Leveraging Cloud in Compliance led LifeSciences Industry
Cloud computing as a technology and service has offered increasingly compelling solutions to the Information Technology needs across all sectors. With a variety of on-demand service offerings, flexible modes of deployment, seamless collaboration and centralized management as key drivers industry is fast transitioning to cloud.
The Life Sciences sector has not been an early adopter of cloud, mainly due to concerns related to regulatory compliance, transparency and liability. As demand for the benefits of cloud services increases within the sector, solutions are beginning to emerge which have potential to accelerate cloud adoption in the near term. The coming years will see increased collaboration between the Industry, cloud providers and regulators to unlock the benefits of cloud, identifying solutions where barriers stand today.
Cloud as a technology comes with tremendous benefits in terms of faster time to market, lower cost, easier scalability and smaller investments. Cloud service offering include the following:
IAAS - Elastic provision of servers, network and services
PAAS - As above, with additional provision of OS/middleware/databases
SAAS - As above, plus management of application software
Cloud can be deployed in these ways:
Public - Common infrastructure serving all customers, potentially across multiple geographies. The most flexible and efficient model from a service perspective.
Private - Unique infrastructure managed for a specific customer. Less flexible and efficient, however offers customers more transparency and control over infrastructure.
Hybrid - Combination of the above two models, where certain infrastructure components are unique to a customer while others are shared.
Some of the major benefits that cloud as a technology has to offer to LifeSciences Industry are:
Seamless integration and collaboration - Cloud helps in increased collaboration of data where multiple agencies can simultaneously upload and access the information. E.g. the different departments in the CRO looking onto the patients' data for analysis
Centralized systems - It allows the system/application to be accessed from any location at any point of time. The application over cloud can be installed configured and upgraded centrally. E.g. Online Health care application taking inputs from the patients and providing the diet recommendations
Data Collection and Management - Data Collection and consolidation would be faster. E.g. the clinical trial data from patients located at multiple geographical locations.
The Compliance led LifeSciences Industry in general had been lagging behind to embrace this technology because of some of the challenges. Some of these key challenges and possible solutions are:
Data Integrity - Includes the risks associated with Data Security and Privacy over the cloud computing platforms. Data transfer between the local client and the remote server over the cloud needs to be completely secure and reliable. To mitigate this Cloud Users must ensure that the provider has Infrastructure in place to take care of Data Protection, Access Management and Incident Response. It is recommended to use encoded and encrypted data instead of plain text data for storage and transmission. Cloud providers are increasingly demonstrating their credentials in this area through specific contractual agreements with customers, for example Business Associate Agreements with customers subject to HIPAA. However it a troublesome area with multiple disparate regulations around the globe, this require the need for a homogeneous Data Privacy Framework globally.
Providers Quality Systems - This requires the suppliers of cloud based services to comply with regulations laid down by various federal authorities and regulators. Demonstrable control over assets from planning through management is key for life sciences regulators. SOP's, qualification, change control, training are all areas a typical customer would require from internally provisioned services and extend that requirement to service providers. In this respect, providers are becoming more aware and responsive to customers, either through maintenance of industry standard certifications or through specific processes aimed at the life sciences industry, for example Microsoft's qualification process for platforms supporting Office 365. At the same time, consumer of the cloud needs to ensure that supplier has taken care of the security and legal aspects by doing regular audits. Acceleration of the use of cloud will require increased analysis of the way cloud providers ensure quality and to what extent this achieves the same ends as the traditional controls operated in-house today. ISPE GAMP have initiated a Cloud Computing Special Interest Group with that express purpose.
Contracts and liability - Liability in terms of outage or data loss is an area that has limited uptake from the industry. A global pharmaceutical organization terminated its plan to expand use of the major cloud provider services due to inability to agree liability terms. In recent months, cloud liability insurance has been proposed by the insurance industry however ability of such insurance to cover the scale of potential loss within the life sciences industry is not yet clear.
Auditability - Extension of regulated IT infrastructure into the cloud certainly adds complexity to the environment that may concern life sciences regulators. Governance and transparent management of the services extended to the cloud, along with mapping of typical provider certifications to GxP requirements is an approach that may be adopted, however concerns remain around the auditability of the public cloud.
Uptake of cloud based services is gaining momentum as the service providers and life sciences industry work through some of the challenges highlighted in the article. Many of the regulatory issues have restricted usage to private or hybrid models, such as with Microsoft Office 365, QUMAS OnDemand, Veeva CRM.
Service providers and academics increasingly propose that they are now in a position to meet the requirements for providing regulated applications and content on a public cloud. Concerns from the industry, they propose, may be addressed by leveraging collection of certifications and independent audit reports that several providers can now boast.
Acceptance of this position within the industry remains a challenge and will likely remain so until regulators issue guidance or successful regulatory audit precedence becomes established. There is however, a groundswell of opinion within life sciences that cloud is firmly in their direction of travel as they strive to provide an agile IT infrastructure. A multi-lateral approach involving regulators, industry bodies such as Open Data Center Alliance (ODCA) for standard framework, service providers and Cloud Ecosystem Integrators will be key to further unlocking the potential of the cloud for the benefit of not only the industry and investors, but also for patients through step change in the ability to process and analyses data in the development of effective and tailored medicines, medical devices and other healthcare products.Created with Inputs from David Frew