Considerations for Medical Practices Shopping for Cloud-based EHRs

Cloud computing - that lofty-sounding term that conjures visions of pillow-like, white puffs in a baby-blue sky - is a great option for small practices moving to an EHR. Requiring only an Internet connection, a cloud-based EHR allows practices to access, store, and transmit data without worrying about shelling out big bucks for second servers or other heavy hardware parts.

But before practices take the leap into the skies, there are multiple considerations they need to take into account.

During a Thursday morning session at the HIMSS12 Conference in Las Vegas, Melissa Markey, a shareholder with law firm Hall, Render, Killian, Heath & Lyman, and Margaret Marchak, the associate vice president and deputy general counsel for the University of Michigan, gave attendees an earful of these considerations.

For starters, security should be top of mind.

A practice’s data is still at risk even if it is not within reach. Remote data centers, which store a practice’s EHR data, are not foolproof from data breaches. And the consequences of a data breach, which include government fines, state attorney general lawsuits, and reputational harm, are steeper than ever.

“We’re seeing more class action suits,” said Marchak.

Practices should make sure to ask vendors the following question, first and foremost: Where is your data?

“It’s hard to tell you when you’re using your cloud exactly where your data is,” said Markey. “Some of the algorithms used for transmitting and storing bounce around. So you may be dealing with international transfers of data unintentionally and you may be subject to some international laws.”

And some of those data security laws, such as those passed recently in Europe, Mexico, and India, may be more stringent than the ones in the United States, said Markey.

Next, practices should take their time in picking the right vendor, and check out competitive offerings in the market.

“The first thing you need to consider is that moving to the cloud is not an easy decision,” said Markey. “This is a relationship. This is not something that is short and quick and easy to deal with. You’re going to be living together for a long time.”

Initial factors to consider in choosing the right partner should be:

• What type of cloud service you want. A public cloud has many advantages, but it also has “flat operational characteristics,” says Markey. Public cloud vendors don’t like to negotiate contracts. And while a private cloud offers more flexibility, it may be more expensive. “It’s great but you don’t get utilities or efficiencies of scale,” she added.

• Capitalization. “You need someone who’s got the financial wherewithal to stay with you long-term,” said Markey.

• Whether they are established. A vendor’s reputation and how established they are in the marketplace may indicate their staying power. So the length of time they are in business should be top of mind. “Look at insurance and whether they have any recoverable assets in case they go down the tubes,” she added.

Next, there are a few things practices should consider when it comes to contract negotiations.

When it comes to service-level agreements (SLAs), “they need to be more than just a penalty and a way to get your money back,” said Markey. “You want computing power, availability. Make SLAs a means of managing and controlling performance.”

Consider that many physicians aren’t comfortable with not being able to get their data when they need it. And find out how many users a vendor can handle on the system at the same time.

Markey said practices should also ask, “How quickly can you [provide] extra bandwidth to me?” So if, for example, there is a tornado, you could access all your data relatively quickly.

“What’s becoming increasingly important is your clinical team,” said Markey. “They’re going to have to use it.”