Should Pharmaceutical Companies be Putting their Heads in the Cloud?

Despite concerns over regulation and data protection, cloud computing is entering the world of pharmaceuticals. There are good reasons why the cloud might suit pharmaceutical companies-greater efficiency, lower costs, the ability to take data in the public domain and mesh it with private data sets-all good reasons to embrace the cloud. But, assuming that the regulatory concerns can be overcome, is the cloud what it appears to be?

According to a 2014 report from Kable, information and communications technology (ICT) spending in pharmaceuticals increased last year. Of 102 pharmaceutical companies surveyed around the world, 46% increased their ICT budgets in 2013, a growth of 11% compared to 2012. Interestingly, the report noted that pharmaceutical companies had made investments in their data centres and applications. In 2013, 19% of ICT budgets were allocated to data centres, followed by enterprise applications at 16%.

These figures clearly demonstrate that pharma companies are still quite nervous about putting data in the cloud. It has been done; for example, Roche has been reported to use cloud-based email and some other services that do not expose them to sensitive data. Pfizer was reported to use a cloud environment to support an online clinical trial, but are there hidden risks that pharmaceutical companies need to be aware of?

"Cloud" means many things to many people. It could, for example, mean using cloud-based software. If this is the case, there are several risks. Firstly, the data protection and privacy concerns will come right back to the surface. If company X is sharing the same application as company Y, what will ensure that the security is maintained to a sufficient standard that means company’s X’s data will never become available to company Y, and vice versa? There have also been a number of public cloud security breaches in recent months where this scenario would have been quite likely. Secondly, there is the risk of cloud lock-in. This is a common problem with the cloud, but in terms of a cloud-based service where the software is the cloud product, the data will almost certainly have been modified to ensure compatibility with the providers’ systems. (This may only be a case of matching field names in a database, but could be much more complex encryption or other modification.) What happens if the company wants to change providers? How will they get the data back to its original state?

Cloud may include the infrastructure too. In other words, the pharmaceutical company “outsources” the infrastructure. They are no longer responsible for managing the servers, the storage, or the network. This has advantages both in terms of capital expenditure (capex) versus operational expenditure and in terms of the IT management. But, it also comes with huge risk. What happens if the company wants to move back from the cloud?

Significant capex will be required to build a new infrastructure from scratch, which is likely to take several months. There is, of course, an alternative-move the data to another provider. Since the first cloud provider will have its own proprietary systems, it won’t be that simple. The environment can’t just move from one provider to another because the two systems will be built differently and configured differently.

Vendors are nervous about customers changing providers and are therefore not making the whole task of migration easy. Vendors will try to lock-in customers to avoid them migrating to a new provider. For the customers, they often don't know how the lock-in will impact them until it is too late, and this can be devastating when it happens.

Data ownership issues are a concern for many pharmaceutical companies too. Recent years have seen providers attempt to take ownership or rights over content that belongs to their customers. In 2012, Instagram made an attempt to monetise their users' content without permission. Sales of personal data between unscrupulous online providers has become commonplace. While this is less likely to happen with business data, complacency is not an option. Who wants to be headline news because it did happen to them? Or worse, lose the intellectual property that has taken years to develop?

So what is the solution for a modern pharmaceutical company? Clearly, pharma companies, like any other, want to move forward and to adopt new technology and exploit it to give them a competitive advantage. Cloud computing offers many advantages both in reduced management and reduced costs, but the risks need to be properly understood and mitigated. There are companies that offer a “hybrid” solution, and this may be the answer. Carry out a full and proper analysis of every application, the data that it supports or processes, and the risk to the business if its security were to be breached. There will be some applications that might suit the cloud, although we would assert that email is not one of them. Emails inherently contain private information and attachments that are highly confidential to a business, they must therefore  be placed into a colocation environment managed by people you know.

Colocation comes with many advantages. Lower operational costs, greater efficiency, and a degree of outsourcing enables the business to take advantage of the services offered by a commercial data centre but still maintain control over the environment. Security is paramount in the pharmaceutical industry and colocation  addresses that. The pharma company maintains its own infrastructure in a highly efficient but highly secure data centre environment and gets the benefit of the efficiency and reduced costs without the risk that the cloud represents.

The message “Go to the cloud, that’s the future” is valid for some, but if I were a pharmaceutical company, I’d be looking towards colocation rather than sticking my head in the cloud just yet!

Jacob Barreth is director of MigSolv, a data centre consultancy.