Epic Tells Customers It Will Stop Google Cloud Integrations

What if something questionable happens, even if it's legal, and you're found to have handed over patient data to Google, the largest ad targeting firm on the planet?

Pointing at legalities will not save your reputation or your job in the face of glaring misalignment of interests.

It's like letting your dog guard your employer's sausages after giving it state of the art training in self control.

Now they all do their best to feed your data straight into Google, while other similar products do their best to protect it. How long until GCP says 'let's pool all of our data for machine learning' or 'centralize your network traffic for security analysis' and 'We've updated our privacy policy, please leave immediately if you don't agree to the updates'

It is also very likely that any data collected is used to reinforce and consolidate their main business.

All these things taken together means it is not crazy to imagine that this is the case. If it is not the case currently, we have to assume it will be the case soon and that when it does become the case, historic data is still available. They are therefore always a bad choice.

Sure, and what company would drive around the entire planet and collect peoples private info and WiFi networks? That’s crazy obviously lmao

The solution is to make it fewer competing concerns. We need to make employer provided healthcare illegal (go back to pre WWII) and force competition on the open market. We can still have you buy your own with HSA pre-tax dollars. We need to move to reference based pricing. Payors can't charge more than 1.3 * Medicare. This also solves the "out of network" bullshit, it is all the same so just pay. We also need to separate wellness/preventative from "health insurance". The one you know you will and should perform annually and the other is against catastrophe. Unfortunately, today we treat them as the same thing. I don't think a Medicare for all works but I do think it might work if it was for primary care only. Specialty care and Urgent/Emergency care could be handle by private payors.

[1] https://en.wikipedia.org/wiki/21st_Century_Cures_Act

Healthcare IT is full of deeply committed professionals who deeply dislike Epic.

I'm a fan of Google, but what's with people thinking Silicon Valley companies can easily "get into" everything? What business is Google in that leads you to believe they could run hospitals? They couldn't even design a decent social network, which is their wheelhouse. At least Amazon was selling groceries before they bought Whole Foods.

Because it (atleast the demo) looks like readonly-data aggregation application (that has somesort note functionality that is not directly linked to actual ehr data)

Lastly, all three of AWS, Azure and GCS do try and make a big deal of their HIPAA compatible instances, but whatever the compliance officer at a company is used to is what will get by the easiest - honestly anyone who has a compliance officer that is happy to accept a non-on-premises solution should count themselves as lucky.

All that said - I'd be amazed if MSFT hasn't invested heavily into advertising to cement this decision, but I'd also be surprised if AWS hasn't been trying to dump even more money in there - google just seems a bit clueless when it comes to the convention game and these sort of closed circles where everyone plays golf on tuesdays.

I'd argue it's less because of a belief that a non-Windows environment is inherently insecure and more that Microsoft very aggressively promotes their products as being compliant with regulations like HIPAA.

This isn't limited to PaaS. For example, I think that Teams will likely gain a foothold in healthcare environments over Slack because MS markets Teams as explicitly HIPAA compliant. (Slack explicitly is not).

Things like that buy them a lot of mindshare when it comes time to choose a PaaS provider.

As a result what we end up having is this shadow-structure/architecture at the company that is highly resistant to change, such that when new projects are discussed and designed, oftentimes decisions are made that are technically worse but save time due to not messing with the SOX structure.

I feel the Azure choice might be due to a similar phenomenon. Maybe the Azure people promise all sorts of out-of-the box HIPAA compliance and insurance and security etc. and the upper management is happy not having to deal with it. Price difference almost doesn't matter very much, if saving a few bucks means that you'll now have to hire and retain a team to design and maintain compliance in your AWS stack. I've no idea if this is actually what happens but it smells like it.

I work with hundreds of vendors and digital health organizations that deliver life critical software applications to health systems - and we host everything on AWS. Independent 3rd party HIPAA assessments + a HITRUST (not self assessed) certification goes a long way with hospitals now.

Also, Microsoft support for enterprise customers is just amazing. They have been deploying their own engineers to support enterprise customers in the past for their hosted clouds.

Cant mention much about security but Microsoft does open fewer lower level Apis compared to Linux. For example, it's impossible to do certain socket-level ops with Windows apis. So, in a sense I guess it makes Windows safer at least historically?

People are professionals, and these decisions are important and expensive enough that they are very rarely made by lower level management. Sure your CTO will advice the executives to go with Azure, but it’s not because he or she fears Linux, Azure runs a lot of Linux after all. It’s because of several business related reasons.

When you’re and enterprise sized organisation your IT staff probably knows Microsoft products. They are certified in them, and have worked on them for maybe decades. You probably also already run an Office365 platform, which means you probably already run things like Azure AD, which again means, that training and re-training costs will be millions lower if you stick with Microsoft rather than going with AWS, and Google is typically not even on the table because their support isn’t competitive with Microsoft or Amazon. Not only are there the training cost, but you will probably lose your best IT staff members if you don’t pick the technologies they like, and that’s really expensive in a world where some of the hardest IT people to hire are people who know how to manage an enterprise sized cloud setup.

Then there is the business relationship. We’ve worked with Microsoft for what? Three decades? And while the average Joe was making M$ jokes, they were the only company, aside from IBM, to take enterprise organisations with a lot of different business related needs serious. It’s hard to compete with that sort of history. Amazon actually does a great job with AWS now that they’ve realised just how much money is available in public sector cloud, but they’re still up against a business relationship where we know that we can call directly to Seattle when something breaks and that they will be on the phone with us all the way until it’s fixed. Not having the same relationship with Amazon is a huge risk factor in your strategic analysis, and that is something most enterprise organisations but especially the public sector is very careful with.

I don’t think I’ve ever heard a single argument to run Windows because it was safer than Linux, or any of the million other Internet armchair options on why the public sector wastes its money on Microsoft. The truth is a lot simpler, there is no alternative, and Microsoft is actually very good at selling software solutions as well as support to enterprise organisations. There is no actual alternative to office365, and 90% of the 300-500 applications/IT-systems you operate only run on Windows and have no alternatives available. Like we run a medical journal that keeps track of first graders vaccination history, it’s client only works on Windows and it’s backend is on a mainframe. We’d like to replace it, because only a few companies know how to operate mainframes, which means they can squeeze us on price, but no one has made a competing system, and that’s just one of a million such stories.

If the price difference isn’t significant, you’re going to have a very hard time competing with Microsoft if the enterprise organisation you’re selling to in anyway has to operate part of its backend in a lot of organisations.

It's garbage on the backend because the update process is ridiculously manual. Every minor change sends out a ticket with incredibly detailed instructions, e.g. to update a single element somewhere. The role of the analyst is essentially to execute a script, by hand. Not only is this more costly and slower, it's more error prone. But it creates an ecosystem of these Epic-trained and -approved technicians which helps lock in customers and ensures another steady stream of income to epic.

As for the MUMPS code, there was a node size limitation for the code. Which included variable names and comments. So each code segment (identified by inscrutable five-letter (or less) names like "^ZHMRG") was jam-packed as tightly as possible with one-letter variable names and zero comments. Basically unmaintainable, but I bet they're still using it.

Garbage software. I left in 2007.

They like to hire straight out of universities. It was the second job for me, so I didn't really know to jump ship earlier.

  3. Know that customer data is not used for advertising.
  
  You own your data. Google Cloud does not process your data for advertising purposes.

That said, it's completely understandable that companies don't want to help fund competitors. --Walmart knows that they could use AWS without having any real fear of Amazon employees looking at their data to get a competitive advantage, but they chose Azure because Microsoft is not a direct competitor.

Likewise, companies providing healthcare software look at what Google is doing in that space and they don't want to fund the competition by using GCP.

These are rational decisions that we would expect companies to make. It's actually more surprising that, for example, Netflix still uses AWS given the fact that Amazon is a direct competitor in the streaming business. --GCP or Azure would make more sense here unless Amazon is giving them a really good deal to keep their business.

That being said, and with 15 years of adtech of experience, I guarantee that there's absolutely no usage of business customers' first party data by Google's adtech system. While companies can use it to match and target their users, they have to do explicitly with lots of restrictions and protocols and it's only become more limited with new privacy regulations.