Sentara Health is a not-for-profit health system, one of the largest in the Mid-Atlantic and the Southeast and among the top 20 largest in the nation, with 30,000 employees, 12 hospitals in Virginia and Northeastern North Carolina, and the Sentara Health system Plans division, which serves more than 1.2 million members in Virginia and Florida.
THE PROBLEM
Sentara has embarked on a cloud computing journey to improve operational efficiency, improve patient care and strengthen data security. Through strategic collaboration with suppliers and innovative initiatives, Sentara has leveraged cloud technologies to transform its IT infrastructure with the goal of delivering better patient outcomes.
In 2018, Sentara launched its Digital Front Door initiative to improve the patient experience and increase access to healthcare services through technology and innovation.
“The digital front door includes several components to make healthcare easier and more accessible for patients,” said Tim Skeen, executive vice president and CIO at Sentara Health. “A key element was the implementation of a mobile app that allows patients to schedule appointments, access medical records and communicate with healthcare providers.
“This app provides a seamless and personalized patient experience, eliminating the need for phone calls or in-person visits for routine tasks,” he added.
To strategically put Sentara on the path of a digital front door, employees recognized the need to design, deploy and manage applications, services and resources securely in the cloud, he said.
“As we looked at rolling out the digital front door, we also recognized the need for a consumer-facing app in the cloud, our enterprise data platform, EHR, CRM, claims platform and many other strategic and business-focused applications,” Skeen recalled.
“As companies increasingly migrate to cloud-based environments, ensuring the security of sensitive data and applications becomes of paramount importance,” he continued. “Cloud computing has revolutionized the way businesses work, but it has also introduced new security challenges.”
PROPOSAL
Skeen said the first thing was understanding the cloud security framework.
“The cloud security framework provides a comprehensive approach to protecting cloud infrastructures, leveraging advanced technologies and implementing industry best practices,” he explains. “This technology provides a solid foundation for the cloud security framework, allowing organizations to protect sensitive data and ensure the integrity of their cloud-based operations.”
“By defining the cloud infrastructure through code, we were able to standardize and automate the deployment of their security framework across multiple cloud environments.”
Tim Skeen, Sentara Health
The key components of the framework, Skeen outlined, include:
- Secure data processing. The patent covers advanced techniques for secure data processing in the cloud. It includes encryption algorithms, secure data transfer protocols and robust access controls to protect data at every stage, from storage to processing.
- Anomaly detection and threat monitoring. The patent includes advanced anomaly detection mechanisms to identify and mitigate potential security threats. This technology can detect abnormal activity that indicates a security breach by analyzing network traffic patterns, user behavior, and system logs.
- Secure data storage. The patent’s data storage capabilities ensure that sensitive information remains protected at rest. It uses encryption methods to scramble data before storing it, making it unreadable to unauthorized users. Additionally, the patent includes mechanisms for secure key management, ensuring secure access to encrypted data.
- Scalability and performance optimization. The patent emphasizes scalability and performance optimization to meet the dynamic needs of cloud-based environments. It enables organizations to seamlessly scale their cloud infrastructure, ensuring security measures remain robust despite increasing data volumes and processing demands.
- Data encryption and privacy. The framework uses encryption techniques to protect sensitive data at rest and in transit. Encryption ensures that even if data is compromised, it remains unreadable by unauthorized persons. Additionally, the framework emphasizes privacy controls, ensuring compliance with privacy laws and regulations.
MEETING THE CHALLENGE
Skeen said there are many benefits to the cloud security framework, including:
- Enhanced security posture. By implementing this framework, organizations can significantly improve their security posture in cloud environments. The comprehensive approach covers various facets of security and ensures that vulnerabilities are addressed holistically.
- Regulatory compliance. Organizations operating in highly regulated industries such as healthcare can use this framework to establish and maintain compliance with industry-specific regulations. The risk assessment and compliance management components help organizations identify and correct compliance gaps.
- Scalability and flexibility. The framework is designed to grow with the changing needs of organizations. It can adapt to different cloud environments, including private, public and hybrid clouds, making it suitable for different business requirements.
- Cost-effective security. Organizations can streamline their security operations by implementing a unified security framework, reducing the need for multiple, disparate solutions. This consolidation results in cost savings while providing comprehensive protection against cyber threats.
“The automated deployment of cloud security framework technologies was used to streamline and improve the process,” Skeen explains. “Optafi, a cloud security provider, recognized the need for an automated approach to deploying their security framework to efficiently protect cloud environments. By implementing automation tools and methodologies, we were able to simplify and accelerate the deployment process while ensuring the highest level of security.
“A key aspect of the automation strategy was the use of infrastructure as code principles (IaC),” he continued. “By defining the cloud infrastructure through code, we were able to standardize and automate the deployment of their security framework across multiple cloud environments.”
This eliminates the need for manual configuration and reduces the risk of human error, resulting in a more secure and consistent deployment, he added.
“Additionally, we have deployed continuous integration and continuous deployment (CI/CD) pipelines to automate the entire deployment lifecycle,” he notes. “CI/CD pipelines facilitate the seamless integration of code changes, automated testing, and security framework implementation. This enables faster iterations and ensures that the latest security improvements are immediately deployed to the cloud environment.
“Intelligent orchestration and configuration management tools were deployed to further improve the automation of the cloud security framework,” he continued. “These tools allow us to centrally manage and automate the configuration of security controls, ensuring that all cloud instances are adequately secured and compliant with industry standards.”
In addition, automated monitoring and alert systems have been implemented to proactively detect and respond to security incidents or vulnerabilities, he said.
RESULTS
Skeen reported some key success metrics from the cloud program:
- Sentara’s cloud migration journey began in July 2018.
- Nearly 80% of all applications are now in the cloud.
- Sentara achieves an annual decrease of $5.8 million (approximately 30%) in data center costs versus baseline.
- The reduction in operating costs is due to reductions in labor costs, software maintenance, equipment and data center maintenance and utilities.
- Sentara’s migration to the cloud changed the recovery period from 10-12 days at 20% capacity and 30 days for full recovery to 4 to 12 hours for full recovery of mission-critical applications at a cost savings of 28% when used on-premises.
Follow Bill’s HIT coverage on LinkedIn: Bill Siwicki
Email him: bsiwicki@himss.org
Healthcare IT News is a HIMSS Media publication.