7 Questions to Ask Before Moving Your Data to the Cloud

There are compelling reasons to move to the cloud for your practice management and electronic health records software, including the cloud vendors' economies of scale, reducing your capital equipment costs, leaving security and infrastructure to their specialized experts, and reducing -but not eliminating - your internal HIPAA compliance burden. The cloud makes sense in particular for small practices, eliminating the need to maintain internal IT infrastructure such as servers and storage area networks (SAN) and staffing adequate in-house expertise to manage these resources.

Of course the forecast for your cloud future isn't totally sunny. There are legitimate concerns about security, data ownership, vendor lock-in, and the viability of your cloud vendor. These concerns most likely are shared by other practices, and generally they can be answered and addressed adequately by the vendor. While many practices share a common fear of "giving up patient data" to an outside vendor, that doesn't mean they aren't justified in feeling this way. You should be very careful in the selection of a vendor.

Note that when we refer to the cloud, there are variations among vendors. For instance, some vendors host their own Enterprise Performance Management/EHR software. Likely the vendor will also include add-ons tools and services such as code-set libraries, assistance with interfaces (e.g., to payers) and HIPAA compliance, to name a few. Cloud vendors also vary in whether the vendor shares servers among multiple practices or offers the option for your practice to be on a separate (physical or virtual) server not shared with others.

But all vendors are not created equal, and once you commit your practice to a vendor, it may not be easy to reverse course. Thus it's crucial to ask questions upfront about your practice's IT systems, the vendor, and the vendor's performance.

Here are seven question you must ask your vendor before a move:

1. Does the vendor have references from practices that are similar to your practice? This may be easier with a specialty-tailored EHR, but even with non-specialty vendors, references which reflect your size, specialty, and your geography (especially if you rely on critical payers or programs such as Medicare) can give important insights into whether the vendor will work for you.

2. What changes will we need to make to our internal network? If you are moving from in-house servers, your network is designed to maximize the speed (bandwidth) among your practice locations to those internal servers. When you migrate to the cloud, all data flows in and out through your internet connection, increasing the amount of internet traffic dramatically. Be sure to look at the vendor's bandwidth requirements for each computer and ensure that you have an internet connection(s) capable of handling both the cloud vendor, and your other internet uses.

3. How will the move impact our ability to share and integrate data with other applications? Do you have imaging or laboratory software which needs to connect to the cloud software? Ask if the vendor has assisted other practices using the software you use.

4. How good is the vendor at security? What is the cloud vendor's knowledge of HIPAA and how does it ensure compliance? While vendors were once merely required to sign HIPAA Business Associate Agreements, current rules require them to be fully HIPAA compliant. Also as the cloud has matured, a variety of security standards have emerged. You - or your IT consultant - may want to review the standards outlined here.

5. What is the vendor's approach to application upgrades? If you're in a shared server environment, all customers may need to upgrade to new versions of the software at the same time. Since upgrades may need to be compatible with other interfaced software, you may be caught in a bind needing to maintain an existing software package which may not be compatible with the cloud vendor's upgraded version.

6. What is their service-level agreement (SLA) and escalation policy? Days and hours of support matter - time zone differences may mean they're not available when your office may be open and need help. Downtime costs you and your practice. This is a key area to cover when doing vendor references.

7. What happens if we choose to leave the vendor, they merge with another company, or close business? While the cloud market has matured, you always need to be aware of your options - and contractual protections - anytime you're putting your practice's records in a vendor's hands.

As in any major IT transition, they will be bumps along the way. But if you ask the right questions, your likelihood of success will be greatly increased. And, in the long run, having your vital business data in the hands of experienced and well-resourced professional vendor is a great