For some employers, successfully implementing software can feel like a sports team clinching a playoff spot after a grueling season—relief followed by high-fives. But no matter how many bona fide improvements the new software delivers a healthcare organization, challenges inevitably come. The hurdles range from short-term ones, like generating custom reports (beyond the templates that are part of the package), to longer-term concerns, such as replacing the systems’ trained administrators who leave for another opportunity.
According to industry analysts, managed service providers (MSPs) are increasingly helping healthcare organizations keep up with, among other things, compliance, and security concerns. A recent Mordor Intelligence report finds the healthcare industry will increase the use of MSPs by nearly 12 percent annually through 2030. According to Informa TechTarget, the genesis of MSPs extends back to the 1990s. So, it is not news that healthcare organizations are partnering with MSPs. What is new, say researchers, is managing the growing complexity of compliance (e.g., HIPAA and 42 CFR Part 2) along with the public’s demand for healthcare like behavioral and mental health services. That uptick is prompting healthcare organizations, especially SMBs, to take a closer look at managed IT services.
What type of MSPs exist?
For healthcare organizations considering an MSP, there are a few varieties.
- First, there are ones managing IT operations like infrastructure, networks, help desks, strategy, and security in support of an organization’s facility, staff, and technology needs.
- Second, there are software vendors providing managed services specifically for their platform. These vendors also offer support for daily use and enhancement of their solution to help the client successfully leverage the products to their full potential.
- More healthcare software vendors are also offering managed services where they host or manage their systems in the cloud and provide updates for clients. Informa TechTarget notes, “the terms cloud service provider and managed service provider are sometimes used synonymously.”
In all three cases, MSPs employ staff that are ready around the clock to keep an organization running and anticipate problems.
For those considering managed services for the first time, here is an example of how one Midwestern organization works with a provider. The community-based services agency helps families and opted for managed services due, in part, to its rapid growth. Information technology was not the organization’s core business. So, the agency’s managers looked for a provider that knew not only IT but also the business of health and human services. The agency wanted a 24/7 help desk; engineering support for its network, servers, desktops; assistance developing reports from its EHR along with data analytics; and a level of security services. The agency’s executives also wanted to develop an IT strategy for the organization. The managed service provider they chose included a senior-level consultant who had served as a CIO at a large healthcare organization. So, the consultant’s experience made possible the development of a customized strategy the agency’s executives and IT team could adopt.
When should an organization consider an MSP?
The road to managed services differs for each organization. Here are scenarios that could prompt a healthcare provider to seek out an MSP.
- A behavioral health organization with 24/7 residential facilities might opt for managed services with an around-the-clock help desk. Imagine an incident, on Christmas Eve, with a patient; the residential staff encounter a problem accessing clinical records in their EHR.
- Following the departure of a CIO, an organization may want to engage a virtual CIO, so the executive team has on-call, strategic IT leadership helping to guide the organization’s strategic vision.
- A healthcare agency facing a cybersecurity breach might bring in an MSP to mitigate the event and develop a strategy for the future. Once the MSP resolves the problem, the agency may also decide to retain the provider to deliver ongoing security strategy, monitoring, and management solutions.
- A mental health facility may go through an audit that results in findings and gaps, leading them to contract with an MSP as a long-term strategy for resolving the shortcomings and preventing new ones.
- An MSP might help a healthcare organization develop a plan for (or assist in) migrating its software to the cloud. Moving to the cloud can help an employer scale up or down resources based on demand. Cloud services also support nurses, clinicians, and navigators with mobile access to critical systems with patient records.
For small and medium-sized healthcare organizations, managed services provide the IT skills and talent that employers may find challenging to attract or afford. At large organizations, MSPs can fill niche roles.
- A hospital system might have anywhere from 10 to 50 IT professionals on staff. But even these large teams can have a gap to fill. Managers do not always want to fill gaps by hiring new FTE resources. For instance, a large hospital system may have an application running in its IT stack that requires part-time, deep domain expertise. Instead of hiring and training part-time staff, the hospital system may call on its MSP with highly skilled resources. This eliminates the expense of onboarding part-time resources whose knowledge and skills managers only need on a part-time basis.
- If an organization is looking for a resource to take on a project, such as building a data warehouse or providing tools for gathering and tracking analytics, hiring a managed service provider for chunks of time would be an option to establish the data warehouse and create needed integrations.
- Let us say an employer has suffered a cyberattack and requires assistance restoring systems. The organization also wants to put in place protective measures and create a security posture against future attacks. An MSP can play a role either for a brief period or as an ongoing engagement including mitigating the cyber incident, developing a security strategy, implementing security countermeasures, and ongoing system monitoring.
- Some software vendors who provide managed services also offer training for a variety of functions. But if the client does not use the functions, the knowledge fades. Through managed services, an MSP can offer coaching on a software’s new capabilities or dive into the system and take on needed tasks like configuring billing logic, report writing, or new functionality deployments.
What does an MSP cost?
MSP costs depend on the services, ranging from a bucket of hours for specific projects to completely outsourcing an IT department. Some organizations will choose a flat-fee model allowing consistent budgeting without spikes caused by a cyber incident or staff turnover. For instance, rather than absorbing a sudden $50,000 cost for recruiting, training, and onboarding a new resource, a healthcare organization might pay a fixed annual rate that covers a full scope of services. This transfers all the risk to the MSP vendor.
Smaller healthcare organizations, especially those with 50 or fewer employees, often struggle to afford specialized in-house IT leadership, such as a full-time security expert. With an MSP, these organizations might purchase a fraction of a security expert’s time–say, 40 or 50 hours annually–while benefitting from the expertise of someone who has managed IT operations for large-scale organizations.
No two healthcare organizations are alike, and reputable MSPs typically start with a no-cost assessment to understand current operations, IT needs, staffing levels, and budget. From there, they can recommend services—ranging from gap-filling support to full outsourcing—and offer a service level agreement (SLA) tailored to those requirements.
An SLA may cover everything from dashboard development to disaster recovery. The goal is predictable service and accountability, regardless of whether the vendor has one staff member or a team supporting the client. If an MSP meets or exceeds tasks under the scope of work, the size of the provider’s team should not matter.
What questions should an organization ask when evaluating an MSP?
Healthcare organizations should ask a range of questions when considering a managed services partner:
- Does the provider have experience serving healthcare organizations like mine (e.g., acute care, behavioral health, mental health, or substance use treatment)?
- Do they offer breadth—engineers, support staff, security specialists, and reporting experts?
- Does the provider have bench depth if someone leaves the organization?
- Do they have experience implementing and supporting large-scale cloud environments?
- Do they help with compliance and cybersecurity insurance requirements?
- Do they have the skills to assist with developing strategic long-term IT plans?
Healthcare professionals are serving ever more patients and facing growing regulatory complexity. Like an NBA team that outsources the role of a shooting coach to improve basketball players’ accuracy, there is a case for outsourcing IT services: stabilizing costs, mitigating staffing challenges, and ensuring security and compliance. To net those paybacks, healthcare organizations should seek out an MSP that knows the healthcare space (e.g., behavioral health, acute care, etc.); offers affordable, flexible pricing; and, of course, presents the right mix of skills and references.
About Scott Anderson
Scott Anderson is the chief technology officer and general manager of Managed Services at Cantata Health Solutions, which serves customers ranging from state hospitals and health systems to local, regional, and national behavioral health and human services providers. Anderson has over 30 years of experience transforming organizations through strategic and executive management as well as infrastructure design and IT operations. Before Cantata, he held roles including virtual CIO and vice president of Cloud/System Engineering at Netsmart Technologies.
