1 ADVANCE for Executive Insight

cloud contract
The Cloud
Contract
Key elements for executing a
move to the public cloud are
outlined. By Chris Witt
Similarities exist in a cloud contract as with
other contracts you have negotiated; if you currently
employ data center co-location or managed
services, you will see many parallels with
cloud services, for example. What follows are
observations I have assembled while working
with many clients. You should engage your corporate
council early in the process, as they will
prove to be invaluable.
Key Areas of Consideration
HIPAA – This might seem like an obvious area,
but it requires some specific attention. Due to
the nature of cloud computing, it can be difficult
to know where your data is and who has access
to it. Ultimately, you are on the hook to secure
the data and be able to audit access. You want to
ensure your vendor will facilitate this logging.
Chris Witt is president and cofounder
of WAKE TSI.
There are clearly pros and cons of using
public cloud computing in the delivery
of healthcare computing services. Somewhere
in the process you will select a vendor who
best aligns with your strategy. The next step in
this vendor relationship is to negotiate the contract.
Contract negotiation is like sausage making:
You want the final product but you don’t
want to see how it is made.
Force Majeure – Most standard contract language
makes it far too easy for a vendor to declare
Force Majeure. I would not recommend that a client
go into anything less than a Tier 3 data center.
It should take a catastrophic local event to bring
down the data center. Also, your cloud instances
are portable and should be replicated. A primary
reason you move to the cloud is for the inherent
resiliency. If you are not leveraging this, why not?
Services – Make sure the contract clearly spells
out the required services provided by the vendor
and pre-negotiate the optional services. The
contract should also cover implementation and
the roles and responsibilities of each party. Do
they include backup? Archiving? What happens
if you need a restore?
Service Level Agreement (SLA) – This is where
you document your expectations. The SLA
components should directly relate to the
tom whalen
44 ADVANCE for Executive Insight