Thursday, June 28, 2012

Healthcare CIOs: At The Crossroads

In the course of my role here at EMC, I meet plenty of IT leadership teams that are in the throes of transformation.

But the CIOs of healthcare providers are clearly a breed apart: the transformational forces grinding upon them are truly exceptional to behold.

In geology, the only difference between a benign fault line and a massively destructive earthquake is simply about how fast things move.

And, for healthcare providers, things are starting to move very fast indeed.

An Industry In Transformation

One of the things that attracts so many bright, passionate people to the healthcare industry is that you're not just making a buck, you're doing good for others.  There's a distinct "higher calling" I can clearly see in just about everyone I meet from this sector.

It’s a wonderfully positive attribute.

Ultimately, though, the amount of good you can potentially do is directly constrained by finances and economics.

More resources available (or better use of existing ones) means more health care professionals, better technology, better protocols, better outcomes and everything that goes along.

In that regard, healthcare in the US is a business like every other business.

If you're a student of business history, you can reel off familiar industries that gone through gut-wrenching transformations: transportation, telecommunications, manufacturing, media, and many more.

You can point to defined windows where a particular industry entered a rapid period of restructuring and repositioning, and looked quite different at the other end of the process.

My core thesis?  That's exactly what's happening to healthcare providers here in the US.  Some of them clearly appear to recognize it and have good ideas about what should be done; others appear to be taking a more passive and reactive approach. To each their own.

I single out the all-important roles of CIO and the IT leadership team in this transformation for one reason and one reason only: they can either be the key enabler in this transformation, or a key roadblock.

And I've seen both.

Forces At Work

I could make a very long list of all the forces of change going on within US-based healthcare delivery, but it would take several pages for a complete enumeration.  And no one would read it, anyway.

In the interest of brevity, I tend to focus on three major forces that really seem to matter:

First, the payment model has started to shift from "pay for service" to "pay for results".  That means instead of getting reimbursed for a procedure, there's now a powerful incentive to prevent the need in the first place. 

It might sound like a minor change, but -- once fully appreciated -- the shift in incentives inevitably leads to a complete and thorough re-envisioning of our familiar healthcare system. All good, from my perspective.

Second, healthcare consumers (that's you and me) are starting to take an engaged and proactive role in consuming healthcare services -- much like we care about our finances, our children's educations, real estate purchases, careers, relationships and so on.

We've learned not to walk into a car dealer without doing our homework; we're learning to not walk into a healthcare provider without doing the same.

Third, there's so much at stake for us as a society and as individuals, the government keeps wanting to "help" in the form of increased regulations.  Without delving too much into political agendas, the historical record of government "help" is a mixed bag at best.

Should the government play some sort of role?  Certainly.  But exactly what that role should be continues to be one of the most divisive issues in US politics.  And, at least in the US, the political winds potentially shift every four years, making longer term decisions and strategies more difficult.

Yes, behind this, there's a very long list indeed of technological and societal forces in play, but these are the big ones I keep coming back to: supply, demand and regulation.

It must be the economist in me :)

The Strategic Opportunity?

The more you look closely at healthcare delivery, the more you start to see it as an information-based business.

For example, if you're a healthcare professional, here's what you're probably struggling with:

  •     What do you really know about the patient -- and not just what's in the EMR?
  •     What do you really know about the wide range of treatment options and protocols?
  •     What do you really know about the likely risks, outcomes, and associated costs?
  •     How can we use all the information available to gain new insights and new practices?

I'm starting to see a picture where continually better decisions can be made on healthcare delivery -- with the right information in the right hands at the right time.

Framed this way, one can approach the opportunity in terms of diverse information flow, aggregation points and economic incentives.

It's all about the information.

Yes, it's true that everyone in the entire healthcare delivery chain: therapy companies, insurers, providers, etc. -- have access to their own information bases.

But -- in the bigger picture -- each player has only a small slice of potentially useful data that is theoretically available.

If you believe -- as I do -- that "access to more, diverse sources of timely information" is directly correlated with "better healthcare outcomes", it's a fascinating question about how and where all these information sources will come together.

Put differently: who in the entire healthcare value chain has the economic motivation and "societal license" to amass as much information as possible around these important topics, and has clear economic incentive to correlate them for better outcomes?

Let's sort through the players quickly ...

Genomics and therapy companies only have access to comparatively small and less-than-diverse information bases, usually associated with the trials they run.  Many of them are starting to realize this, and are thinking about what they might do about it.  But I believe their options are somewhat limited.

Insurance payers of all varieties certainly have the economic motivation to do this, but not necessarily the societal license.  Do you tell your doctor everything?  Probably.  Do you tell your insurance provider everything?  Probably not.

And I personally shudder when someone says "well, the government should collect and distribute all that information".  I prefer not to live in that world, thank you -- and I am not alone.

Around the periphery, we have new-school social sites, a few flavors of electronic healthcare exchanges, and other interesting activity.  While it's all interesting, none of them appear to have the right formula or the required critical mass.

That leaves us with our future-state healthcare provider as perhaps the only interesting information aggregation and correlation point in the entire value chain.

They are motivated and empowered to  assemble all the information that's relevant to a patient's condition -- as well as gather forms of information no one else usually can. They sit at the junction of multiple, relevant information rivers.

No, healthcare providers are clearly not there today -- not by a long shot.

But things can change quickly.  I've become convinced that only future healthcare providers will have both the motivation and access to aggregate and correlate the massive disparate information bases needed for effective healthcare delivery.   In the long term, they win.

A few research-oriented healthcare delivery organizations (one of the leading edges of the industry) appear to have apparently reached a similar conclusion, and there's a ton of interesting projects brewing all around the central theme of assembling and correlating massive information bases.

Big data analytics that yield more powerful predictive models, to you and me.

And if someone has a better model or argument as to where these aggregation and correlation points will form in the near future, I'm certainly entertaining alternative scenarios.

The Tactical Challenges?

There's a very long road between where we are and where we're probably going.  And if someone brings a certain cynical perspective to this discussion, trust me -- I've heard it many times before.  But I’ve seen other industries make the transformation, and I believe strongly that healthcare providers can do the same.

But there are serious structural challenges to overcome.

For starters, IT in US-based healthcare delivery appears to be constructed one bounded application at a time.  The term "silo" doesn't really convey the extreme isolation and lack of integration between functional applications.

Maybe the term "walled fortresses" would be more appropriate.  Every sub-constituency in a healthcare provider setting has "their" application with "their" information.

We've all seen this malady before in other industries -- and it doesn't end well.

There's more.  Healthcare IT professionals are justifiably concerned about having a bad IT day.

We sometimes joke about life-and-death IT outages; in healthcare delivery it's really no joke.

Not to mention, you're handling really sensitive information about people, and -- HIPAA or whatever -- there's a powerful social contract in place to protect patient privacy.

Both concerns can make ambitious IT initiatives more difficult to consider.

Just getting basic core operations and workflows nailed down in a traditional healthcare provider is a major undertaking (think Epic, sort of the "SAP of healthcare providers"), let alone all the adjuncts and extensions needed to compete and thrive in this new world.

And, perhaps the most daunting, there's an inherent culture of deep expertise.  People work long and hard to become a licensed healthcare professional.  These professionals inevitably tend to see things through the lens of a particular discipline (e.g. radiology or pharmacology) as opposed to a larger "client wellness delivery system".

And that's not going to be easy to transform.

The Multi-Industry Model Of Next-Gen Healthcare Providers

Imagine, just for a second, that there was a rapid and fundamental shift from "pay for service" to "pay for results", e.g. managed care, at-risk, ACOs, etc.

What would you -- as a healthcare provider -- need to get good at that you weren't good at today?  Maybe there aren't many examples in your specific industry, but there are plenty of examples elsewhere that you could learn from.

First, you'd have to be very good at assessing and managing risk, much like a health care insurance company does today.  Here's a fixed sum and fixed set of expectations with a client attached -- do you take the bet, or not?

That means -- if you’re going to compete in this next-gen healthcare world -- you're going to have to either build, buy, partner or rent what looks like today's healthcare insurance services.

Second, you'd have to be very good at capacity utilization.

Empty facilities, idle healthcare workers, under-utilized equipment -- all very damaging to your bottom line.  Perhaps you'd find some interesting lessons in manufacturing, or better yet the airline industry?

In particular, the airline industry -- despite how frustrating your last flight might have been -- cares about reasonably happy customers, effective capacity utilization as well as being very concerned about having a bad day of any sort.

Third, you're going to have to get very good at engaging with your clients (formerly patients!) well before they show up for an office visit -- if at all!

Remember, in this new model, you're being paid to keep people healthy, and not necessarily when they're in dire need of health services.  You're going to want to engage with them in their lives, and not yours.

You might want to think about retail, banking, financial advisers and other proficient high-touch B2C business models.

Fourth, you're going to be on a treadmill of continual process improvement: quality, efficiency, outcomes, etc.  You're going to become a big data analytics addict, just like manufacturing, retail, logistics, etc.

There's more, but hopefully by now I've been able to sketch a picture ...

I strongly believe that the next-gen healthcare provider will find many great lessons simply by studying other industries that have learned to get good at similar things.  Unfortunately, yhat tends to fly in the face of the familiar "inner circle" mentality of healthcare professionals today, but it's going to change before long.

It's inevitable, from where I sit.  Yes, you’re special.  Just like everyone else.

Back To The Healthcare CIO And The IT Function

So, what can we learn from other industries that are going through (or have gone through) transformational changes?  And how can we apply those lessons to the next wave of healthcare IT?

At a high level, the observed recipe is conceptually simple, but it's going to take a herculean effort to get there.

The starting point is the all-too-familiar IT transformation: reconstructing the core IT function to look more like a competitive IT service provider, and less like a traditional project-and-technology shop.

Every so often, I meet an organization that's going through fast changes: new leadership, new strategies, new priorities, new measurement systems, etc.  It's always indicative of an IT transformation discussion -- no exceptions.  I've observed this to be true across every industry -- including, of course, healthcare.

The IT transformation model -- in all its glory -- is pretty well understood here at EMC (plenty of reading available, if you're interested), but it's just now that I'm seeing it starting to be applied in larger and more progressive healthcare settings.

The bottom line -- in turbulent times, business leaders value agility above all else.

On top of the basic IT-as-a-service construct (and its associated business, talent and financial models), you'll need to create some key platform capabilities above basic ITaaS that are directly addressed at extremely likely aspects of your future business model.

Since there are no packaged end-to-end applications that are designed for your next-gen business model and evolving workflows, you'll inevitably be in the business of integrating your own from functional components already in the marketplace.

In my terms, you're going to need a fast "app factory" where you can specify, implement and deploy new functional integrations around new workflows very quickly and reliably.  You probably don't have that today.

But if you're going to compete in this new world, I can make a compelling case that you'll need one.

You should be desperately interested in any and every form of mobility.

Yes, for your knowledge workers and healthcare professionals, but more importantly for your patients (errr, clients!).

You're going to want to engage with your external clients frequently and deeply, across multiple channels and on devices of their choosing (game consoles, anyone?).

Put differently, your current "patient portal" isn't going to cut it in this new world for very long.

And -- at the top of the list -- you should be visualizing analytics platforms and capabilities you can point at each and every part of your business, and -- more importantly -- across your business.

Like any other competitive and progressive business, you'll want to support vast hoards of analytics junkies of all flavors and stripes.

Yes, it's a lot.

And it's going to have to happen relatively quickly.

A New Willingness To Consume IT Externally?

I'm sure that somewhere, more than one healthcare CIO has done a quick, back-of-the-napkin assessment and realized they've got a serious mismatch.

On one side, here's what the business is going to need from IT.  On the other side, here's the best case for the resources and people that can be marshaled to help get there.

There's a huge and intractable gap every time.  Very quickly, that CIO is going to start looking for outside IT services (not simply contractors!) to balance the ledger.

That's not the norm today.  There's sort of this default assumption that healthcare IT is so specialized, so important, so sensitive, etc. that it can only be done in-house.  Not only is that not true based on what I've seen, it's an unproductive mindset at a business level.

Using high-quality external IT services gets you speed, agility and expertise -- and you always retain the option to bring it in-house down the road if you're smart about how you do it.  Infrastructure.  Collaboration.  Mobile.  Departmental Applications.  Etc.

My best advice is to use your people to focus and integrate the pieces that are unique to you and your value proposition, and don't invest in re-inventing the wheel.  The faster you move your people up that value chain, the better.

Choices Remain

If you're a student of industry transformations like I am, you basically have three options: specialize, acquire-and-transform or be acquired.

There aren't really any other choices.

The first two clearly require a board-of-directors perspective of the overall IT strategy (and funding model) as an enabler to the business model. 

And -- like it or not -- healthcare CIOs are at the crossroads as a result.


By Chuck Hollis

Wednesday, June 27, 2012

Attack of the Phones: Combating Cyber Threats in the Era of Mobile Commerce

One of the hottest topics at this year’s Internet Retailer Conference and Expo was mobile commerce and, by extension, mobile payment technology. By lumping payment methods, loyalty cards, and coupons all into one location, services like Google Wallet, Passbook and ISIS™ make it easier than ever to shop online. Customers are now able to purchase just about anything with one tap on the screen of a smartphone or tablet.

Simply put: devices like smartphones and tablets have transformed the way businesses and consumers interact.  Not only are retail giants accommodating the growing mobile industry, but many are proactively tailoring their services to attract more of this business. The mobile commerce industry is expected to account for over $170 billion in sales by 2015, up from approximately $1 billion in 2009.  With hundreds of millions of smartphones being sold every year, businesses are wise to invest in their mobile sites, both in terms of user experience and consumer safety. The question is no longer how to integrate mobile commerce into customers’ daily routine, but how to protect them while they are browsing and using private information.

Who is at risk?

McAfee Labs’ Q1 Threat Report provides some unnerving data for those using smartphones. Some key points: The number of malware samples in McAfee’s database has shot up from less than 2,000 to more than 8,000 since 2011.

Nearly 7 out of 8 of attacks and malware are found on the Android platform, though Mac malware is clearly on the rise.

One key statistic of note is that almost none of these threats originated from the Android Market.  When launching your company’s mobile app, stick to well-established venues like the Android Market or the Apple App Store, reducing the risk of unwittingly exposing your customers to malware.

The Global Market:  How many phones are we talking about?

Data from the Q1 Report clearly shows that the most at-risk platform is Android.  If we look at a breakdown of the current market share for mobile phones from an International Data Corporation (IDC) report, Android also accounts for over 60% of smartphones globally.

The U.S. Market

A February Nielsen report states that approximately 50% of U.S. mobile subscribers own a smartphone, and of those smartphones, 48% are running on Android.

According to these numbers, Android users make up a significant portion of the smartphone market. Thieves are following the money as mobile commerce becomes a larger force, only increasing the dangers to Android and other smartphone users over time.

As customers are increasingly aware of the existing threats, many are hesitant to hand over their credit card information directly to websites. The task for retailers now becomes twofold. How can retailers both protect consumers from the inside, but also help them feel at ease about sharing their private data?

What it all boils down to:

 Vulnerability scanning options like McAfee SECURE™ service can help protect against malware threats and vulnerabilities and help organizations meet PCI compliance requirements. Additionally, the placement of a security seal shows visitors that their sensitive information will be handled responsibly – ultimately turning security-savvy shoppers into buyers.  Especially in regards to the booming mobile market, security measures are essential. McAfee SECURE service offers what businesses and consumers need to stay safe against data breaches and loss of personal data.

For more information on how McAfee can help your business, visit the McAfee SECURE website and follow us on Twitter @McAfeeSECURE for the latest on eCommerce news, events, and resources.

By Nancy Levin