Eliminating the Digital Divide in Life Sciences, Part 3: The Truth About Cloud Security

Three-quarters of life sciences CIOs and IT execs say security risks are main reason for opposing cloud technologies

Published: Wednesday, June 5, 2019 - 12:03

While most business sectors have welcomed the efficiencies and benefits that cloud technologies and software-as-a-service (SaaS) offerings bring, the life sciences industry has been slow to embrace external cloud networks. Merely a decade ago, in fact, an International Data Corp. survey showed that 75 percent of CIOs and IT executives in life sciences and healthcare fields surveyed said that security risks were their primary reason for opposing cloud technologies.

Cloud-averse attitudes are slow to change, and industry research shows that companies that manage health information continue to show major resistance to cloud technology.

Why life sciences organizations are cloud-cautious

Life sciences organizations’ reluctance to make the move to the cloud is understandable, given the importance of data security in an industry that regularly handles patients’ protected health information, proprietary documentation about drugs and medical devices, and similarly sensitive content. The prospect of sending data to an off-site server can be unsettling when the welfare of your business, products, and consumers is on the line.

The main objections life sciences organizations have to cloud technologies can be grouped into three general areas.

1. Data security and integrity
There is a persistent fallacy that premise-based environments are more secure than cloud environments. What many life sciences organizations fail to consider is that cloud-based solutions from reliable vendors counter the changing threat landscape with continual updates made by engineering teams whose sole focus is security as it pertains specifically to their application and its intricacies. In on-premise environments, conversely, IT teams apply a general security blanket to all applications and then must dedicate a resource to address each threat on an ad hoc basis (e.g., either an internal IT department frantically attempting to put out fires or a software system provider coming onsite to fix problems). What’s more, not only are on-premise software systems continually depreciating, but their security risks increase the more outdated they become. Those risks increase exponentially for “version sitters” who aren’t regularly upgrading to a software’s most recent release. And, if version sitters finally decide to upgrade, the compliance burden becomes increasingly heavier the longer they’ve waited because it will take more time and effort to validate.

2. Risks to regulatory compliance
Some life sciences organizations fear that moving data to the cloud will somehow jeopardize compliance. This mentality flies in the face of the pro-cloud initiatives promoted by the very regulatory agencies that monitor these companies’ products. Case in point: Prior to stepping down as the commissioner of the U.S. Food and Drug Administration (FDA), Scott Gottlieb urged developers at the 2018 Health Datapalooza to “find new ways to use cloud-based services and tools to support patient health and support more effective treatments, tailored to a patient’s needs and preferences.”

3. Negative impact on business
Many companies worry that the time, effort, and resources required to upgrade systems and move to the cloud make cloud-migration costs prohibitive. Others fear that any disruption to their organization’s status quo will adversely affect operations.

Planning, budgeting, and related migration activities are certainly going to be more disruptive than simply flipping a switch to magically activate a new infrastructure. But a closer look at the cloud solutions available on the market reveals that reliable vendors have developed well-established migration paths. Experienced providers have worked with hundreds of customers in life sciences environments to streamline deployments and minimize disruptions.

Benefits of embracing the cloud

While some in the life sciences still consider external networks to be an unproven and possibly passing fad, the technology is steadily becoming an industry mainstay. What started as a slow shift—largely sparked by the benefits demonstrated by research and development laboratories—now has the potential to bring an array of efficiencies and competitive advantages to life sciences companies, including the following.

Improved—not imperiled—security
Our society has a long history of entrusting important personal and business information to qualified third parties like postal services and telecommunications companies. If appropriate security measures are taken, trusting that our data will be kept safe in the cloud shouldn’t be any different than mailing a check or providing a credit card number over the phone was 20 years ago.

With cloud technology, security enhancements are provided via automatic updates from the provider. Security issues can be found faster, and patches are applied quickly and universally. Cloud service providers also have the expertise and technology to provide continuous security monitoring and incidence response, something that few IT departments can handle in-house.

Faster responses to, and resolution of, security issues
Is it safer to trust your IT staff to stay current on security issues—piling additional burdens onto already strained workloads—or rely on a security-focused team of specialists who have so much experience working within a tested cloud environment that they know exactly where to look for issues and the best way to rectify problems?

Accelerated compliance
Life sciences companies that have made the switch to cloud technologies report that they’ve been able to double or even triple the speed at which they’re able to operate in regulatory environments. “We proudly boast that we were actually able to take a product idea for a fairly complex medical device from paper napkin all the way to a full 510(k) FDA submission in less than one year,” says Fritz Haller, owner/managing director at Intelligent Endoscopy, about the efficiencies his company gained by implementing a cloud-based enterprise quality management system (EQMS).

One of the biggest hurdles life sciences companies must clear to achieve and sustain regulatory compliance is the validation of their computer systems, as specified in regulations and standards like the FDA’s 21 CFR Part 11 (for drug companies) and 21 CFR Part 820 (for medical devices). Cloud technology is dramatically accelerating validation processes, as unique solutions like MasterControl’s Validation Excellence Tool (VxT)—the first automated validation tool for regulated companies—are proving. MasterControl customers that use VxT have streamlined their validation efforts, trimming 336 hours in overall project preparation time and cutting actual project execution from 104 hours of labor-intensive activities to just 20 hours of total validation project time.

Research virtualization
In areas like drug research, the cloud offers the invaluable capability to connect the various parties involved with research data systems, and enables them to collaborate in ways that were previously unimaginable. “Externalization—basically the virtualization of research—has been the prime driver to get people over some of the resistance and move to the cloud,” Michael Elliott, CEO and chief analyst of the life sciences IT consulting firm Atrium Research, told Chemical & Engineering News. “People are beginning to think that it’s time to look at a different operating model.”

That new operating model is changing the way research organizations innovate therapies; administer activities; and engage with study subjects, consumers, and patients. In one instance, the clinical research company, Science 37, reported impressive efficiencies during the course of an entirely virtual Phase 2B placebo-controlled trial in which more than 8,000 individuals were screened and 372 participants were enrolled. The use of a cloud-based platform resulted in a 30- to 50-percent reduction in the projected enrollment time.

The potential to leverage blockchain
The decentralized operational applications and information sharing facilitated by the cloud opens the door to other associated technologies that might benefit the life sciences in similar, complementary ways. Blockchain tops the list of beneficial technologies that are perfectly suited to work in tandem with the cloud. As an immutable, decentralized ledger that serves to distribute data while maintaining its integrity, blockchain has the potential to be a game changer in the life sciences.

Take clinical trials, for instance, which typically involve data aggregation and information sharing processes that are time consuming and prone to error. The synchronous use of cloud and blockchain technologies is expected to revolutionize data aggregation in clinical studies by facilitating an unprecedented level of security, validity, accuracy, and automation. As a recent Deloitte report noted, granting researchers greater access to data hubs will foster an environment where “there will be no shortage of medical information that can be analyzed, which could ultimately lead to a more efficient care ecosystem.”

Business benefits
Some of the business advantages that the cloud provides to life sciences companies include:
• Decreased capital investment and operational costs
• Less reliance on in-house IT expertise and infrastructure maintenance
• Increased scalability and agility (which life sciences companies need to handle diverse sets of data types)

Another less conspicuous consequence of the upsurge in cloud technology is its contribution to the leveling of the life sciences playing field. In more and more instances, the cloud is allowing startups and other smaller companies to affordably leverage the same powerful tools that massive, multinational corporations use. “Now we have widespread deployment of sensitive data in the public cloud in compliant ways,” says Microsoft chief medical officer Simon Kos. “And as the big, hyperscale cloud providers engage in competition in the market, we’re seeing the cost of storage and computing drive right down.”

A proven cloud platform allows a company of any size to reap the benefits of optimized security, according to Deloitte Risk and Financial Advisory principal Kieran Norton. “If you’ve invested $1 billion in your cybersecurity program, you probably have a pretty secure network,” Norton says. “But if you don’t have that kind of money, there are cloud providers who can dump more resources, technology, and R&D into building that base infrastructure and securing it so it can be leveraged in a way that a company alone could never match.”

As an added bonus that benefits large and small companies alike, software updates for cloud-based solutions are seamless, automatic, and applied universally for the benefit of all users. With the cloud, life sciences organizations are not dependent on a third party coming onsite to provide upgrade assistance.

Moving cloudward

The progression of disruptive technology innovations like the cloud continues to be relentless, and that momentum is making it less and less feasible for life sciences companies that store data on-premise to stay competitive. Cloud security, once thought to be a liability, is now proving to be a business accelerator. The unprecedented agility, speed, and controlled accessibility that the cloud provides helps life sciences companies get their processes validated and products to market faster than ever before.

About The Author

Matthew M. Lowe

Matt Lowe has served MasterControl for nearly two decades across several different executive leadership roles including product, engineering, sales, and marketing, and now will continue his tenure as chief strategy officer. In this role, Lowe brings vast institutional knowledge of the market, MasterControl’s products, and customers to identify growth strategies and expansion opportunities for the company. He also serves on the MasterControl board of directors.

Lowe is a medical device expert with experience in product development and product management at Ortho Development Corp. and Bard Access Systems, a subsidiary of Beckton Dickinson. Lowe has successfully launched more than a dozen medical devices and has five patents issued and one pending. His regulatory experience includes writing a 510(k) that was cleared by the U.S. Food and Drug Administration and managing a multisite, multiyear postmarket clinical study for orthopedic devices.

Lowe has a bachelor’s degree in mechanical engineering from the University of Utah, and an MBA from Indiana University.