How to Evaluate an Offshore Healthcare IT Service Desk

DHP | THE HEALTHCARE SERVICE DESK SERIES

Part 2 of 3: Experience → Risk → Economics

Moving healthcare IT support offshore in itself is neither a security strategy nor a security risk. It's all about how the service is designed, who has access to the clinical and business systems, and whether the provider can demonstrate that their controls work when the going gets tough.

For a healthcare CIO evaluating an offshore healthcare IT service desk, the question isn't just one of 24/7 coverage at a good price. It's whether the operating model can safeguard the sensitive data, deliver the essential support and be held to account by the health system.

In Part 1 of this series we looked at why an outsourced service desk should still feel like part of your own team. In this part we're going to look behind that experience at healthcare IT outsourcing risks and the controls that healthcare leaders should be checking before choosing a provider.

1. Security starts with access, not geography

Healthcare service desk due diligence starts with defining the work, before we even talk about a delivery location. Which tickets will the analysts be resolving? Which applications will they be accessing? Will they be viewing PHI? Will they be making configuration changes or will they just be triaging issues for another team?

A password reset and a privileged app change shouldn't have the same permissions. Ask the provider to map each role to the systems and actions it requires, to explain who approves access and how activity is logged and reviewed. As part of that assessment you'll need to include the remote support tools, the screenshots and the ticket attachments.

If it's going to involve PHI then you need to get your privacy and legal teams involved right at the outset. Depending on the nature of the arrangement you may in fact be required to have a Business Associate Agreement in place along with the appropriate safeguards. The HHS guidance on Business Associate Agreements is a good place to start, but again it is not a substitute for you looking at your own particular service.

2. Look at the people and the environment behind the service

Security policies are only going to be of any use if they actually affect what happens on a normal shift. How are the analysts screened, trained and supervised? How do their permissions change when they move roles or when they leave the organisation?

Then have a look at the workspace itself. Are the entry points controlled? How are visitors dealt with? What are the rules around personal phones, cameras, printing and removable media? Can the provider actually show you those controls in the workspace where your people would be working?

These questions matter whether you're using onshore or offshore IT support. A well-presented facility tour is useful, but evidence of day-to-day compliance is far more valuable than a presentation on policy.

3. Resilience must be demonstrated, not promised

Healthcare support can't be predicated on everything going to plan. You may have a service desk with redundant internet links and backup power and yet still lose telephony, authentication or remote access during an outage.

Ask the provider to walk you through a real disruption. If their primary connection goes down, can the analysts still take calls and access tickets? If the facility is down, where does the work go? Does the backup team have the right training, the right permissions and the capacity to take it over without in any way compromising the security controls?

Request the most recent failover or continuity test results, the agreed recovery objectives and a clear description of the minimum level of service the provider can maintain. Multiple sites are of limited value unless there is a clear way of moving the work between them.

4. Governance separates a vendor from an accountable partner

A healthcare IT service desk needs more than just a contract and a monthly dashboard. The health system needs to know who owns the incidents, who can authorise the changes, how service problems are escalated and how the corrective actions are tracked right through to completion.

Independent assurance can underpin this review, but the scope is absolutely critical. If a provider is producing a SOC 2 report then you need to check that the relevant service, locations and time period are indeed covered and you need to check the exceptions and customer responsibilities with your assurance team. You must not assume that a general compliance statement in itself proves that all the controls in the proposed delivery model are in place.

Set out expectations around service reporting, access reviews, incident notifications and regular operational meetings prior to go-live. Good governance is evident in the day to day decisions as much as it is during an audit.

5. Seven questions to ask an offshore service desk provider

• Scope: Which tickets and systems will your analysts be looking after and which activities will remain with our own team?
• Access: How are permissions approved, monitored, reviewed and removed?
• Workforce: What is the training, screening and supervision of the analysts that you have assigned to us?
• Workspace: How is physical access, the use of personal devices and sensitive information controlled on a shift by shift basis?
• Continuity: What happened during your last outage/failover exercise and what did you change as a result?
• Assurance: what independent reports or control evidence would cover the actual service that we would in fact be receiving?
• Accountability: Who is accountable for escalations, corrective actions and ongoing service improvement?

Ask for the evidence with each answer: an anonymised access review, the training records, a facility walk-through, a continuity test summary or an example of a closed corrective action. That takes it from being a sales conversation to being a proper due diligence exercise.

Make the decision on evidence, not assumptions

An offshore support model can be a way of expanding your coverage and improving the economics of your support. A lower rate or a longer list of certs in no way makes a provider the right one.

Start with your support requirements, identify the outsourcing risks that matter to your organisation and test the controls intended to address them. Fix the critical gaps before you grant access and use a controlled pilot where you need to validate the service in practice.

Digital Health Partners helps healthcare organizations design service desk support around their operational needs, with onshore and offshore delivery options.

Explore DHP's healthcare IT service desk capabilities and start a conversation about the right model for your organization.

Next in the series, Healthcare IT service Desk Pricing and Per-Ticket Costs – Coming soon