IT Problems Faced by Zulekha in Delivering Services to Its Patients - Case Study Example

IT INFRASTRUCTURE Number INTRODUCTION Zulekha Hospital –Dubai LLC is a hospital under the auspices of Zulekha Health Care Group. Zulekha hospital LLC is a medical facility operating in the heart of Al-Nahda and is the second hospital of the Zulekha group. The modern 75-Bed state-of-the-art hospital spans an area of 82,000 square feet and offers specialized services to residents. Other hospitals under the Zulekha group include Zulekha Hospital-Sharjah, Zilekha Medical Centre Dubai, Zulekha Medical Centre- Dhaid, Zulekha Diagnostic centre and Al Rafea Phamacy. The services range from health planning, general diagnostic and reproductive health. The services are offered in a multi-specialty manner under one roof and multiple consultants and doctors operate from each specialty to reduce patient queuing time. There is also a modular operating room to minimize Hospital Acquired infections in surgical patients as well as an amazing and completely entertaining children’s zone and child care area attached to the pediatric wing. The hospital offers 24-hour service in selected emergency situations, pharmacy GP and ambulance. As mentioned earlier, the hospital provide a host of services including urology, heart care, child care, weight loss, genecology, minimal access surgery and women wellness programs. These services are highly sensitive and patients sometimes demand to be served by their preferred doctors. The hospital, in the past was overwhelmed by the demand and the lack of scheduling mechanism to distribute patients to available consulting doctors efficiently. This resulted in a lot of inconveniences in terms of waiting time the associated health repercussions. The hospital in leveraging technology decided to introduce a doctor and patient management system known as Inquiry, Booking and Reservation system. This system allow patient to inquire for their preferred consultant doctors and book for an appropriate session guided by the schedule of the doctor. Most of its clients make reservations through direct calls made to the centre. The customer service department receives the calls, book clients and advice on the best visit schedules according to the physicists calendar of events. In dire scenarios, the hospital allows direct communication between clients and their doctors for better service delivery. Therefore, telephone communication is the de facto medium although other channels such as eMail and texts are employed. The clinic has an implementation of VoIP. However, the system has been associated with some drawbacks. Some of the clients have developed mistrust with the clinic due to the communication media it had adopted. CASE STUDY: ZULEKHA HOSPITALS CHALLENGES Over the past two years, the clinic has battled various court cases with clients over privacy issues. A number of clients have reported breach of privacy during communication and want the clinic held liable for doing little to guarantee security of their information. There is an apparent lack of security in the company’s telephony communication medium. Calls have been reportedly intercepted at some time and in spite of the security measures adopted at that instance, it appears that little has changed. This has triggered the hospital management to change their security approach in regards to telephone conversations. There are three particular issues that were reported in the hospital in regards in respect to telephone conversations. Eavesdropping With conventional telephone conversations, a physical access mechanism to tap a line or penetration of a switch is required for eavesdropping to be successful. However, with VoIP, the probability of eavesdropping is magnified tenfold. The large numbers of nodes used for communication are large and if an attacker succeeds in compromising one of them, it makes it easy to access the IP through them. This is what happened with Zulekha Hospital-Sharjah and Zilekha Medical Centre. Referring to a scenario where a patient reported the possibility of a taped conversation between her and the physician, it is possible that one of network analyzing tools were used by attackers. Investigation reports indicated that Wireshark was particularly used to peer into the network and record a variety of system activity such as level statistics and bits of a packet. The attacker then uses the details to troubleshoot the network security and finally dissect the network (Swale, 2001). After successful attacks they can access information on a network and see patient’s details, of which they can use for varied crimes. Patient’s addresses, contacts, lab reports, financial details are sensitive information that if reveals to outside parties leads to immeasurable damaged. Attackers used this information to blackmail patients, conduct fraud or utterly harassment hence the onset of the court cases. Caller ID spoofing In one particular scenario, one patient reported having been called by what he supposedly referred as the clinic’s customer care agent who advised him to deposit some amount of money in a particular account and report to the hospital in the following day for a major surgery he had been scheduled a month away. Upon reporting to the hospital, the patient realized that he had been conned as clinic staff did not make such a call. Caller ID spoofing is a process where the attacker manages to take control of the gateway server and change the “From” header to a number he desires (Peter Thermos, 2008). The agent responds positively to the proxy server when directed to a “via” address. The proxy server forwards the acknowledgement to the legitimate user since it knows it IP address of its phone. Caller ID spoofing techniques are used by attackers to launch attacks on unsuspecting citizens such as patients. Having set the caller ID to appear as if it is from the original patient or clinic, they order cash transfers which they finally take possession. Call hijacking and redirection Caller redirection and hijacking was reported one moment in the Hospital. All the phone communication systems were cut off. An attacker had successfully launched denial of service attacks to create large number of call requests to a certain terminal subsequently diminishing its processing power. Investigations revealed that the attacker initiated too many invite requests to the hospitals gateways and mobile devices using the network derailing the services of the whole system (McWay, 2009). The current happenings have prompted them to act decisively and determine all the security vulnerabilities associated with the deployment of VoIP application. Due to the magnitude of privacy required to be sustained in Zulekha Hospital, the technology desired should exhibit the highest security protocols. TECHNOLOGY INFRASTRUCTURE OVERVIEW Zulekha Hospital opted for a VoIP phone system in November last year. It adopted a special VoIP system known as Connect that has advanced security features. Voice over Internet Protocol or IP telephony is a routing protocol for voice communication over IP-based internet networks. Unlike traditional dedicated-circuit switched networks, voice data flows through generalized packet-switched networks (Cisco, 2006). EXAMPLE Zulekha Hospital has a centralized customer service system. The system known as Connect streamlines customer support processes. It contains help desk support, service ticket support, self-service support and mobile integration. The system runs on a centralized SQL database and has a client based interface. It integrates a Toshiba PBX Phone system for telephone conversations. It is used to maintain all inquiries, complaints, complements and correspondences either internal or external made to Zulekha Hospital. Since numerous inquiries are made on a daily basis either by patients or physicians, the Hospital has implemented an independent standalone server on a Dell PowerEdge R520 and run by Microsoft Windows Server 2012. Zulekha Hospital has a system support contract with Avaya Inc. (the developers) to ensure continuous updating and support for the system. Connect is a multi-channel contact centre built on an IP-based architecture to support multiple channels of communications. It supports Voice, text chat, email and video on an IP network and an IP-based voice system. Connect integrates inbound and outbound voice applications over the internet. Zulekha Hospital adopted this system six months ago to replace the legacy TDM-based communication system. This has allowed better management of customer service as customer service personnel can support multiple interactions at a go regardless of the communication channel adopted by the customer. Connect has a Network –to-Computer telephony integration which functions on all call centers across the medical facility. Each building in Zulekha Hospital has a customer service/inquiry centre manned by call centre personnel. Secretaries double as call centre representatives in various departments. Other centers across the organization are manned by full time call centre representatives. All the call centre representatives report directly to customer service manager in the hospital. Customer service managers fall under overall leadership of a liaisons director who happens to be the Hospitals executive secretary (Karen A. Wager, 2013). Connect allow call centre representatives to respond to all inquiries in real time. The client interface comprises of rich features such as live chats, telephone conversations and message exchange that facilitate patient communication and interaction. Inquiries made are recorded and kept in a database upon which they can be accessed by physicians and doctors. SECURITY The system is secured by the latest call centre security and data integrity features provided by the vendor. The system employs multifactor and risk-based authentication techniques to guarantee the integrity of information given. A user is authenticated by providing something they know and something they are so that a secure environment for information exchange and business transaction is facilitated. Eavesdropping is a security threat that compromises the confidentiality of information. In order to combat the incident the hospital employed encryption techniques to prevent sniffing tools. Encryption will ensure that those connecting to the VoIP from outside are legitimate users. Ingress and egress filtering tools were applied to eliminate any packets that originate from spoofed sources. The hospital also employed the use of Cisco Express Forwarding service designed for high performance layer 3 IP switching to provide optimum performance and secure communication on critical resources. The system also exhibit distributed fault tolerance enabled by self-diagnostics and self-healing functionalities that leverage redundant components. End-point protection of the system is provided by Microsoft End Point Protection 2012 as well as the firewall to manage traffic and prevent Man-in-the-middle, denial of service and eavesdropping. The implementation of VoIP-aware firewalls and intrusion detection and prevention systems eliminated such attacks as denial of service (Thomas Porter, 2011). TIMELINE Zulekha Hospital tendered for the installation of the new system mid last year. Bidding process was completed by August 2013 and the system was implemented during the months of October and November. Zulekha Hospital looked into the services of several vendors including Polycom, Avaya and Cisco and settled on Avaya based on the durability of the phone system, battery life, ease of maintenance services and integration with other services. The process of procurement implementation and testing took a period of six months as shown in the table below. Plan procurement (Purchase and acquisition) 2 Month Conduct procurement (VoIP, Seller selection, Customization) 1 month Implement the solution 8 weeks Testing and support 3 weeks Patient and Manager Feedback Data from the hospital indicate that there is increased satisfaction on the side of patients and workers. The new system is easy to manage giving patients a leeway to conveniently and securely access healthcare at the convenient time. There are no attacks reported since implementation and coordination between call centre workers, patients and consulting physicians is simplified. RESULTS AND CHALLENGES FACED DURING IMPLEMENTATION Zulekha Hospital reported no incident after the implementation of the integrated VoIP system. There is a sign of relieve in the hospital as a result of guaranteed security for the patient data and communication. Prior to implementation of the system, patient turnover had decreased due to the concerns which were once highlighted in the media. Those using the IBR system was greatly affected as patient were scary that their data will be exposed. However, for the past six months after the installation of the integrated VoIP system, the system IBR system has witnessed increased activity as patient are calling, texting and emailing to inquire and place appointments with the doctors and the physicians. The hospital management is also happy with the system and the security it offers to its data and that of the patients. There are no more losses in terms of compensation to patients whose information was compromised. Likewise, the Hospital is bound by Data Privacy Law under article 26 of the Data Protection Law to keep all confidential information safe from exposure or face sanctions and fines from Commissioner of Data Protection. Challenges Complexity and confusion existed during the initial process of VoIP implementation. Network administrators experienced difficulties in the unfamiliar terrain of VoIP communications. Network administrators conversant with running data networks did not understand much about VoIP systems at first since it was a new technology with new equipment, different ways to set up and support. VoIP comprises of many terminologies – media gateways, analog telephone adapter, interactive voice response, and audio response unit. Likewise, there are different VoIP protocols such as H.323, SIP, and IAX (Swale, 2001). The already overworked staff had to undertake the rigorous process of learning whole new features to make it easy to troubleshoot and maintain the system. Zulekha Hospital maintains an internal IT functionality that oversees the operation of key IT infrastructures and does not rely purely on external contractors and vendors though support is usually sort in some cases. Zulekha Hospital realizes that no IT infrastructure is immune to attacks and though it has employed the best encryption tools to enhance its security, it is aware that the system can be subjected to dedicated attacks. Providing another layer of security on top of encryption increases the overall costs of the system eating into the costs savings anticipated. Lessons learned In implementing any new technology in an organization is a daunting task but if the implementation is carefully plan and executed, it runs smoothly to benefit the organization. Health information technology is particularly tricky because the live of the patient is at stake. A carefully coordinated approach involving open communication and collaboration is required. Zulekha contracted a partner to implement the new integrated VoIP system with the help of internal IT staff. The process was rigorous and involved constant communication and collaboration between all the stakeholders to meet the intended goals. ACHIEVING BUSINESS OBJECTIVES THROUGH TECHNOLOGY INFRASTRUCTURE Voice over IP is increasingly adopted in the world due to its inherent features and benefits. Organizations all over the world have saved millions worth of resources by adoption voice over IP communication to replace traditional telephone systems. Through network consolidation, transmission of data, voice, and video signals have been facilitated as a result significantly reducing the cost of set up and maintenance. Thus, different multimedia devices have been integrated together to bring enhanced functionalities. Research from telecommunication firm Juniper indicates that the growth in VoIP communication in business entities has accounted for over $18 million in revenues and future projections indicate an exponential growth (Epstein, 2009). It is thus apparent that VoIP accords organization enormous returns in terms of revenue, improved communication and ease of access. Considering the vast network of Zurekha Hospitals, it strands to benefits from VoIP implementation (Martin Campbell-Kelly, 2009). The selection of VoIP systems in Zulekha is a positive move to reduce worker frustration and boost effectiveness of communication systems. Workers were craving for a new efficient system that would keep everyone in touch and deliver according to the needs of the hospital. Under the original system, nurses had to go to the main desk or doctors lounge, phone or page a doctor – this took time. Patients were also unsure if they would succeed to meeting their physicians at particular periods and times. The whole process was inefficient and time wasting. It affected service delivery and the reputation of the hospital (McWay, 2009). Adopting an integrated VoIP system was motivated by a desire to improve working environment, create job satisfaction and improve the quality of services offered. The choice of Avaya meant that Zulekha would be able to capitalize on some of the features that its integrated VoIP system offers. It saves money, creates more mobility provides easy deployment and management and integrates with existing applications in the hospital. The well developed IP network for voice communication allowed for smooth integration of voice, text and internet for both clients and doctors (Graham, 2000). This is a source of competitive advantage as the hospital seeks to be the best in service provision in Dubai and UAE. RECOMMENDATIONS Implementation of an IT infrastructure in an organization derives numerous benefits in terms of costs savings, competitive advantage, efficient service delivery and interoperability with existing applications. The prime justification for adopting IT infrastructure is return on investment. VoIP systems can benefit Zulekha hospitals by making services more flexible. However, the management of IT systems to as point where it derives ROI is always the major challenge. Security issues and the ability to manage them effectively is the first challenge. Security of the integrated VoIP system does not only lie with the infrastructural controls. Zulekha must look beyond infrastructural controls and deploy logical and physical control to make it work effectively and deliver returns. It is recommended that Zulekha apply best practices and policies in managing its IT infrastructure to realize potential changes to service delivery and business benefits. References Cisco. (2006). Voice Over IP Fundamentals. Cisco Press. Dwivedi, H. (2009). Hacking VoIP: Protocols, Attacks, and Countermeasures. No Starch Press. Epstein, J. (2009). Scalable VoIP Mobility: Integration and Deployment. Newnes. Graham, N. O. (2000). Quality in Health Care: Theory, Application, and Evolution. Jones & Bartlett Learning. Karen A. Wager, F. W. (2013). Health Care Information Systems: A Practical Approach for Health Care Management. John Wiley & Sons. Martin Campbell-Kelly, W. A. (2009). Computer: A History Of The Information Machine, Second Edition. Westview Press. McWay, D. (2009). Legal and Ethical Aspects of Health Information Management. Cengage Learning. Peter Thermos, A. T. (2008). Securing Voice-over-IP Networks: Threats, Vulnerabilities, and Countermeasures. ADDISON WESLEY Publishing Company Incorporated. Swale, R. (2001). Voice Over IP: Systems and Solutions. IET. Thomas Porter, C. C. (2011). Practical VoIP Security. Syngress. JOURNAL ENTRY In this course, I have learned ways of using technology, especially IT infrastructure to better business and service offerings. I couldn’t have imagined a telephone system could help an hospital such as Zulekha deliver to its patients more efficiently and effectively. You know there is this gossip all round about software that can tap you phone records and conversations. And when talking about a person’s health, it gets scary and complicated to trust that the system is secured from those hackers and eavesdroppers. But technology has a way of solving problems and introducing others. I belief that a VoIP will solve more problems than it can introduce possibly in terms of security, cost of running and managing operations and the time taken to access medical help. The most pronounced problem we encountered in this project has to do with managing a new system. Zulekha system and network administrators do lack the skills to administer and securely manage the network from attackers and intruders. JOURNAL ENTRY This is a project that enabled me to apply the knowledge gained in class to real applications in the outside world. Network and communication systems are part of the IT infrastructure that we have researched and covered. The application of this knowledge to daily activities in our lives has been captured in Zulekha case study. So far we have covered about information technology infrastructure and how they are applied to solving business problems. We talked about: Problems faced by Zulekha in delivering services to its patients How the problems have affected the company financially and its reputation The steps taken by Zulekha in solving the problems (deploying a new infrastructure i.e. integrated voice over IP communication system) Problems faced by Zulekha in deploying the system especially winning the public trust after the court cases Steps taken to secure the system in form of security deployments (Intrusion, Detection and Prevention systems, border security such as firewall) Implementation timelines and the business objectives achieved as a result of the implementation JOURNAL ENTRY Information technology is business differentiator in today’s world. Early adopters of information technology gain a competitive edge and fair market coverage. In the context of information technology in medical facilities, early adopters have gained immensely by leveraging the proliferation of mobile phones and the Internet. This projected provided me an opportunity to explore some of the ways in which information technology infrastructure can be leveraged to better the business activities of an organization. In the paper, I have thoroughly explored the options for Zulekha. I realized the implementation of an integrated phone system helped it achieve its business objectives by slashing the cost of operations, promoting service delivery to patients and enhancing patient-doctor relationships. Patients can make reservations using their mobile devices and inquire whether they can access their doctors at a given time. In addition, they can cancel appointments and schedule them for another day. I realized that challenges for implementing the system include convincing users that the security of both patient and organizational data is guaranteed. JOURNAL ENTRY This is an opportunity to display my skills of analyzing a business case and reporting in respect to the use of infrastructure in an organization. The project specifically allowed me to put into practice what I already learned in class to real life issues. In short, the course presented some form of consulting opportunity. I learned that the success of implementing of an information system and infrastructure depends on the approach used by the organization. Technology cannot be implemented for the sake of it, but rather, the needs of the organization should match the business objectives. Zulekha Hospital is in the process of changing its business systems to allow its client flexibility in booking and accessing health services. The important thing is explored in this research is the match between the needs of Zulekha Hospital and the infrastructural offering of Avayah systems. A VoIP system will allow the organization better service delivery as well as security. If I was to undertake the project again, I would use primary data instead of secondary data. APPENDICES Read More