Encrypt source code asp

Is it a business or technology model? Three ASP luminaries drill down for realistic answers to tough questions.

Depending on whom you ask, application service providers (ASPs) can be viewed as a new way to do business or as a new enabling technology. "There's a fair amount of confusion among CIOs as to what an ASP really is," says John Holton, CEO of scheduling.com, an ASP based in Los Gatos, CA. "An ASP is a technology delivery model, a way to deliver software functionality to the client."

But that's not the way Alan Portela sees it. As senior vice president of client relations for CliniComp International Inc., a San Diego-based clinical information systems provider, and its wholly-owned ASP subsidiary, Clinteligent, Portela says contracting with an ASP is simply another form of outsourcing. "This is a business model, not a technological approach. You have to look at ASPs first as a business model before implementing a system."

Most healthcare organizations rely on ASPs simply to host applications on a remote server while providing access via the Internet, and Jonathan Bush, CEO of Waltham, MA-based athenahealth acknowledges that this limits the scope of many ASPs. "I think it's a great business model, but not as compelling as outsourcing an entire business process," he says.

Plus, he asks, "Does the ASP take on enough responsibility to [generate] enough savings to drive a purchasing decision from a healthcare organization? Healthcare organizations won't focus on you unless you offer a significant financial reward for doing so."

While trying to define the parameters of an ASP may seem like semantic hairsplitting, Holton, Portela and Bush agree that healthcare providers must assess individual needs before contracting with an ASP.

A Work in Progress

Holton notes that the genesis of the ASP model goes back 20 years to 30 years when mainframes dominated the computing environment and large companies had data centers from which clients could remotely lease computer time and software applications. But the advent of client/server technology led to wide-scale ownership of software which was run almost totally inhouse.

Now, however, the Internet has changed the face of computing. Healthcare organizations are forced to re-evaluate applications based on which are most applicable to run over the Internet. Holton believes this change will revolutionize the way information is disseminated. "What's the best infrastructure to facilitate distribution of information?" he asks. "It's the Internet," he says. But there is a caveat. "Technology is much more complex than in the past, more complex than client/server ever was. Healthcare is behind the technology curve, but is making strides to catch up."

Many CIOs have not had to deal with Web-based applications. As a result, healthcare organizations must ask themselves if their own IT departments have the technological strength to run every Web-based application inhouse or if they need to outsource these tasks to the professionals at an ASP, Holton says. "ASPs must prove they can handle this stuff better than a hospital and do it more economically and efficiently."

That has been a problem, says Portela. "Many ASPs don't know the needs of healthcare. A few years ago, we started to hire nurses and physicians as consultants to determine our customers' needs." A debate also has been raging over which applications are best run over the Internet and, therefore, could be outsourced to an ASP.

But Holton states that any application that can be Web-enabled can be outsourced to an ASP. Anytime you want to connect multiple sites that go outside the four walls of a structure, you should consider an ASP model," he says.

Upgrades and Training

Holton says that while healthcare providers are not as worried about farming out financial and administrative applications as they are about clinical applications, it's essential to do both.

"Clinical applications need to be distributed throughout the entire delivery system," he explains. "That's more important than financials." Plus, he notes, a growing number of physicians want to be able to pull up a patient's record or their drug history while that patient is still in their office.

Bush agrees, adding that prescription routing and laboratory ordering are easily outsourceable, as are electronic medical records (EMRs). But he also says the best applications for outsourcing are still those "discrete from the core business process" or ones in which the ASP can "make the interface invisible."

A major attraction of outsourcing has been the savings in time and money that can be realized by shifting responsibility from an inhouse IT staff to an ASP. "If you look at the total cost of ownership, a small hospital can save $600,000. Bigger facilities can save up to $1.5 million," says Holton.

When upgrading an application, the new version is put into a "practice environment," he says. If training is necessary, employees have a chance to attend an online "release conference" that usually lasts between 30 minutes and 45 minutes. After a week in the practice environment, the new version is automatically moved into the "production environment," where it replaces the older version. Plus, if an application requires more memory, the client doesn't have to add it on his end; the ASP adds it.

Bush says his ASP offers preview slide shows and conference calls for retraining on newer features of applications although he says upgrades are done incrementally. "The application is morphing under your fingers, rather than being replaced."

The Big "C"

But there is another reason for contracting with an ASP, says Portela--connectivity. When it comes to mission-critical apps where the uptime requirement is 99.99 percent, many hospitals and physician groups don't have fast and reliable connections to the Internet, he says. "Only 10 percent to 15 percent of medical centers have excellent connectivity to the Internet."

In many rural areas of the country, for example, small hospitals and physician practices often rely on dial-up modems for their connections. Even if they have digital subscriber lines, these are usually provided by the local phone company whose own infrastructure may not be the most reliable, Portela says.

Recent telecommunications line problems in the West have made some healthcare providers nervous about using the Internet for mission-critical applications. But Bush says most of the problems have been caused by individual circuits going down.

"It's not the switches on the Internet. It's the switches to get on the Internet." As a way to avoid this problem, which results when switches are forced to handle both analog and digital signals, Bush recommends using a "mission-critical circuit" like a frame relay network. "A frame circuit is a digital circuit from end to end," he notes. "For very little extra money, these circuits can be connected to our servers without ever going over the World Wide Web." Bush says that through a partnership with Global Crossing, his company is able to provide clients "a separate backbone from the public Internet."

Holton also understands concerns about connectivity and states that his ASP has invested approximately $8 million just in connectivity and redundant equipment. "We don't rely on a single telecom vendor," he says. By using AT&T, MCI and Qwest, the load is balanced, he adds. If one connection goes down, the load is immediately switched to the next one without the end user ever realizing that a switch was made. "We've built in redundancy at every possible point. It's the kind of redundancy you couldn't buy," he says.

Privacy and Protection

Security is a big concern for prospective ASP clients. Holton says he can provide features such as virtual private networks (VPN), 128-bit encryption and two-level authentication. Since all servers are partitioned, each client's data stays separate from all others. If a client wants to end its relationship with scheduling.com. "We'll spin out their data and give it to them," Holton says. "We make it very clear that we want no part of owning their data. We're not interested in sharing that data or selling it." As an additional protection, his ASP "de-identifies" data based on HIPAA standards.

Security also is paramount at Clinteligent, says Portela. Four years ago the company was awarded a contract by the U.S. Department of Defense and now serves 13 medical centers including Walter Reed Army Hospital and the National Naval Medical Center in Bethesda, MD. "Because of our contract with the DoD, we were required to encrypt data via a VPN line. But we also have special codes to get into areas that may include patient data," he explains.