organization and other healthcare organizations all over the world pay a fee to use the application. You access the application through an Internet connection. In addition to providing the software as a service, the EMR vendor protects your individual data and likely provides a host of value added services.

Cloud computing has plenty of advantages:

• Cost may be reduced and capital expenditures are converted to operational expenditures.
• Users can access applications using a web browser regardless of their location.
• Data is managed off-site which makes it suitable for business continuity and disaster recovery.
• Security is often better because vendors can spend more money, resources, and time on security. Also, HITECH makes most healthcare vendors offering cloud computing Business Associates that must live up to HIPAA Security standards.

Most applications are moving to the cloud. At some point, your organization will have to make a financial decision: Do you invest up front, build your local computing infrastructure, and keep your data local; or do you amortize your investment over recurring monthly charges and keep everything, including your data, "in the cloud?"