Saving with VPNs

Memorial Hospital Alliance and Mede America prove virtual private networks can help slash costs in health care and other industries.

By Tom Duffy
Network World, 5/18/98

Virtual private networks (VPN) are winning more corporate converts every day, primarily because they hold out the promise of significant cost savings, according to several firms that are reaping the benefits. For a limited investment in the technology, companies can improve remote access and cut costs.

That's exactly what happened at Memorial Hospital Alliance in Mount Holly, N.J., after the hospital implemented a VPN that eventually will be used by its 30 affiliated doctors' offices. Similar savings are attributed to the newly installed VPN at Mede America, an East Meadow, N.Y., firm that handles pharmacy transactions over its network.

Memorial rolled out the VPN to several doctors and a handful of executives. The doctors use the VPN to access patient records, while the executives typically use it to access e-mail and other documents while they are on the road or working from home. Full implementation will begin this month.

"I can't think of a better solution at this point in time," says Bob Haines, Memorial's lead network administrator. "I'm ecstatic."

VPNs enable users to logically carve out a portion of the Internet for their own use. Some VPNs are managed by ISPs while others, such as Memorial's, are managed internally.

Prior to the VPN, doctors affiliated with Memorial accessed patient data using Symantec Corp.'s pcAnywhere to dial in to a ChatCom, Inc. ChatterBox remote access server. But when the hospital upgraded to Windows NT, it was faced with a costly upgrade to make the ChatterBox NT-compatible. Instead, IS turned to VPN technology.

While the network works flawlessly now, there were bumps along the way. Haines' first attempt to install a software-based VPN and firewall from Check Point Software Technologies, Ltd. failed. Bugs in the software prevented Haines from enabling the encryption for inbound traffic, even with significant help from one of Check Point's value-added resellers (VAR), he says. In its defense, a Check Point spokesperson said the VAR made repeated attempts to aid the hospital but IS eventually stopped responding to the VAR's inquiries. Haines said after two months of frustration, he turned to Seattle-based VPN provider Aventail Corp. It took Haines only four days to set up the Aventail VPN Server software. However, connecting all the doctors' offices is not going as quickly as he would like. Many of the offices use 32-bit TCP/IP applications, so they need to upgrade their PCs to Windows 95 or NT to use the VPN. Once the offices upgrade, they will be able to connect to the network via virtually any ISP.

Haines says the experience taught him that the simpler the VPN solution, the better.

"I would tell people to go with a VPN-only solution as opposed to a firewall," he says. "With a firewall, [vendors] are trying to incorporate way too many features, and the clients end up being confused and not able to work. Aventail coexists with any firewall you have."

The cost savings from installing a VPN are significant. Instead of spending $68,000 upgrading ChatterBox, Memorial spent about $12,000 for the Aventail software. Meanwhile, the hospital no longer pays about $2,000 per month for leased ISDN lines and maintenance of bridges and routers. Instead, the hospital is simply making greater use of its T-1 Internet connection and is allowing doctors to access the network through the ISP of their choice.

There also are a lot fewer headaches. "We won't have to troubleshoot when the ISDN lines go down, and we won't have to go out to the doctors' offices," Haines says.

Executives and doctors who use the VPN are pleased with its performance. The users prefer to search through records with a browser instead of the previous text-based interface.

Haines got a chance to try it himself at the end of March when he attended a conference in Salt Lake City. "I dialed in through a local [point of presence] and kept up with my e-mail better than I do when I'm here at work," he says. "It worked flawlessly."

Mede America is equally bullish on its VPN. Pharmacies, hospitals and other health care providers use Mede America's network to verify patient membership in health care plans and to determine discounts and other pertinent information. Because Mede America handles more than 14 million transactions daily, cutting per-transaction costs even by a penny can make a huge difference to the bottom line.

In the past, pharmacies were connected to Mede America via dedicated circuits and a cross-country network of hubs and routers. That setup required Mede America to maintain an expensive bank of modems, which continually required upgrades. The company began considering other options several years ago, according to Chief Information Officer James Stinton.

Looking for a way to off-load network management tasks and reduce costs, Mede America contracted with CompuServe Network Services for use of its network. So far, Stinton hasn't regretted the decision.

"We have achieved significant reductions in the unit cost of our transactions," says Stinton, who declined to reveal specific figures. "And the VPN performs very well."

David Zimmerman, Mede America's operations director, says the VPN is flexible enough to provide benefits to virtually all of the pharmacies with which the company contracts. High-volume customers can get access via leased lines, while low-volume clients can dial in to local CompuServe POPs. Meanwhile, for Mede America, the VPN simplifies the task of network management.

"We have basically given up the network control to CompuServe," Stinton says. "It's much easier to deal with them, rather than put up hubs and routers all across the U.S." Duffy is a freelance writer in Somerville, Mass. He can be reached at tduffy62@compuserve.com.