At the Big Thompson Medical Group in Loveland, Colorado, the previous director of IT operations, Marc Soldner, contracted security to an outside firm because he didn\’t have the staff to handle it internally — and saved by not having to hire a dedicated person.
Big Thompson, a $20 million to $30 million healthcare group with 250 employees spread across eight local clinics in Colorado with about 200 computers, did fine with just a single IT staff member at the company headquarters reporting to Mr. Soldner. In addition, Mr. Soldner had one person with a non-IT job at each site trained in basic issues and available for rudimentary fixes, such as checking connections and powering a machine off and on. IT functions in the company\’s accounting department are handled separately.
The system works on such slender staffing because it relies on outside companies for a number of IT functions, including security. Mr. Soldner estimates that by outsourcing security, he saved the yearly cost of hiring and managing at least one network security professional. And the organization is happy with the relationship he set up with the outside security vendor.
–> TIP #1: Figure out what functions require security to put together your request for proposal or statement of work.
Included in the $30,000 security outsourcing deal were detailed specifications such as secure connectivity for employees needing to reach sites outside the company, for outside doctors who needed to contact other secure or insecure areas while visiting the building (such as a hospital\’s secure data on a patient), and for staff members connecting to Big Thompson\’s secure site from home.
The network consists of eight sites, with the central site in Loveland, Colorado, a few hours outside Denver. In October 2000, when the company launched an external-facing Web site for marketing and informational purposes, Mr. Soldner hired the outside security company. Prior to that, ÒWe didn\’t need security because we weren\’t connected to the outside world.Ó A major upgrade followed in December 2003.
The driver for outsourcing security was financial, Mr. Soldner said. ÒI can hire a company to manage our routers for significantly less [than handling it internally].Ó
There were two parts to the initial security contract, Mr. Soldner said — to upgrade the routing environment for the company\’s own Metro Area Network (MAN), making it secure and fast, and to put together a Wide Area Network (WAN) for connecting the company to the outside world via the Internet. That involved some routing, some firewalls, setting up secure environment, and more.
–> TIP #2: Don\’t assume you\’ll simply pay a retainer. Explore all pricing options.
After the initial work was done, Mr. Soldner set up an ongoing arrangement with the company, a small firm based in Boulder, CO called The Root Group. For ongoing work, the service provider proposed two hourly rates. Under one structure, Mr. Soldner could get immediate service at an expensive price, in which The Root Group either dials into the client network or sends someone immediately onsite. The second option is a less expensive Òbundled hoursÓ setup, in which the client buys hours in advance as a package and accepts a slower response time.
Big Thompson Medical\’s Web sites themselves are managed by a separate company out of Denver, so the security firm handles everything else, including e-mail, firewalls, and routers. Ò[Internal people] set up and manage the e-mail accounts,Ó Mr. Soldner said, and Ò[The Root Group] makes sure the process is safe. They do the routers, the firewall, and they\’re the next tier up if Qwest [the Internet service provider] can\’t [fix a problem].Ó
Mr. Soldner said he began the outsourcing effort by looking for companies Òthat would let us connect to the outside world, transfer data, and maintain the integrity of patient records.Ó This was pre-HIPPA, the Health Insurance Portability and Accountability Act, the government regulation mandating a higher level of confidentiality in patient records.
–> TIP #3: Expect to justify the outlay for IT security services to management. And do it in a form (and forum) they\’ll understand.
Big Thompson is a privately held corporation that is owned by the physicians who work at the clinics; so explaining and selling technology solutions to doctors was part of Mr. Soldner\’s job.
He said that in the face of HIPPA and other regulations, the importance of securing patient records especially was well understood by management, which took only a financial interest – ÒROI kinds of thingsÓ — in his proposed solutions. ÒThey were interested in security, interested in different processes for achieving it, and the benefit it had,Ó he said.
His company was already HIPPA-compliant, Mr. Soldner said, but any change to software can raise HIPPA issues, so he looked only at outsourcing companies that were familiar with HIPPA.
He met with the decision-making doctors initially in one-on-one meetings, then held a series of meetings of 15 doctors at a time, giving them the opportunity to ask questions and bring up concerns. Questions included, Why are we doing this? What is it going to cost us? Can I trust it?
At the same time, Mr. Soldner was working with an outside Web company to build the firm\’s Web pages, which were to be kept on the outside of the firewall. The security company helped, for example, when it was time to put in the routers. ÒThey have the people who can configure them,Ó Mr. Soldner explained. ÒI didn\’t have anyone who was router-savvy.”
–> TIP #4: Expect to negotiate on new projects that aren\’t part of the original discussions.
The structure for managing the relationship with the vendor, Mr. Soldner said, was informal by his choice. Since both are small firms, the arrangement worked well. ÒI could either call or e-mail them [for assistance]. There\’s a flat fee set-up, so they charged me for time after that.Ó
For a project such as setting up a new clinic, for example, Mr. Soldner said he negotiated that as a package deal with the security company. ÒThere\’s no monthly retainer. If I had a failure, I called [and] they diagnosed.Ó That arrangement, he said, can be Òvery priceyÓ because of the guaranteed 24/7 response, which he finds critical in the medical field. Thompson Medical, as a series of medical clinics, simply can\’t afford to have a site down when someone may be trying to reach them.
With the relationship in place, Mr. Soldner said the time he spent on the vendor relationship was Òvery minimal — probably just a few hours a year.Ó The initial setup took Òa couple of weeks working out what we needed and wanted.Ó
When he did have an issue — someone using his mail server for spamming — it was resolved quickly and successfully. ÒWe knew this because we monitor bit packages going in and out to watch traffic, and that suddenly jumped way up. I called the security firm to ask what was going on. They dialed into the server through the VPN [and] found the configuration error. It took one phone call from me, and they had everything worked out in half a day.Ó
The cost of that emergency fix? Just $600 to $700, Mr. Soldner said, clearly Òwell worth it, just not to be irritating users.Ó
ÒI was pleased,Ó Mr. Soldner said of the security deal. ÒFor this organization, this is a really good setup.Ó In addition to giving him two pricing options, depending on urgency, he liked the Òrun-over-by-a-bus advantageÓ of having outside experts who know the company technically. If something happened to him, Òthere was somebody out there who really knew what was going on. I think that\’s really important, especially in small businesses.Ó
That worked both ways, since Soldner was highly technical himself: ÒIf something happened to the security company, I knew how to get hold of the router configurations.Ó
Useful Links:
Big Thompson Medical Group
http://www.bigthompsonmedical.com/
The Root Group
http://www.rootgroup.com/
/home/home.aspx?i=02_8/16/2005_cn_229_1_00_00
