devopsy.kinsta.cloud

Tag: healthcare

  • Application Modernization: A Catalyst for Fixing Sub-Optimal UX

    Application Modernization: A Catalyst for Fixing Sub-Optimal UX

    Today, some of the biggest government programs in existence are Medicare and Medicaid with the two health care insurance providers serving over 43% of the U.S. population. The Centers for Medicare and Medicaid (CMS) spent $1.6 trillion in 2021 and continue to grow in both size and cost on an annual basis. With this type of investment and permeation into the American populace, one would assume that this program would be running on the most up-to-date applications available. However, both public and private health care insurance carriers continue to operate on legacy systems.

    Recently, Andrea Fletcher, the digital services director of the CMS, described their system as operating on technology from the 1960s, which is alarming considering the responsibilities of the program. In fact, the Biden administration has only recently announced plans to modernize their organ matching system. This announcement came from a study conducted in February, which showed that only 26% of organs were procured from donors on average. This is just one example of how efforts to improve legacy systems, which are currently being used by over 40% of the population, allow both public and private organizations to operate in a more efficient manner as well as satisfy user needs. Further exploration will show how modernization improves other areas of business, such as creating user experiences that are both easier to navigate and more personalized as well as the ability to incorporate the latest cybersecurity updates.

    Modernizing as a Means to Improve User Accessibility and Personalization

    Given the size and diversity of the United States population, a modern flexible system is necessary for creating a smooth user experience for every individual. Today, users connect with insurance carriers using a variety of different devices while communicating using different languages and possessing different levels of technical expertise. The ability to create a personalized user experience for each individual will require a level of modernization that legacy systems were not built for. The importance of this flexibility is accentuated when considering that the purpose of Medicare and Medicaid, in particular, is to serve the elderly and underprivileged.

    Prioritizing the modernization of the consumer experience is not limited to just government organizations. In an independent survey conducted by Evolveware, 46% of private organizations measure the success of their application modernization efforts through an expected improvement in customer experience. As health care insurers continue to rely more heavily on analytics and the population continues to adopt digital technologies, the process of creating a streamlined and targeted approach to purchasing and managing health care becomes essential to staying competitive. For a multitude of companies in the marketplace, having an agile system that can be customized to each individual user can be a major differentiator, especially given the variety of factors that each individual has when it comes to making decisions about their health. Moreover, by prioritizing the user experience, organizations can improve their brand loyalty and customer retention, which are key factors when dealing with a competitive marketplace with a lot of players. Insurers have recognized this, as a recent survey of CIOs by Gartner showed that improving the customer experience and application modernization were listed as the highest priorities in the insurance industry. As customers become more judicious with their money due to current macroeconomic trends, providers will need to make sure their platforms’ user experiences are on par with their competitors.

    Modernization to Mitigate the Impact of Hidden Costs and Security Vulnerabilities

    The costs of not updating legacy systems should also be taken into consideration when making the decision to modernize. While the expense and process of moving away from legacy systems can seem like a significant obstacle, these systems, due to on-site maintenance and operational costs, are already expensive to maintain on a continuous basis. In fact, health care IT teams spend around 60% of their time trying to maintain and manage legacy systems. Furthermore, the opportunity cost of IT teams focusing on maintenance over innovation is significant, especially given the potential of the latest technologies to deliver a more intuitive user experience. There is also an understated but pressing labor cost with legacy systems, as members of the workforce who are familiar with these systems are aging and retiring, and the replacement workforce is not well-versed in legacy languages and technologies.

    Finally, legacy systems can also contain blind spots that are prime targets for cybersecurity breaches and hacks today. Legacy applications were built at a time when these types of attacks were not common and, therefore, don’t have the most up-to-date security capabilities embedded. Many of these systems also do not have up-to-date documentation, resulting in a high potential for hidden vulnerabilities. For health care organizations that have access to sensitive data, understanding and then shoring up these vulnerabilities using modern security features is critical.

    Health Care Modernization Example: Chatbots

    One prominent example of how application modernization can lead to organizational success is the integration of chatbots. As technology expands and businesses identify new ways to reach consumers, the addition of chatbots has become more prominent on platforms across industries. For the health care insurance industry, the bots provide both a cost-efficient way to process insurance claims as well as an enhanced user experience through ease of use. Recent estimations show that bots can handle the workload of two to five claims processors and can deliver 20 times the production relative to cost, allowing industry employees to focus on less tedious and more innovative tasks. Using generative AI models, chatbots will continue to become more sophisticated and varied in their responses to user input. As a result, modernizing legacy systems to optimize the integration of these bots becomes integral to remaining competitive in the marketplace.

    Legacy Systems and the Future

    As we look to the future, both government and private insurance carriers have plenty of internal and external factors that incentivize application modernization. As Medicare and Medicaid continue to grow due to the increasing number of eligible users, an agile system is integral for user accessibility. Meanwhile, macroeconomic factors such as high costs and an increasingly competitive marketplace will force private organizations to adopt systems that can integrate and adapt to the newest technologies for a better and more secure customer experience. With serious challenges facing both the public and private sectors of healthcare insurance, the necessity to modernize has never been greater.

  • Clinical Trials: Programming for Scale, Speed and Success

    Clinical Trials: Programming for Scale, Speed and Success

    According to the Journal of the American Medical Association (JAMA), the median cost of bringing a new drug to market is $985 million and the average cost is $1.3 billion. However, those in health care hoping to harness promising new treatments, and patients facing steep prescription costs, see this as progress. After all, previous studies estimated the average price for developing a drug to be as high as $2.8 billion, a cost usually recouped at the expense of consumers. While savings are being realized, trials still come with quite a price tag—but the reasons why are understandable. First, clinical trials are complex and, simply put, time is money. The final stage alone, the Phase 3 clinical trial, can involve tens of thousands of participants, each with hundreds or thousands of data points that need to be tracked over a number of years. This can produce hundreds of millions of data points that must be protected, secured and blinded, and all of which must be analyzed by numerous applications.

    Many cite the fast development of a COVID-19 vaccine as proof that the process can be expedited. While the vetting of these vaccines was thorough, the processes benefited from unprecedented resources, industry and government cooperation and global pressure to quickly find a way to slow a highly infectious disease. Even so, one can’t help but wonder why clinical trials typically take six to seven years? Haven’t we learned how to speed up trials without jeopardizing health or draining budgets?

    The short answer is yes—there is a way to reduce the time and resources needed for clinical trials. Pharmaceutical companies use dozens of software platforms from an array of vendors in their trials. As a result, crucial data gets trapped in unconnected silos, adding complexity and stalling progress. However, by unifying apps and data stores in one integrated system, trial efficiency can be raised and time-to-completion reduced by over 20%.

    Raising a Platform

    Deloitte noted that COVID-19 revealed health care’s need for structural and technology transformation, adding that its future will be “enabled by radically interoperable data, artificial intelligence (AI) and open, secure platforms.” The same holds true for clinical trial data software platforms; however, creating a unified system is an enormous undertaking for software developers and software engineers. Most importantly, any unified system must be able to provide the following four capabilities.

    ● Security: Data in platforms must not only be protected from external threats such as hackers and ransomware but it must also be blinded. The ideal is a double-blind clinical trial in which neither participants nor their physicians know who received the actual drug and who received the placebo.
    ● Modeling: A platform must be capable of extending a data model for each clinical trial to prevent the need to rebuild every time. The models, and the platform overall, must be flexible but still capable of managing hundreds of millions of records across multiple trials.
    ● Extensibility: Over the course of years, data collected—even in a single trial—may change. The ability to extend a scheme on the fly to fit evolving needs can save an enormous amount of time versus building a platform and transferring data. This is especially true when you have millions upon millions of data points.
    ● Ease: A platform must be easy to modify by non-programmers. If a trial designer can implement rules without having to bring in a programmer, the trial will move ahead much more quickly.

    Key to being able to raise an effective clinical trial platform are software engineers and developers. According to the Bureau of Labor Statistics, software developer jobs alone will grow more than 22% by 2029—faster than all other occupations combined. While this is good news for software pros, demand will create a shortage exceeding 1.2 million by 2026, which isn’t so great for the pharmaceutical companies that need talent.

    Then again, there are purpose-built platforms available that provide data, software, services and an ecosystem of partners to support functions from research and development through commercial availability. They’re designed to bring such products to market faster and more efficiently while maintaining complete compliance. The platforms can not only be comprehensive, but they can also mitigate reliance on developers and engineers, with regular provider updates future-proofing operations and decreasing investments.

    Programming for Success

    First and foremost, pharmaceutical companies are achieving faster trial goals by leveraging the cloud and DevOps. In doing so, all data can reside in a central repository that’s accessible from anywhere. There’s no hardware requiring time-consuming manual configuration. What’s more, modern cloud infrastructures are resilient, secure and robust. And all of this is largely being made possible by software-as-a-service (SaaS) platforms.

    Despite this progress, the need to technologically bolster trials continues. AI is now being applied to auto-classify documentation. Naturally, these types of developments require the implementation of programmability and extensibility at scale. The best minds in software engineering have made considerable gains. It’s now up to pharma to ensure their trials and operations continue to be programmed for success.

  • How Healthcare Companies Can Optimize Software for Improved Patient Outcomes

    How Healthcare Companies Can Optimize Software for Improved Patient Outcomes

    Healthcare companies are more reliant than ever on software to help them achieve good patient outcomes. Recent research reveals that the use of software as a service (SaaS) solutions is growing exponentially in health care, covering a wide range of areas including:

    • Patient diagnosis
    • Medical imaging
    • Therapy and patient self-care
    • Data collection and analysis
    • Hospital management

    Due to the increased use of digital products in patient care, healthcare providers recognize the need to speed innovation and fundamentally rethink how they build software. This has led many engineering teams to move toward continuous integration and continuous delivery (CI/CD) when building and deploying software.

    Considering the industry’s emphasis on improving patient experiences, it makes sense that healthcare providers are keener than ever to optimize their systems. In fact, around 90% of healthcare providers are implementing or already using customized software solutions and development.

    As teams look to improve these critical processes in software development, feature flagging is one way to speed up development and optimize software performance in the healthcare industry.

    CI/CD Challenges for Healthcare Companies

    The healthcare industry faces unique challenges when applying DevOps strategies such as CI/CD.

    Intense Regulation

    The main problem is that, for obvious reasons, health care faces stringent regulation and oversight. A high level of scrutiny is necessary in an industry in which one small mistake or misjudgment can cost patient lives; however, in terms of DevOps, waiting for regulatory evaluation and approval can slow down the entire software development process, which defeats the core purpose of CI/CD.

    Security

    Data security poses another challenge for healthcare providers, especially when dealing with cloud-based software solutions. Cloud-based systems will always have potential vulnerabilities, as they rely on infrastructure that connects a variety of devices and smart technology equipment. There will always be inherent weaknesses in remote systems, as opposed to on-premises, too. A recent survey revealed that 42% of respondents said their major security concern was unauthorized access to cloud systems through insecure APIs. Network configuration problems were a close second, with 40% of respondents citing those as a concern.

    In a healthcare setting, another issue is the high volume and high velocity of data. Even a small, specialist clinic that may only see 150 patients per day will still generate vast amounts of data over the course of a month or year. Most of the data is private and sensitive, which means that data privacy and cybersecurity are top priorities for healthcare companies.

    The Impact on DevOps

    At first glance, because of the high level of regulatory oversight and cybersecurity concerns, it might seem that health care is a less-than-ideal environment for agile DevOps processes. How can you adopt fast-paced CI/CD cadences and innovate rapidly when there are necessary, opposing forces?

    The answer is to leverage innovative software development solutions such as on-premises feature flagging.

    Feature Flagging and Its Impact on Software Innovation

    Feature flags are, essentially, toggles or switches that allow software development teams to turn features on or off. The main advantage of feature flagging is that it allows for faster software deployment. One or more features can be coded into the software during development and made ready to go, but it is turned off for the user and/or patient on initial deployment.

    The ability to embed features within software that can be toggled on or off is perfectly suited for the healthcare industry since that approach allows for the necessary regulatory approval(s) before full deployment.

    For example, look at the rapid rise of telemedicine during the COVID-19 pandemic. Doctors, hospitals and patients alike were forced, along with the rest of the world, into the “new normal” of virtual interaction to mitigate the spread of disease while still providing quality treatment.

    For most industries, adding video chat/conferencing capabilities to existing applications was relatively easy. But for health care, the approval process, privacy and security concerns slowed down the adoption of these features. In our experience, typical healthcare teams are, best-case scenario, running on monthly—or, most likely, quarterly—deployment cycles to align their deployment efforts with compliance and governance review boards. Product and engineering teams work to get their updates and improvements in line with this cadence, which can make innovation difficult.

    If teams wanted to deliver this capability quickly, they could adopt feature flagging to decouple the concepts of “deploy,” “approve” and “release.” To use the video chat example, here are the steps they’d be able to take:

    1) Build the videoconferencing capability into their app and deploy the feature to production with the capability switched on for internal users (IP targeting, specific email addresses, etc.) only.

    2) Now that the feature is in live production, they can perform actual field testing to ensure that the functionality is working well, while simultaneously moving through internal and external approval processes.

    3) Once the review is complete, move to the release stage by switching the feature(s) on and allowing (external) end users to access the capability.

    All this can be achieved without needing to redeploy the software, and the developers are still free to make iterative improvements to the application.

    Now that the regulatory hurdles are addressed, it’s important to acknowledge that security is still an issue for healthcare companies that employ a SaaS feature flagging platform.

    While most providers focus solely on SaaS, the ability to deploy feature flagging software on proprietary cloud infrastructure is important in the healthcare space. This model enables both extra security and HIPAA compliance, and also opens up important capabilities and performance results that SaaS-only providers have a hard time matching. Since this technology typically becomes deeply embedded in the fabric of an organization’s product and technology, feature flagging is well-suited to an on-premises implementation.

    The implementation of on-premises feature flagging is a great way for healthcare companies to increase deployment velocity from monthly to daily. It allows their software development teams to adopt CI/CD cadences and innovate more rapidly, without the risk of breaching regulations or making sensitive data easily available to hackers.

  • Healthcare Increasingly Embracing DevOps

    Healthcare Increasingly Embracing DevOps

    Speed and efficiency rank high as reasons why among respondents to a survey of healthcare organizations that have adopted DevOps

    While the novel coronavirus pandemic has hurt many industries, few have faced the immediate difficulties that the healthcare industry has had to manage. While trying to deliver care during one of the most significant healthcare crises in generations, providers must also contend with all the challenges every other organization must contend with as they strive to keep their business technology systems up and running securely.

    To that end, a recent survey found that healthcare organizations are increasingly embracing DevOps. According to the study from Redgate Software, the “2020 Database DevOps Report for the Healthcare Sector,” 70% of respondents have adopted DevOps across all or some projects or have a proof of concept to use DevOps techniques. In fact, at 41%, more healthcare organizations have moved out of the proof-of-concept stage than other sectors such as financial services and government, at 36%.

    “We know that the healthcare sector is facing unprecedented demands from the pandemic and other regulatory struggles, and DevOps is the best way to tackle these issues,” Kendra Little, Redgate DevOps Advocate, said in a statement. “By then extending those practices into the database, the healthcare sector can not only improve the quality and efficiency of these systems but ensure patient data remains secure and maintain compliance practices.”

    There are a handful of motivations behind the shift. The increased risk of failed deployments/downtime was cited as the top reason healthcare organizations moved to DevOps by 24% of respondents, while 21% reported inability to respond to changing requirements and 20% cited slow development and release cycles as the top reason.

    When it comes to automation, the report found that the healthcare sector is adopting automation across the database development process more than other industries. The majority are managing to do so while remaining compliant, or so they say—58% of respondents claim they have version control measures for database code in place. The primary motivations to automate database delivery had to do with efficiency and risk reduction, with 27% wanting to free developer time, 22% wanting speed of delivery and 12% wanting to reduce data loss risk.

    “What’s surprising this year is the way North American respondents are surging ahead, with 55% saying that they deploy database changes daily, weekly or even on-demand,” Little said. “This indicates that they’re embracing Agile practices to better meet the needs of doctors, patients and remote services like telehealth that rely on these databases each day. We’ll be watching this space closely as the sector continues to change during the pandemic and in response to pressing compliance needs.”

    With the rush to telemedicine and electronic medical records, it is surprising that only 42% of respondents said they use the cloud in some capacity. That’s a number that’s sure to rise in the months ahead as remote access to medical services continues.

    As organizations everywhere strive to do more with less, and remotely, health care is particularly challenged. And as the industry continues to work under strain, more will likely continue to embrace DevOps and cloud computing as ways to meet their objectives and deliver care reliably.

  • COVID-19 Pandemic: Appian Offers Free HR App

    COVID-19 Pandemic: Appian Offers Free HR App

    Appian, a provider of a low-code platform for building applications, has decided to make available a free application to help organizations with 1,000 or more employees track healthcare incidents stemming from the COVID-19 pandemic.

    Designed mainly for human resources (HR) professionals, the COVID-19 Response Management application is designed to track the health and work status of all employees by geography and department, including their travel history.

    Appian CEO Matt Calkins said that while Appian has built a handful of applications for customers before by request, the company decided to leverage its expertise to provide a free application to help organizations maintain business continuity during the COVID-19 pandemic that is forcing employees to work remotely for the foreseeable future. Organizations can either access the COVID-19 Response Management application as a cloud-based service provided by Appian or download and install it themselves, he said.

    Organizations in highly regulated industries that need to still comply with rules concerning personally identifiable information (PII) are likely to want to run the COVID-19 Response Management application in a local data center, noted Calkins. The cloud-based instance of the application runs in an environment that is already certified to be compliant with the Health Insurance Portability and Accountability Act (HIPAA).

    Calkins said the COVID-19 Response Management application is designed to be set up and configured in less than two hours. Because the application was built using low-code tools, COVID-19 Response Management application is highly customizable using the company’s namesake low-code platform, so as the crisis continues to evolve, organizations will be able to extend the application as they best see fit.

    Millions of individuals, unfortunately, may contract the COVID-19 coronavirus or may be unable to work because they need to care for loved ones who have fallen sick in the weeks and months ahead. As organizations race to implement business continuity plans, many of them are likely to discover their existing HR applications were not designed to help manage a highly distributed workforce, which may need to be augmented with little notice. The COVID-19 Response Management application provides a way to manage talent in addition to other HR functions, noted Calkins.

    The Appian application is also designed to enable HR teams to function as the hub around which organizations can build online communities that employees can use to interact and provide mutual support. For example, employees can connect with each other to volunteer their time to go shopping on behalf of employees who may be quarantined.

    As the COVID-19 pandemic intensifies, many organizations are clearly entering unchartered territory. Workforces may be sharply reduced or increased depending on vertical. The number of temporary workers may skyrocket in some cases. Regardless of the outcome, most organizations will need access to applications that enable them to be as flexible as possible to deal with whatever lies ahead. In some cases, organizations may have HR applications in place that enable them to achieve that goal. In most cases, however, it’s probable they don’t.

    — Mike Vizard

  • The Bumpy Rise of the Tech-Savvy CFO in Healthcare Organizations

    The Bumpy Rise of the Tech-Savvy CFO in Healthcare Organizations

    The good news? The working relationship between technology leadership and financial officers in health systems organizations is improving. The bad news? Chasms between finance and IT remain, and they are common throughout health systems providers.

    Market Research firm Black Book Research recently found, in its “2019 Black Book CFO & Financial Leadership Survey,” that chief financial officers (CFOs) are no longer prioritizing cost-cutting and are becoming more aggressive in their technology spending. Interestingly, 52% of CFOs reported that they are shifting their priorities to financial technology investments, such as the implementation of advanced analytics, as well as 44% who cited increased spending on broader distributed ledger technologies.

    This is a dramatic change over previous years, where financial technology in many healthcare organizations witnessed negligence and budget cuts. “Ninety-one percent of CFOs surveyed agreed that their past organizational CIO and senior IT management did not support a culture where financial technology upgrades and acquisitions were prioritized as initiatives that impacted enterprise health system strategy,” the report found.

    The survey found that 90% of financial leaders and management strongly agreed that CIOs and IT management undervalued the needs of financial digital transformation and their financial tools. Technology leaders instead prioritized and convinced their boards that their electronic health record vendor-related offerings were the best investment going forward.

    The result? When it comes to finance technology in healthcare organizations, the world has become quite bifurcated. Consider this: Ninety-four percent of marginally performing hospital CFOs nationally claimed that they are not prepared to handle new healthcare delivery and payment models with their current financial software. Comparatively, 89% of the top financially performing hospitals in the country report having the organizational technology tools to address modified payment strategies.

    There’s also no rest for the weary financial officer, the survey found. While senior financial officers struggled with the pressures of smaller operating incomes, rising labor and supply costs, shrinking volumes, reduced reimbursements, declining patient volumes and changing healthcare delivery models, 83% report that in the past fiscal year that they received add-on responsibilities that included organizational productivity, strategic technology and innovation growth initiatives.

    “In a noticeable shift since the acquisition of enterprisewide EHR systems led by CIOs, CFOs have become the executive charged with digital transformations to improve competitive advantages, strategic growth and innovation across all customer touch points, while measuring the technologies’ ROI,” said Doug Brown, president of Black Book.

    Indeed, there has been a huge shift in CFO involvement in recent years. In fact, 88% of CFOs report having increased involvement in their health system IT agenda since the implementation of their enterprise EHR, as compared to 14% in 2015.

    But this dramatic rise hasn’t been without friction:

    • 85% of all respondents stated that their current organizational structure prevents enhanced CIO-CFO collaboration. Eighty-nine percent of CEOs interviewed disagree with this statement.
    • 82% of CFOs stated that they have an insufficient understanding of IT issues as the barrier to them not being included in technology selections and approvals prior to 2014.
    • 84% of CIOs surveyed in Q4 2018 claimed the processes and tools in finance are incomparable to IT functions and remain a significant barrier to mutual understanding.
    • 90% of all respondents agree that the absence of key performance indicators that link IT agendas to financial performance greatly limits their success.
    • 98% of respondents strongly agree that it’s the healthcare CFO’s job to ensure their organization fully realize the benefits of technology investments, not the CIO’s job, in 2019.

    While the CFO’s role in technology has grown, largely due to the substantial impact of EHR adoption—and this has caused significant stress between the CFO and CIO in many health services organizations—the working relationship is showing signs of becoming stronger and more collaborative. The report found that the continuing lack in understanding on both parties to converge on strategies, investment mindsets, healthcare customer experience, business models and agendas continue to keep the barriers high for many.

    — George V. Hulme

  • How to Automate HIPAA Compliance with DevOps

    How to Automate HIPAA Compliance with DevOps

    DevOps can help make HIPAA compliance more achievable

    Automating the provisioning of HIPAA-compliant server infrastructure enables compliant hosting service providers with the ability to provision and deploy infrastructure-as-code with minimal human intervention. Providing the automated process is thoroughly tested, revised and updated, it can offer a healthcare organization huge flexibility when enforcing a HIPAA-compliant server or serverless infrastructure within a private, hybrid or public cloud offering.

    Organizations that practice centralized operations, also known as DevOps, have a unique team who have the desirable skills of software development, IT operations and quality assurance (QA). The DevOps objective is to create a performance-based IT solution within a greatly reduced provisioning lead time using technical server blueprints within a continuous delivery environment.

    DevOps within a healthcare organization must be able to meet the stringent administrative, physical and technical safeguards required by HIPAA. In all cases, the required safeguards must be met, but with DevOps, it can be significantly easier to meet the addressable requirements of HIPAA.

    Planning

    Each healthcare organization can present differing business needs which they need a HIPAA-compliant service provider to resolve. It is not always possible to provide a cookie-cutter solution for every healthcare organization, often one design does not fit all; however, it is possible to create a baseline of operations using automation.

    A great deal of planning must be completed with all relevant stakeholders to not only understand the technical solution but to gather critical information about unique aspects of the architecture and then plan ways to automate the delivery process.

    It may not be possible to automate every workstream, but getting the DevOps team involved in the early planning stage will allow thorough and accurate playbooks to be created.

    With advanced planning, significant gains can be made in defining the networking security layout for the healthcare clients virtual private cloud, work out what isolated cloud resources can be defined and make decisions about potentially leveraging network layer protection services such as DDOS protection or a software-defined web application firewall.

    Provisioning

    The next step to creating the infrastructure-as-code is to write the automation playbooks that will provide the infrastructure. There are several provisioning applications that can be used, such as Terraform, Chef, Puppet, Google Deployment manager or AWS Cloud Formation, and playbooks will need to be written (or converted to) a compatible language such a python, YAML or JSON.

    The machine-readable code interacts with the service provider’s API front end; this may be an on-premises VMware vSphere cluster or a public cloud provider such as AWS, GCP or Azure. The API interprets the code and uses the descriptor commands to provision and deploy infrastructure in a cloud environment.

    A DevOps engineer will select the cloud provider they using and then define all the environmental variables to use to create the infrastructure-as-code. Connection variables are usually configured first and will define the cloud provider locations, regions and availability zones, as well as the encrypted account passwords or IAM configuration to interact with the provider API.

    Once the connection variables have been initiated with the provisioning software of your choice, they are used throughout the project life cycle. The next stage is to define the HIPAA infrastructure environment, including storage, network and compute resources. This will include provisioning resources and setting private and public networking.

    At all stages of the design it important to define where ePHI data will be stored and processed. The process must include step-by-step documentation and a customer responsibility matrix. At this stage, it is imperative to incorporate technical safeguards such as server access control lists (groups), introduce activity logging and provide auditable controls.

    Server hardening policies must be created for servers, active directory, workstations or providing least privilege authorization accounts at multiple levels, such as user profiles, that enable or restrict access to individuals or third-party systems. Preapproved software is typically installed at this step as well.

    Next, the inclusion of boot volume encryption and encryption of disk objects and storage volumes must be defined, this is easily achievable on mass provisioning of servers, simply providing a volume ID and an encrypted $TRUE statement.

    Throughout the playbook designing phase, testing is conducted to close loopholes, refine automated network configuration and create shared VPN tunnels with passwords that automatically cycle. The playbooks set the properties which make an organization HIPAA-compliant, and can also be used to create secured bastion servers if VPN is not an option.

    Playbooks allow DevOps teams to create rotating security keys, SSL certs and log aggregation and filtering. This can also be configured to trigger automated messages that can be emailed in case of any errors or failures in the automation process.

    Continuous Delivery

    When all the playbooks are streamlined and accurate, they can be used to define a healthcare clients service catalog, which enables the use of standardized templates to be used within the HIPAA environment. This may include server templates, container configuration, storage templates or any predefined software application.

    Security tools can be used to track and inventory resource usage and any system changes, track all user activity and any API activity requests.

    Monitoring tools can be used such as Cloud Watch, Nagios or Nimsoft to monitor server resources and application usage, these monitoring tools can also pick up errors or predictive errors and alert against predefined thresholds.

    Many organizations choose to use serverless workloads such as Docker or Kubernetes. These massively scalable solutions also bring about a huge benefit that aids the DevOps continuous delivery approach of automated update rollouts—essentially, applications can be isolated over differing pods, allowing the underlying hardware to be updated or versioned with zero downtime.

    DevOps is changing the automated delivery of HIPAA-compliant solutions. It is important to remember that DevOps does not have all the answers for HIPAA, especially many of the administrative regulation. However, it does empower managed service providers with the ability to provide tried and tested automated solutions that meet or exceed the technical and physical safeguards of HIPAA compliance.

    — Moazzam Adnan Raja