Operating as a Hybrid Entity at Cornell John Ruffing – Assistant Director, Center for Advanced Computing (CAC) Cornell University Associate Director, Information Technology and Services Weill Cornell Medical College 1

Overview Informing Perspectives Organizational “Objects” Cornell Logistics

Perspectives Institutional Individual

Perspectives: Institutional Medical campus Significant separation –Distance, governance, ERP Burdens –Extensive –Expensive (potentially)

Burdens: Extensive Executing –Administrative –Technical –Physical Maintaining –Documentation –Training/Awareness –Periodic Review

Perspective: Individual Medical campus Previously led –EHR implementation (Epic) –SAP technical teams Coordinate IT aspects of audit

Overview Informing Perspectives Organizational “Objects” Cornell Logistics

Organizational Objects Covered Entity Organized Healthcare Arrangement Business Associate

Covered Entities Health Plans Healthcare Clearinghouses Healthcare Providers who –Electronically transmit Any health information in connection with –Transactions for which HHS has adopted standards 9

Typical HPC Providers Not covered entities themselves Not part of covered entity Handling identifiable data –Within the same institution –Ultimately from a covered entity 10

Covered Entity Trap Entire legal entity –Often more than really applies Unnecessary burden –Extent –Expense 11

Hybrid Entity Escape? Covered components –Same criteria as entity –Distinct and relevant Function Governance Formal designation 12

Cornell as Hybrid Entity Four components –Medical campus –Student health center –Benefits –Counsel Where is HPC? 13

Typical HPC Providers Not covered components themselves Not part of covered component Resistance to including –Burden –Definition 14

Business Associate Relationship to covered entity –For or on behalf –Other than in the workforce Separate legal entity 15

Overview Informing Perspectives Organizational “Objects” Cornell Logistics

Where is HPC? Privacy Rule –Extend the workforce Security Rule –Extend the protections Only as needed

Including HPC at Cornell Reminder: medical campus perspective Extending walled garden –Potential savings Not yet trying to share full resources Three aspects

Including HPC: Physical Co-lo –Already has personnel controlling and logging –Rationale for remote location Separate racks –Separate keys and associated controls

Extending to HPC: Technical IP Network –Extension of med network into data center With all security trimmings –Air gap (garden wall) to other networks Storage –Separate physical disks Shared array, on private management network –Shared storage switch Separate when volume makes feasible

Extending to HPC: Administrative Sharing Workforce –The lesson of athletics –Sysadmins leverage med training and awareness, follow documentation and procedures –Joint position supervision (direct control) Compliance –Elements accountable within garden E.g. shared array, on private management network –Other frameworks and HITRUST