While cloud-based tools may present financial and usability benefits for healthcare organizations, depending on cloud computing infrastructure can pose significant risks to business operations.
In a Dec. 4 op-ed for Health Affairs, William Gordon, MD, clinical informaticist at Boston-based Brigham and Women's Hospital and Mass General Brigham; Aneesh Chopra, president of CareJourney; and Adam Landman, MD, vice president and chief information and digital officer at Brigham Health; highlighted these risks and offered mitigation strategies.
Four risks with depending on cloud computing infrastructure:
1. Issues with the software on the vendor's end will immediately affect users. For example, during Microsoft Office 365's downtime in September, healthcare organizations using tools including Outlook email and Teams may have had delays in communicating about patient care issues.
2. Transitioning to cloud-based services centralizes risk; if a large regional data center experiences connectivity issues, numerous hospitals could be impacted simultaneously as a result. Certain downtime protocols, such as diverting ambulances to other hospitals, will become less of an option if several other locations in the area are experiencing similar issues.
3. Healthcare organizations lose control of the software lifecycle when software operations are switched to external management. The vendor plans updates according to their schedules and these affect customers all at once, so software may stop working or suddenly change without warning.
4. Internet access can be fragile, and disconnection can limit critical operations at a practice. For example, a satellite ambulatory health center that provides ambulatory visits, day surgery and lab and imaging services may be connected to the internet through a fiber connection to an internet service provider. If that fiber line is somehow damaged by road construction or another factor, the organization could be cut off from the internet and left unable to access its EHR.
One critical way to mitigate some of the risks is by adopting business continuity plans, the co-authors wrote. With increased telehealth and remote workforce, continuity planning must focus on both the hospital and the community.
"Today, 'downtime procedures' are focused on the hospital environment," they wrote. "We are creating plans for community-based internet downtime, such as reserving in-person capacity in our buildings that rely on more robust corporate networks. We have also implemented procedures for reverting to phone calls if virtual care visits are unavailable."