The Health and Human Services Department (HHS) has made more tangible progress than many federal agencies in metamorphosing services into cloud applications – even surpassing the Office of Management and Budget’s requirement to do so with three functions.

HHS has migrated its grants solutions, audit resolution tracking management system and MedWatch Plus as its first three services to move to the cloud as part of the federal Cloud-First initiative.

“HHS has multiple cloud service implementations in development, test and production at the department level and in its individual agencies,” said Frank Baitman, HHS CIO, who came earlier this year from the Food and Drug Administration, where he was an entrepreneur in residence. He was also a previous CIO at the Social Security Administration and, prior to that, in the private sector.

The FDA, an agency under HHS, has more than 275 applications operating in its private cloud, including the MedWatch Plus service, which is the FDA’s post-market automated reporting system in which the public can submit adverse event reports about human medical products and the agency can create reports to inform the public.

[This article was drawn from "Navigating the Cloud," a free e-supplement containing this and other must-read information about cloud computing in healthcare.]

GrantSolutions.gov, established through the Grants Center of Excellence and managed by HHS’ Administration for Children and Families, has moved to the cloud and supports all 14 stages of the grants management business, he said. GrantSolutions.gov manages the process from receipt of application to financial award for 18 agencies across the government.

The Administration for Children and Families developed the audit resolution tracking management system to get more standardization in financial audit resolution of its grant awards and debt management. ACF conducts a lot of its business through grants to non-federal organizations, including states, Indian tribes, local governments and non-profit groups.

HealthData.gov spawns Health Datapalooza

HHS’ most high-profile example of cloud services may be its HealthData.gov, which uses the GeoCloud platform, a federal geospatial platform as a service, and runs on Amazon’s public cloud infrastructure, acting as a development, security and operational benchmark for other public-facing cloud projects. Particular to agencies handling healthcare data, Amazon Web Services (AWS) says in its documents that its components can help users meet HIPAA and HITECH requirements, and have been certified to meet stringent federal information security requirements.

Started by Todd Park, formerly CTO at HHS and now White House CTO, HealthData.gov makes high value health data that the government collects more accessible to entrepreneurs, researchers and policymakers so they can develop new methods or applications for using the information to improve health outcomes. HHS also uses it to support developer competitions to come up with applications that solve problems, such as a simplified sign-on for Web identification authorization for external users to make it easier for them to contribute and participate. Park also started the Health Datapalooza, at which public and private developers demonstrate and share their applications and new uses of government health data.

HealthData.gov is one of the first examples of opening government data to the public to make federal operations more transparent as part of the Obama administration’s Open Government effort. The web division in the Office of the Secretary has moved to the cloud as well.

Like similar changes in the private sector, cloud-based solutions are meant to improve the efficiency of government operations and reduce operating costs.

Users reaping early benefits

HHS has already experienced benefits as services moved to the cloud have increased availability times and performance improvements that, in turn, has eased demand and allocation for resources to enable differing application latencies and responsiveness. “Specifically, user service improvement was the most critical positive impact of the move of GrantSolutions.gov to the cloud,” HHS CIO Baitman said. Users saw immediate benefits in the availability of GrantSolutions services, where unplanned outages were almost eliminated, adding that “cloud services also allow more flexibility in putting up more servers when needed.”

In the works, HHS is establishing a Cloud Web Portal for “shareable processes and collaboration around lessons learned from all our cloud initiatives,” he said. The Cloud Web Portal will also support a continuous Web-based information collection approach to speed up future information reporting on HHS-based cloud services.

HHS, for instance, will share lessons learned from its Cloud-First initiatives. “We’re currently working toward departmental guidance for cloud connectivity and processes, and developing technical shared connection patterns to cloud service providers,” Baitman said.

The Office of Management and Budget has required agencies to move to a “Cloud-First” policy by deploying cloud-based solutions when a secure, reliable and cost-effective option exists. Cloud-based applications enable on-demand self-service, broad network access, pooling of the vendor’s combined computing resources to serve many customers, and the ability to vary those resources based on needs.

Agencies had to select three IT functions and transfer them by summer. The plan has been to build capabilities and momentum in federal agencies, which would spur transfer of more services to the cloud.

In doing so, HHS has tracked the estimated costs, major milestones and performance goals of two of its chosen services as they move to a different IT platform and infrastructure to make sure that they are reaping the savings and benefits that they anticipate.

GAO details HHS cloud challenges

An audit report from the Government Accountability Office in July found that while HHS has outdone many agencies in transferring and transforming services to the cloud, the department still needed to provide more details about the performance goals for its grants solutions and major milestones for its MedWatch service.
HHS said it needed more guidance from OMB, according to David Powner, director of IT management issues at GAO, who authored the audit report. HHS told the GAO that agencies were required to move services to cloud-based solutions before guidance on how to put it in place was available.

“As a result, some HHS operating divisions were reluctant to move to a cloud environment,” he said. Some difficulties that federal agencies have in deploying cloud-based systems and applications may not be found in private sector organizations. For one, vendors may be not be familiar with security requirements that are unique to government, such as continuous monitoring and maintaining an inventory of systems that are called for under the Federal Information Security Management Act (FISMA), Powner said.

Certain agencies lack the tools or technical staff expertise to implement cloud services. HHS said that teaching its staff an entirely new set of processes and tools, such as monitoring performance in a cloud environment, had been difficult.

And because of the on-demand, scalable nature of cloud services, it can be difficult to define specific quantities and costs. “These uncertainties affect contracting and budgeting because costs fluctuate with the associated cloud service purchases,” he said.

HHS told GAO, for example, that a service could consume several months of budget in a few days of heavy use.

OMB established the Federal Risk and Authorization Management Program (FedRAMP), a government-wide program that offers authorizations and continuous security monitoring services for all federal agencies.

 began initial operations during the summer but will be fully operational late next year. FedRAMP aims to make sure that cloud-based services have adequate information security; eliminate duplicate efforts
and reduce risk management costs; and smooth the rapid and cost-effective acquisition of IT systems and services for agencies.