Using Tiered Storage to

Retain Electronic Medical Records

In previous papers we addressed the general concerns of security, chain of custody, retention period, data integrity, scalability, compression and interfacing an Archival system to your EMR. Click here for more info.

 Many experts are recommending the use of Tiered Storage to address the costs associated with maintaining this EMR. This is especially true with medical images since they represent the largest quantity of digital storage. Although this paper was written with specifically for retention of medical records, a tiered solution should be considered for any long term Archival need.

Typically, the process is to capture the image on Tier 1 storage and keep it there temporarily during clinical review. At some point, usually within a month, the images are moved to Tier 2 storage. After six months, the images are then moved to Tier 3 or higher because future clinical review would not require instantaneous access to the medical images. This is usually done by using scripts so it doesn’t take much manual effort to move this data from one tier to another.

Below is an example of how to use tiered storage in a medium to large Healthcare information system. Definitions of tiered storage vary greatly from vendor to vendor and medical organization to medical organization. This example of tiered storage is based on raid levels, performance and cost:

-    Tier 1 15 KB or greater, 146 GB Fibre Channel (FC) disk with RAID 5 and shadowing (approximately $15 per gigabyte). This storage is used for data that needs to be accessed in microseconds that have mirrored copied that can be accessed with little or no performance degradation

-    Tier 2 10 KB, 300 GB FC disk with RAID 5 and shadowing (approximately $10 per gigabyte). This is storage typically used for applications.

-    Tier 3 10 KB, 300 GB FC disk with RAID 5 and no shadowing (approximately $5 per gigabyte). This is used for images that does not change where slower response times are acceptable.

-    Tier 4 1 TB FATA disk with RAID 5 and no shadowing (approximately $3 per gigabyte). This storage is used for long term storage that is rarely accessed and long access times are permissible.

Note these costs quoted are the cost for raw storage and do not include any additional costs for maintenance, testing, recovery, electricity, cooling, etc.

 An effective way to manage image storage is with an enterprise storage area network (SAN) solution. Some image vendors, especially those that want to manage the entire imaging system, will insist on a direct-attached storage array. But most imaging vendors realize the investment a health care institution makes to a SAN solution and will work with its information systems department to use SAN storage.

 One of the important things to remember when is that the Food and Drug Administration (FDA) does not require an approval process for disk storage for medical images. Click here to see the actual regulation.

 Tiered storage in a SAN environment allows for storage management you wouldn’t see in a standalone storage environment. This includes on-the-fly backup snapshots, performance monitoring, storage reassignment across different tiers and multilevel SAN redundancy. Migrating SAN logical units from mirrored sets to non mirrored is also easier to manage in a SAN environment when you want to economize on capacity for data that no longer needs mirroring-level redundancy.

 Although the enterprise SAN solution does address the cost of actual storage eventually moving images to Tier 3 or Tier 4 storage, it does still take significant effort and therefore cost to address some of the nuances of Healthcare requirements.

 Integrity of Data – Although the longevity of storage continues to increase, it does not approach the requirement of keeping the integrity of the data for decades. The SAN does take mirrored images making multiple copies so if a disk goes bad, there should be another copy around if need be. A procedure would have to be put in place to periodically test the disk and re-copy the damaged/lost data. This is especially true for Tier 3 and Tier 4 storage.

 Chain of Custody – Since the data can now be located on a number of devices, any access of the data outside of the EMR or PACS systems would be difficult to maintain (assuming the PAC or EMR builds an accurate chain of custody.

 Version Compatibility – Keeping the data available for decades brings up a potential problem of compatibility between versions of software that the healthcare provider may use, i.e. the data captured in 2009 may not be compatible with the software being used in 2030. So although the data may be in-tact, is can still be potentially un-usable. Some work around will have to be developed each time a software upgrade or change is made.

 Security – Assuming the Healthcare provider’s overall network is protected by firewalls and other security software including encryption, the storage network should be protected by those techniques. However, if off-site storage is used, additional security measures will need to be incorporated.

 Availability – The SAN environment gives a very responsive environment for healthcare records, they may actually be faster than required. The vast majority of patients are scheduled days, even weeks in advance and the data can be moved to Tier 1 storage long before the patient is treated.

MAID (massive array of idle disks) storage technology have been introduced that will help in the overall costs of storage. Using MAIN technology, only those disk drives in active use are spinning at any given time. MAID reduces power consumption and prolongs the lives of the drives. A MAID is usually constructed with low-cost Serial Advanced Technology Attachment (SATA) drives, which have shorter mean time between failure (MTBF) ratings than more expensive drives.

When MAID is implemented, every drive is periodically tested. If a drive shows signs of failure, data is transferred to other drives. A MAID has far greater storage density than a RAID (redundant array of independent disks) system of equal cost. In addition to reducing power consumption, the cooling requirements of MAID are also reduced.

Limitations of MAID include lower throughput than conventional disk arrays and longer latency times while inactive disks spin back up. Since lower cost drives have a higher tendency for failure other techniques need to be introduced to insure the integrity of the data stays intact.

Implementing a tiered solution with MAID technology does reduce costs, but it does introduce other complexities and costs that most healthcare providers do not have the time nor the technical competency to address. For this reason, a “cloud” or service based solution appears to make sense. However, a cloud based service brings another set of challenges as to security and compliance that many healthcare professionals are still uncomfortable with. These challenges are to be addressed in subsequent papers.

Contact Visage Solutions today to see how we can assist you with this and other compliance matters.

_________________________________________________________________________

About Visage Solutions – www.VisageSolutions.com

Visage Solutions is a consulting company operating in the areas of regulatory compliance, risk assessment, information security, risk management and compliance processes. Utilizing our proprietary SingleVue™ and OpsAudit™ methodologies, the company focuses on assisting business entities in mitigating operational risk. Visage has provided solutions to a client base ranging from private, entrepreneurial companies to large multinationals. Our team is comprised of experienced executives, managers and consultants who can assist clients with the development, implementation and execution of their risk management and compliance strategy.