Pano System in Healthcare - Pano Logic

TABLE OF CONTENTS
Executive Summary 1
Why Healthcare Needs Virtual Desktops 2
The Pano System 3
Purpose-built Zero Clients 3
Native Windows Driver Support 4
Device-Based DVM Collections 4
Benefits for Healthcare 5
Security/Compliance Benefits 5
Accessibility/Reliability Benefits 6
Cost/Productivity Benefits 7
Case Studies in Healthcare 8
CharterCARE Health Partners Case Study 8
Henry County Hospital Case Study 9
For More Information 10
Virtualized desktops running a standard Windows operating
system but hosted on centralized servers, promise to reduce the
ever-increasing drain on IT resources from deploying and
supporting distributed desktop computing. This promise can only
be realized by radically centralizing 100% of desktop computing
into the data center. This not only improves IT productivity and
reduces end user downtime by eliminating endpoint management,
but it also removes risks to data security on the endpoint and
provides up to a 90% reduction in power consumption.
Pano Logic is the first company to offer a completely centralized,
purpose-built solution for virtual desktops combining unique zero
client endpoints with hypervisor-independent centralized
management tools designed specifically for the tasks of deploying
and managing virtual desktops.
The inability of true zero clients like the Pano to store any data in
the endpoint, even temporarily, helps healthcare providers ensure
they are compliant with a wide range of regulations and industry
guidelines for data security and patient privacy.
And the reliability, operational efficiency and peripheral support of
the Pano System provides much greater accessibility and
availability for critical point of care and administrative workstations
serving users ranging from clinical staff to administrative workers,
and even directly by patients and the public.
Together all of these benefits provide healthcare organizations
with total cost of ownership savings of up to 70%.
This whitepaper explains the technology and architecture used by
the Pano System and how it provides these unique benefits to
healthcare organizations. Three case studies are also
summarized to illustrate real-world experiences deploying Pano
virtual desktops in healthcare providers.
PANO LOGIC: WHITE PAPER

PANO SYSTEM IN HEALTHCARE
Figure 1:
Virtualized desktops work
by connecting virtual
machines running on a
server-based hypervisor
to endpoint devices.
Virtual desktops provides IT organizations and users with access to a virtualized
Windows operating system desktop, along with whatever applications and data are
needed, running on centralized servers in a data center. These servers use
specialized software called hypervisors to create a “virtual machine” (VM) that
simulates roughly the same capabilities as physical desktop computers. These
desktop virtual machines connect over local area networks to specialized endpoint
devices at the users’ location that in turn connect to monitors, keyboards, mice and
other peripherals to make a complete system.
While there are many technological and architectural approaches to virtual desktops,
they all share a common goal – to free the IT staff responsible for an organization’s
Windows desktop computing assets from the constraints and problems associated
with deploying, maintaining, securing and supporting it on physically distributed PC
hardware.
Personal computers have provided clinical and administrative staff with great utility
and power, growing into a robust environment for a wide variety of applications and
tasks. Unfortunately along with that growing utility has come an even more rapid
growth in deployment and management headaches for IT organizations responsible
for deploying and supporting them.
Desktop PCs can require an inordinate amount of management to make them
secure, reliable platforms – and even more troublesome is that these support
activities often require a trip by IT staff to a remote facility on a hospital campus in
order to troubleshoot problems. Limiting user downtime can also require costly
inventories of replacement PCs and spare parts to ensure that business and carecritical
workstations remain available to staff as required.
PCs and laptops also pose many significant security problems in healthcare
providers and insurers as they make it easy to intentionally or inadvertently create
uncontrolled local copies of private patient data. This can expose organizations to
potential liabilities ranging from simple data archiving and destruction policy
violations to complex and costly security breaches or even to outright thefts of
patient or financial data resulting in public relations disasters.
PAGE 2

PANO SYSTEM IN HEALTHCARE
Virtual desktops are growing in popularity because they address many of these
issues. As with any advanced technology you need to make careful choices to get
positive results. The rest of this whitepaper covers the attributes of the Pano
System – a zero client desktop computing platform purpose-built for virtual desktops
– and how it can benefit healthcare IT organizations.
Figure 2:
The Pano System consists
of the Pano Zero Client,
Pano Controller, Pano
Maestro, and the Pano
Direct Service
The Pano System makes it possible for healthcare IT staff to quickly and easily
deploy, manage and support Windows desktops entirely from within the data center,
including provisioning, troubleshooting, backups and updates. It eliminates many
potential security and privacy risks from deploying traditional PCs, laptops or tablets
in public clinical care locations.
The complete Pano Logic solution includes the Pano Controller and Pano
Maestro virtual appliances, Pano Direct Service software, and the Pano Zero
Client endpoint hardware – all provided as one complete product without any need
for mandatory add-ons or complex licensing and pricing. An optional add-on called
Pano Remote provides remote access to Pano virtual desktops from any networked
Windows system.
The Pano System is the only hypervisor-independent zero client solution and
supports the VMware, Microsoft and Citrix virtualization platforms. It also integrates
with each platform’s management tools and a few other network infrastructure
components to manage and authenticate virtual desktops. Together, these elements
form a complete and integrated solution, as illustrated in Figure 2, where servers
host both the desktop VMs, running Microsoft Windows XP Professional or Windows
7, and other system VMs including the Pano Controller and Pano Maestro VMs.
The Pano Zero Client is the heart of the Pano System, consisting of a compact
purpose-built desktop virtualization endpoint that connects the display, input devices
and other USB peripherals to the desktop VM running on the hypervisor server.
It is referred to as a zero client because in contrast to thin clients and PCs it contains
no CPU, no local storage, and no operating system. As a result, it consumes very
PAGE 3

PANO SYSTEM IN HEALTHCARE
little power — about 6.5 watts when fully active and less than 0.2 watts when in
sleep mode — and is both tamper-resistant and highly secure as it never stores any
data locally. More importantly, it requires no endpoint management, no patch
management, no firmware upgrades, and no client software or protocol extension
licensing fees. All of this significantly reduces costs, improves lifespan, reduces
downtime and improves IT productivity — driving savings in desktop computing TCO
of up to 70%.
The Pano Zero Client and the Pano Direct Protocol handle communications between
the virtualized desktop operating system and the peripherals connected to the zero
client much like a PC system bus. This approach greatly simplifies deployments
since USB peripherals connected to the Pano Zero Client appear to the virtualized
Windows operating system to be locally connected – no complex protocol
extensions or client-side driver stacks are needed to simulate the connection and
almost any type of USB device or peripheral can connect to a Pano virtual desktop
using ordinary Windows drivers.
This support for native Windows device drivers provided by the Pano System
architecture can make it much easier to support existing hardware investments,
security protocols and standard operating procedures. Desktops in point-of-care or
clinical bedside settings may need to support a wide range of old and new
peripherals, ranging from standard printers and scanners to more specialized
barcode readers, two-factor authentication tokens and even patient health
monitoring devices.
In contrast, with many thin clients a special driver that is customized for the thin
client’s embedded operating system, such as Windows XPe or the vendor’s
proprietary Linux distribution, would need to be developed or sourced. With a zero
client none of this is necessary as only the one virtualized Windows XP/7 desktop
operating system is present and the native Windows drivers supplied by peripheral
manufacturers or Windows Update can be used.
The Pano System has the unique capability to provision and manage desktop virtual
machines (DVMs) tied to specific Pano Zero Clients using Device-Based DVM
Collections. This feature is unique among major VDI systems which are usually
restricted to associating DVMs only with specific user accounts. Using a devicebased
association greatly simplifies provisioning of special purpose shared
workstations. Examples of these include public-access information or directory
kiosks, equipment monitoring/instrumentation workstations.
Several variations of Device-Based Collections are supported, including Automatic
Login, either with a standard set of credentials or with one unique to each device in
the collection, and Windows Login, which allows the Windows Login process to be
used enabling the use of smartcard readers and biometric authentication for twofactor
access control. And as these secure access devices effectively run within the
centralized DVM rather than on a thin client’s operating system, getting support and
drivers from device manufacturers is greatly simplified.
PAGE 4

PANO SYSTEM IN HEALTHCARE
While other types of virtual desktop deployments offer some benefits from
centralization, the unique architecture of the Pano Zero Client provides a number of
advantages not found when using thin clients, tablets or even refurbished PC
desktops as virtual desktop endpoints. For healthcare delivery organizations these
benefits mainly fall into a few key areas – security, accessibility and cost.
Two attributes of Pano Zero Clients, the lack any form of local data storage, even
temporarily, and the complete centralization of all processing, enable them to
address data privacy and security regulations HIPAA and HITECH:
• No Local Data Storage: because they cannot store any data locally, even
temporarily, Pano Zero Clients deliver improved data privacy and security since
all private clinical and billing data is kept on secured servers and off endpoints
which can be breached or stolen.
• Malware-free Endpoint: complete centralization of all processing onto the
server eliminates any risk of malware, including keystroke loggers, from being
installed either intentionally or inadvertently on the endpoint. Along with
improving security, this centralization eliminates the cost and overhead of
scanning endpoint hard drives for malware.
• Continuity of Security after P2V Migration: since critical point of care, record
keeping and authentication peripherals – such as touch screen monitors, local
printers, barcode scanners, audio input – are supported with only native
Windows drivers existing security policies and peripherals can be left in place
after a physical to virtual migration of desktops.
• Data Secured from Network Breaches: Pano’s complete centralization helps
protect patient data from network security breaches. With fully centralized
virtual desktops, private patient records from systems like EMR and PACS just
travel from server to server inside the data center – only the image of the
displayed record is sent encrypted out to the endpoint. Even if the network was
breached and Pano’s encryption was cracked, only the displayed portion of the
record could be captured – not every bit of data the application handled.
• USB Port Control: the USB ports on the Pano Zero Client can easily be
controlled using templates for virtual desktop images – letting you restrict them
to just keyboards and mice, proactively blocking potential data leaks.
• Reimage Infected Desktops Easily: if a desktop image becomes corrupted by
malware it can simply be deleted and replaced with a new version from a
template or backup, potentially saving days of effort previously spent cleaning
and reimaging infected PCs.
• Secure Remote Access: when staff are travelling, working from home or at
remote sites where Pano clients aren’t deployed they can still securely access
their virtual desktops using Pano Remote. Provided preinstalled on a USB key,
Pano Remote doesn’t require any installation and leaves nothing on its hosting
PC. If connecting via the Internet, Pano Gateway provides a secure connection
through a DMZ’s firewalls with all Pano Remote traffic sent via standard
Microsoft RDP secured using https/SSL to simplify management, monitoring
and quality of service optimization.
PAGE 5

PANO SYSTEM IN HEALTHCARE
The Pano System’s security benefits can also help healthcare providers and insurers
substantiate their compliance with a wide range of regulations for patient privacy and
other data security including:
• National and state/regional laws controlling the privacy and security of patient
clinical care and billing records including:
o
o
o
US: Health Insurance Portability and Accountability Act (HIPAA)
and the 2009 Health Information Technology for Economic and
Clinical Health Act (HITECH).
EU: EU Directive 95/46/EC and laws implementing it by EC member
states such as the Federal Data Protection Act (2009) in Germany or
the Data Protection Act 1998 in the UK.
Canada: Personal Health Information Protection Act (PHIPA)
• Food and Drug Administration 21 CFR Part 11 rules for electronic clinical trial
records conducted by healthcare providers on behalf of pharmaceutical and
biotech R&D organizations.
• Payment Card Industry Data Security Standards (PCI DSS) information
security standards for patient billing credit card records.
• Sarbanes–Oxley Act of 2002 (SOX) for financial and business records of
publicly traded firms.
Healthcare providers have long faced the challenge of providing easily accessible
desktop computing to highly mobile workforces scattered across one or more
campuses, each of which contains numerous facilities. One approach has been to
provide mobile computing resources such as hand-carried tablets – but aside from
high costs this also creates a host of problems for data security and equipment
thefts, as well as making any required on-site troubleshooting and repair of these
devices needlessly difficult.
Fully centralized virtual desktops provide another model where doctors and clinical
staff can access their desktop from anywhere without needing to carry around
computing hardware (or highly sensitive patient data). The endpoint themselves
don’t have any connection to specific users and can provide access to any desktop –
or even to any one of multiple desktops assigned to a user.
Accessibility benefits from zero client virtual desktops include:
• Rapid Roaming: enabling mobile clinical staff and physicians to rapidly roam
and connect to their personal Windows desktop from any location, freeing them
from having to carry tablets or laptops between work sites. When they login at a
new Pano their Windows desktop is in exactly the same state as they left it at
the last login – all of their applications and files are open saving time spent
booting, loading applications and navigating to records with PCs.
• Multiple Personal and Role-Based Desktops: virtual desktops provide a
common platform to securely provision users with both an individual-assigned
desktop, equivalent to their current PC usage, along with role-based pooled
desktops – such as a standardize nursing desktop used for records
management. All of these assigned desktops are still controlled by the same
user authentication controls.
• Simple Offsite Access: Pano Remote provides convenient full-screen or
windows sessions on any networked Windows PC, with no installation and
leaving no trace – providing anytime, anywhere access to Pano virtual desktop
PAGE 6

PANO SYSTEM IN HEALTHCARE
for staff working at home, travelling, or at work sites where Pano Zero Clients
have yet to be deployed.
• Reliability Enables 24x7 Access: Pano Zero Client’s long lifespans, added
reliability, and the rapid resolution of problems enabled by virtual desktops helps
keep systems critical to continuity of care and prevention of medical errors, like
Electronic Medical Records workstations, accessible around the clock.
• Compact, Easily Isolated in Sterile Settings: at only 3.5” square Pano Zero
Clients are far easier than PCs or thin clients to locate in crowded nursing
stations, bedside or in mobile (COWS) locations. And since Pano Zero Clients
don’t require circulating air for cooling and have virtually no surface openings on
the top or sides they are much simpler to deploy and isolate in sterile or
pathogenic environments.
Pano virtual desktops can deliver much better IT productivity and total cost of
ownership savings of up to 70% compared to unmanaged PCs and much less than
typical thin clients deployments. These cost and productivity benefits include:
• Simplicity Improves IT Productivity: Panos are true zero clients and therefore
do not require any endpoint configuration or management at all – making any
field replacements a simple remove-and-replace operation that any
administrative or clinical employee can perform without the need for IT help or
costly onsite support visits.
• Efficient Hardware Upgrades: Virtual desktops enable highly efficient sharing
of hardware and software capital investments, helping IT get the best return on
their available budgets. For example, instead of upgrading the RAM and CPU of
hundreds or thousands of PCs to support a migration from Windows XP to 7, far
less budget (and IT staff time) can be used to upgrade a handful of virtual
desktop servers – with all of those hardware resources being shared
concurrently across all active users.
• Low Energy Use: Pano Zero Clients consume only 6.5 watts each, dropping to
less than 0.2 watts in sleep mode. Even with the energy used by servers and
storage added a complete Pano virtual desktop seat consumes fewer than 11
watts – less than most thin clients by themselves. These power savings by
themselves can be enough to completely payback the Pano System purchase
costs in less than two years for many organizations.
• Cost-Effective DR & BC Desktops: the rapid user provisioning made possible
by the Pano System enables hospitals and emergency services providers to
quickly and cost-effectively scale up when responding to natural disasters or
when relocating their workforces during disaster recovery and business
continuity responses.
• Longer Lifespans stop Endpoint Break/Fix, Refreshes: The reliability and
longer life-span of Pano Zero Clients comes from eliminating failure-prone
moving parts like fans and hard drives that cause break/fix cycles and reduce
productivity for both IT staff and users. This reliability also eliminates the cost of
purchasing and managing a spares inventory. And Pano’s simplicity and lack of
obsolescence lets you skip refresh cycles on the endpoint.
• Conserves Software License/Second Desktop Costs: with mobile access
provided by Pano Remote there is no need to purchase multiple copies of
software or licenses for users’ office and home systems.
PAGE 7

PANO SYSTEM IN HEALTHCARE
Probably the best way to explain how Pano Zero Client virtual desktops can help
securely and efficiently deliver reliable desktop computing is to look at some realworld
deployments. In the summaries below, two healthcare Pano System users
describe how Panos benefited their organizations and users.
Links to the complete case studies are provided after each summary. For more
examples of how the Pano System is being used in healthcare and other industries,
please see the rest of our case studies at: www.panologic.com/case-studies
CharterCARE Health Partners is a community-based,
patient-centered health system that operates Roger
Williams Medical Center and Our Lady of Fatima
Hospital, both in Providence, Rhode Island. The
healthcare network has more than 500 physicians and
is responsible for approximately 55,000 ER visits and
nearly 400,000 outpatient visits annually.
“We started looking at all of this equipment that lands
on everyone’s desk – PCs, monitors, printers – and the
expense of maintaining it,” said Andrew Fuss, Manager
of Technology and Engineering at CharterCARE. “We asked, ‘How do we maintain a
growth of 30 percent over the next few years with not only our aging desktops but
also new requests that are on the floor?’ What made the most sense to me in this
situation was to virtualize the desktops.”
Fuss was familiar with thin clients but thought the devices made no sense. “We had
some thin clients floating around prior to deploying VDI, so we already knew the
challenges with them and we didn’t like them,” said Fuss. “If it’s the case of Wyse
and their own inherent operating system or if it’s a true Linux distribution, you still
have underlying client OS management that will cause support layer issues. I saw
absolutely no benefits with going the thin client route.”
CharterCARE implemented Pano Logic’s zero client virtual desktops over a sevenweek
pilot at Roger Williams Medical Center. So far, they have replaced 75 PCs with
Pano System virtual desktops in a number of scenarios around the hospital,
including patient-care floors and the human resources and finance departments.
According to Fuss, the benefits were obvious immediately – the IT team realized that
the total cost of ownership savings was huge, including upfront savings of
approximately $200 per desktop. In addition, the hospital is realizing energy savings
from the Pano Zero Client plus the additional energy savings from VMware’s
virtualization infrastructure.
Pano Logic eliminates many of the potential security issues that can plague
traditional desktop PCs in healthcare, especially in publicly-accessible areas. “I
really got excited when I realized I can tear out a PC with all its inherent
vulnerabilities and replace it with this little tiny box that can sit anywhere,” Fuss said.
”If someone wanted to steal it – if they could first figure out what it is – so be it. It
wouldn’t jeopardize patients’ data or breach the hospital’s security network because
nothing can be stored locally on the device,” said Fuss.
PAGE 8

PANO SYSTEM IN HEALTHCARE
It now takes the IT team just 15 minutes, including walking time, to replace a
traditional fat client PC with a Pano Zero Client. “Prior to having Panos installed in
the training room we had a hodgepodge of thin clients and it was a disaster. We
were getting more help desk calls from people encountering problems while using
the training room than we could handle,” said Fuss. “With Pano Logic, we can pull
back on support and have a desktop engineer troubleshoot the problem in-house,
and going in we know it’s not a hardware issue. I think a nuclear bomb could go off
and the Pano Device would still be sitting there.”
The full case study for CharterCARE Health Partners can be found at
www.panologic.com/casestudy/chartercare
Henry County Hospital in New Castle, Indiana
provides a wide range of medical services and
health care programs in 7 locations throughout
New Castle, and serves patients from Henry,
northern Rush and western Wayne Counties. With approximately 1,100 employees,
Henry County Hospital has an IT staff of 18 and a single data center which houses
80 servers and supports 7 locations.
Henry County began investigating desktop virtualization in 2007 shortly after their
VMware ESX server virtualization deployment was completed, to address two major
business challenges: desktop cost and management time. “We were replacing older
Dell desktops and wanted to reduce the initial purchase cost of new systems and
improve the short lifecycle of traditional PCs,” said Dave Nadler, assistant director,
Information Systems at Henry County Hospital. “We also needed to quickly repair
and/or replace computers with problems, which was taking us at least a day per
computer,” said Nadler. “Now we can have another virtual desktop up and running in
twenty to thirty minutes.”
“We had significant cost savings, which we quantified by taking the cost of the PC
and its maintenance, the licensing for our applications, the server and VMware ESX
and looking at them over a five-year period,” said Nadler. “Across the board, the
Pano solution was cheaper than a traditional PC by at least two hundred to three
hundred dollars annually.”
In addition to cost savings, Henry County realized time savings for clinical,
administrative and IT staff. Now, fixing a computer that is having problems takes a
fraction of the time that it did before deploying Pano virtual desktops, allowing an
overburdened clinical staff to be more responsive to patients.
Nadler believes Henry County has only experienced the tip of the iceberg in terms of
benefits from Pano, and intends to continue deploying more Pano virtual desktops.
Next, Nadler plans to make patient documentation accessible throughout the
hospital by installing Pano Zero Clients in the CCU, WCU and emergency rooms.
“We see the potential Pano has in a broader deployment and look forward to
realizing more benefits as we continue to roll devices out,” concluded Nadler.
The full case study for Henry County Hospital can be found at
www.panologic.com/casestudy/henrycounty
PAGE 9

PANO SYSTEM IN HEALTHCARE
For more information please visit www.panologic.com. Other resources can be
found online at:
• Pano System product page: www.panologic.com/pano-system
• Healthcare industry page: www.panologic.com/industry-healthcare
• Healthcare industry brief: www.panologic.com/brief/healthcare
To get a Pano System Starter Kit or to be connected to a local Pano Logic partner,
please email sales@panologic.com or call 650-454-8940 or toll free (US and
Canada only) 877-677-PANO.
Pano Logic, Inc.
2000 Seaport Blvd, Suite 200
Redwood City, CA 94063
This document was updated in December 2011 and is specific to the features and capabilities
of Pano System 5.0. [WP-PSIHC-121411]
© Copyright 2011 Pano Logic, Inc.
Pano, Pano Logic, Pano Button, Pano Direct Protocol, and Pano Direct Technology are
registered trademarks of Pano Logic, Inc.
Pano Zero Client, Pano Device, Pano Gateway, Pano Controller, Pano Maestro, Pano Remote,
Pano Direct Service and Pano System are trademarks of Pano Logic, Inc.
PAGE 10