(8 min read) Vendors are quick to tell you that cloud-based applications that provide Software-as-a-Service (SaaS) products are faster to implement, require low upfront investment, are extremely secure and reliable, and provide access to the product anytime from anywhere. However, do cloud solutions make sense in EMS where we have to deal with the burden of patient information and require access to systems 24x7?
Here are some questions you might be pondering when you think about EMS software in the cloud:
These are all excellent questions to ask as you consider adopting cloud-based software for your EMS agency. We’ll dive into each one to provide some perspective for you.
Costs
EMS agencies are doing more with less budget than ever before. In this time of shrinking reimbursement rates and increasing operating costs[i], it’s smart to think about the total cost of ownership for any purchase as well as budget cycles and upfront investments versus recurring costs.
In-premise solutions generally require a significant up-front investment in time and money[ii]. The cost of setting up most in-premise solutions will include:
Additionally, the costs of the in-premise software tend to be fairly significant, and can be difficult to budget for many EMS agencies. You will own the software outright, but typically have to pay for any future upgrades to the system. The system costs can be depreciated over three to five years, but server hardware and software will need to be continually replaced or upgraded over time.
On the other hand, cloud solutions will be hosted in the cloud, so there’s no need for servers or the expertise to configure and maintain them. Vendors typically provide fully redundant solutions, so disaster recovery is built into the costs. The system is typically billed as an ongoing monthly subscription fee. Upgrades will be performed regularly and are included in the monthly fee. In both scenarios, you’ll still need to provide devices (computers, tablets, smartphones) to access the system and reliable internet connectivity so that your team can easily input and retrieve information and have dependable use the system.
Support
We briefly mentioned the costs associated with supporting an in-premise system, but it’s important to carefully consider the agency’s needs when choosing any solution. Depending on your agency’s needs for customized solutions and the complexity of the system you’re implementing, you may need a full-time, highly trained administrator who will require on-going training to keep the system operational. This can be a significant investment for the agency and can detract from some of the other jobs that need to be done.
On the other hand, cloud-based solutions typically require low technical expertise to implement, configure, and use the system. Often training is available remotely or may be recorded so training will be available when users are. Systems are generally easy to configure and administer, but may have less configurability.
Security
Ransomware has become a major threat for EMS agencies and can completely disable an agency while exposing the agency and its patients[iii].
“On average, more than 4,000 ransomware attacks have occurred daily since January 1, 2016. This is a 300-percent increase over the approximately 1,000 attacks per day seen in 2015.”[iv] (Dept. of Justice)
Agencies with in-premise solutions are more vulnerable to attack because there are multiple points of entry accessible to hackers – especially if hardware is not properly protected. Devices in the field are particularly vulnerable as they’re easily accessible, are often unprotected, and aren’t configured to withstand attacks. When these devices are connected to the agency’s internal network, hackers can gain access and exploit protected health information and other valuable company resources.
Cloud-based solutions employ the latest technology and security experts to ensure that your data is always protected. The data stored on devices will be encrypted according to best practices. Security protocols are constantly changing, and cloud-based solutions can keep up with that pace. They are able to release security patches regularly with minimal disruption to your business. Additionally, the cloud-based systems are typically run in large data centers that provide redundancy so that the system can switch over to a disaster recovery system seamlessly. Cloud-based providers are regularly audited by third party cybersecurity experts to ensure that they meet or exceed compliance requirements for standards such as HIPAA, HITRUST, and SOC2.
Another facet to consider is physical security. In-premise solutions are often compromised due to a breach of physical access, meaning that someone inappropriately accessed the server. Physical security can be very costly for an agency to implement and maintain correctly. Servers for cloud solutions are hosted in data centers that have state-of-the art physical protection systems.
Accessibility, Reliability and Performance
Many agencies are concerned about the availability, reliability and performance of a system that is outside of their physical control. These concerns are well-founded as internet access is not always consistently available, especially in rural areas. In-premise solutions will only be available when the server is available, which means that there could be outages related to issues at the server’s physical location including power outages, environmental factors like flooding, and building issues like HVAC failures. Many cloud-based systems are accessible from any web browser, meaning that users can access the system from anywhere, even without a connection to the office network.
System downtime for upgrades is another important facet to consider. In-premise solutions typically require some downtime to deploy system updates, change out hardware components, or resolve system issues. This downtime can easily extend into several hours or even days when a service technician isn’t readily available or when unexpected challenges arise due to an update or issue. Cloud-based systems will deploy updates regularly, but these will be scheduled at the least disruptive time possible for users and often require little to no system downtime. The vendor will have teams of engineers standing by to identify and resolve any issues that arise. Pay close attention to the Service Level Objective (SLO) or Service Level Agreement (SLA) offered by the vendor. Most cloud-based systems come with at least a 99% SLO, which means that there could be up to 7 hours 18 minutes of potential downtime in a month. Many vendors provide a 99.9% SLO, which means less than 43 minutes 7 seconds of downtime per month. That’s a significant difference when patient care is at stake.
Many cloud-based solutions also provide offline functionality that allows your agency to continue to use the system in a disconnected state, which can be helpful if your agency experiences an internet outage or if devices lose connectivity. Generally, the system will have limited functionality while offline, and as soon as a connection is restored, it will automatically sync the data that was produced while a device was offline to minimize the disruption to users as much as possible.
Cloud-based systems for healthcare products are usually hosted in tier 3 or tier 4 data centers[v] that have dedicated utilities including power and HVAC. These data centers are fully redundant and have no single points of failure, which maximizes up-time for the system and reduces the risk of any system outages.
Customization
In-premise solutions generally allow for substantial customization. Since the agency owns the system, they typically have control over every facet and can customize it to meet every need of the agency. This can be very time-consuming and will often require dedicated administrators to configure, customize, and test changes. Customization can also sometimes result in unwanted side effects that impact the functionality of the system.
Cloud-based systems usually allow for less customization and configurability. These systems will often have preset configurations available that you can start with and then let you “customize what counts” meaning that you can adjust the things that are unique to each agency. Generally, these configuration points are available through a browser and will be immediately pushed to all the devices in the field, which greatly simplifies administration and testing. This limited customization allows the vendor to rapidly build out new functionality because of the reduced complexity for testing the system.
Scalability
One last point to consider as you weigh out your options for in-premise or cloud-based solutions is how you expect your agency to change over time. Will your solution be able to grow with you, or will you need to invest in more hardware and licenses as your agency expands? What about if your agency contracts? Will you be able to recover your investment or will the hardware you purchased lose its value? Cloud-based solutions typically expand and contract seamlessly to meet the needs of your agency over time whereas in-premise solutions usually require addition fees and hardware to support growing agencies but usually don’t provide refunds or reduced costs when agencies are shrinking.
Conclusion
There are many points to consider as you decide whether to use in-premise or cloud-based products for your agency. Think carefully about the upfront investments, the security ramifications, reliability and scalability that your agency demands. Decide what level of customization your agency needs and who on your team will be responsible for maintaining the system. Ask potential vendors about service level expectations. Consider how you expect your agency to change in the coming years and what systems will support those changes, and select the system that meets your needs today while helping your agency expand in the future.
---
[i] Bobb, A. (2018, September). EMS in Crisis: Financial woes, staffing shortages threaten the future of Emergency Medical Services. Retrieved from Ambulance Association of Pennsylvania: http://www.aa-pa.org/files/news/47/EMS%20crisis%20(lower%20res)%20-%20PTN%20Sept%2018.pdf
[ii] Lahn, M. (2017, August 19). How much does a server cost for a small business? Retrieved from Server Mania: https://www.servermania.com/kb/articles/how-much-does-a-server-cost-for-a-small-business/
[iii] Stark, R. (2017, July 9). The ransomware epidemic: What EMS agencies need to know. Retrieved from EMS1.com: https://www.ems1.com/paramedic-chief/articles/285486048-The-ransomware-epidemic-What-EMS-agencies-need-to-know/
[iv] Dept. of Justice. (n.d.). How to protect your networks from Ransomware. Retrieved April 15, 2019, from U.S. Department of Justice: https://www.justice.gov/criminal-ccips/file/872771/download
[v] Allen, M. (2014, December 12). Tier III vs Tier IV Data Center – What’s the Difference? Retrieved April 2019, from DataCenters.com: https://www.datacenters.com/news/tier-iii-vs-tier-iv-data-center-whats-the-difference