Articles

Features

Electronic reporting techniques, instant communications, and vast data storage and retrieval systems, which were practically unheard of a decade ago, are now commonplace in the business world.

Connecting the Dotcoms

Despite the near paralysis resulting from the events of September 11, many businesses that had operated from New York's World Trade Center needed to be up and running the next day.

Although much of the financial infrastructure of the United States, if not the world, operated in or near those two buildings, the consensus was that the economy must continue. But it was able to do so only because many companies, such as Morgan Stanley, had contingency plans that allowed them to replicate or "mirror" their databases and continue operations in new locations across the Hudson River. The Gartner Group states that two of five companies that experience a disaster of that magnitude are out of business within five years. When disaster strikes, proper planning will dictate who succeeds and who fails.  

During the ensuing weeks, many Pharmaceutical Executive readers asked themselves, "Could our business have resumed operations in 24 hours? What if our marketing database was de-stroyed? Would we have a backup? What if we lost our clinical trial database? How long would that delay our next blockbuster? How much would it cost to make sure that could never happen to us?" The answers to those questions lie in each company's analysis of risk, benefit, and cost and how they plan for and implement good risk management practices for business and data continuity.

 There are two threats about risk management. First, there is no limit to the amount a company can spend on it. Second, no matter how much a company spends, it can never mitigate all risk. Therefore, corporate executives must weigh considerations and establish priorities before making such critical investment decisions.  

Given the wide variety of competing alternatives, the best way to analyze those issues is through a framework structured to organize, stratify, and systematically identify threats, assess consequences, and guide choices. Such a framework can also help companies develop and use an exhaustive checklist of considerations, ensuring that they identify and review a broad spectrum of issues. In working through alternatives, the business continuity team can evaluate the company's business, organizational, and technological variables to find the best solutions.

Although risk-management issues are similar in most industries, pharma companies have some unique regulations that affect business continuity. Fortunately, the devices, techniques, and disciplines needed for data center continuity complement those regulations and guidances, including 21 CFR 11 manufacturing standards and the International Conference on Harmonization. For example, 21 CFR 11 and FDA's Guidance on Computerized Systems Used in Clinical Trials seek to ensure system security, data integrity, and dependability in systems used to comply with FDA regulations. A key component of regulations covering electronic records is the documentation of written procedures and management controls; both are also essential elements of a reliable data center. When designing risk-management programs, pharma company IT managers must satisfy both the company's business continuity needs and the relevant regulatory requirements.

The best way to understand risk is through the equation: risk = threat 3 vulnerability 3 cost. Threat is simply the frequency with which an event occurs, which can be quantitatively estimated. Past experience, of one's own or from similar businesses, can help determine that frequency. Depending on the threat, companies must consider several factors, especially the business location. Vulnerability is measured by the likelihood that a threat to a specific data center or business will occur. That assessment may be highly quantitative or very subjective, depending on the circumstances. Cost estimates too, can be both quantitative and qualitative. Some threats, such as the cost of a data center shutdown, are highly quantifiable. Others, such as the cost of not following best practices, can be highly subjective. The assessment team needs to be comfortable with that wide variation in approach and perceived accuracy. 

Obviously, a serious threat with both a high cost and a high likelihood of occurrence, such as an earthquake in San Francisco, is a significant risk for any company. Another threat, such as a typhoon, can be costly, but because it is not likely to occur in the suburbs of Chicago, it would be a low risk for that site. However, a fairly unlikely event with a huge cost may be a greater risk than imagined because both the cost and likelihood of the occurence are factors in determining threat.

Therefore, companies embarking on a risk management program must first develop an itemized list of risk elements by category and rank them by the likelihood of threat success, indicating the cost of the damage for each. (See "Risk Assessment.")

Identifying threats is a significant exercise and must be well planned. The simplest scenarios-such as a catastrophic fire that destroys a single facility-are easy to document. In the aftermath of September 11, companies must also consider the possibility of several crises occurring at the same time, such as the destruction of a facility along with simultaneous loss of voice and data communications, physical plants, and an off-site backup storage facility. 

step in building a data/business continuity program is to develop a plan of action for each  identified risk, thereby modifying the environment to the desired risk profile. Responses and selections should be based on cost, consequence, and likelihood of occurrence. Often, a single remedy will address multiple risk factors, so a matrix showing risks vis a vis remedies is appropriate. 

Armed with a range of possible responses, companies must choose those that are most appropriate for each situation. As the likelihood of an adverse event increases or as the magnitude of its consequence increases, three response models come into play: monitor, manage, and eliminate.

Multiple power supplies may eliminate the possibility of catastrophic power failure in a data center. On the other hand, a company may choose to manage the possibility of a damaged server hard disk through rapid response and data restoration from a backup. That is a less costly alternative to maintaining a continuous replicated hard disk, which would eliminate the possibility of down time from hard disk loss. And some threats may simply require careful monitoring. A good example of that is the percentage of network bandwidth that the data center is using. If the percentage gets too high, the company can add more bandwidth.

For each risk category (recovery, security, and procedures), the data/business continuity team must develop a plan for computer application support, staff, and computer operations. (See "Risk Domain.") 

A remedy in one category may also address an issue in another. Operating within a bonded, formally designed data center, for example, reduces security risks and, at the same time, provides much of the infrastructure re-quired for a highly reliable facility. The choice of a particular remedy to address a risk in one category may influence and possibly increase requirements in another. Thus, the decision to establish multiple facilities to manage the risk of losing a primary facility demands not only a set of procedures to support both the original facility and its backup, but also complementary security measures to guard the overall larger infrastructure.

Recovery risks. On a macro scale, recovery risks deal with physical disasters such as earthquakes, hurricanes, blackouts, and explosions. On a micro level, they involve much smaller events like hard disk crashes. Recovery risks are implied in the question: "Can we continue operations through and after a disaster?" 

The core recovery element is well understood: the creation of an environment designed to recover from a loss of data, machines, services, or facilities within a given timeframe and with a minimal amount of data or connectivity loss. A wide range of alternative strategies, with a primary focus on technology, is available at each level of the system architecture.

Within the recovery risk arena, the planning team can generate a matrix that maps different types of conditions and failure modes. They can separately identify the problems associated with a system failure and a facility failure, and map those against two types of failure mode-availability, representing an access failure, and recovery, representing a physical failure. They then can map each of those into sets of potential solutions. (See "Recovery Risks and Solutions," page 22.)

Security risk. The second category is represented by the question: "Can we control access to data?" In examining both the physical and electronic types of control for both data and system access, it is worthwhile to differentiate between incursion (constraining access) and integrity (data or system manipulation from within) failure modes. (See "Incursion/ Integrity Checklist.") 

There are several types of security risks, including hackers, fraud, or inadvertent deletion, and each requires a different detection mechanism and response. Often discussions about security risks focus on one type of risk, treat all risks the same, or mistakenly address all with one solution. It is important to clearly distinguish between alternative failure modes and to carefully match each solution to its intended use. A great firewall will not prevent an authorized person from changing data. Thus, to develop a complete solution set, planning teams must identify each threat and discuss it within its specific context.

Procedural risk. The third component of the risk-management matrix involves "softer" elements such as staff qualification, training, and adherence to procedures. Those personnel management issues play a critical role in creating or closing security holes and are part of procedural risk. The question companies must ask is: "Does our staff comply with consistent business practices internally and with outside vendors and partners?"

To address procedural risks, companies should design a resource and management strategy to   

minimize the individual roles of key staff

maximize full procedural training and cross training

eliminate undocumented, informal, or non-repeatable processes. 

Writing and maintaining up-to-date standard operating procedures, adopting best practices, and creating a culture of process adherence, documentation, and auditing are key to managing that risk area.

Because personnel are involved, adherence to procedures as well as training and sustaining the appropriate level of control can be difficult. The risk plan should include the funding and attention to the quality infrastructure required to develop, monitor, and maintain compliance. To accomplish that, companies should consider increased management oversight and control in the form of process and documentation audits and reviews. (See "Process and Documentation Review," page 25.)

To prepare a response profile, companies must map each risk or group of risks against the identified available solutions and decide how robust or recoverable each application or system needs to be. 

In most cases, the team must look at the required or desired recovery speed and determine the amount of acceptable data loss. Once the team decides how quickly a system or application needs to be recovered, the security and procedural requirements will follow. But, as the capability and speed of recovery increases, so does the cost, not just for hardware or facilities but also for training, procedures, and management. That said, it is important not to overlook inexpensive solutions that might offer significant protection. 

Planning teams should consider three general levels of recovery:

Low priority areas. These include non-business critical systems with recovery needs in excess of one half hour. An example is using a backup application to copy files periodically to a second disk, relying on the end user to detect a failure and recover the file.

Fault-tolerant systems. The environment of this highest level of data availability is designed to permit almost instantaneous recovery with no loss of individual transactions. In this configuration, end users may experience a slight delay in system response to a disaster, but otherwise, the user is able to continue working on the system as if nothing occurred. Fault-tolerant systems are very expensive.

High-availability systems. Developed to allow nearly continuous system and application operation at a significantly lower cost, this option employs a set of back-up systems at each level and includes various levels of automatic fault detection. Here, one trades off the fault-tolerant system's capability for near instantaneous recovery, no loss of transaction, and no loss of user status for a lower investment and nearly analogous performance.

One base configuration for building a high availability system might include a server with a dual computer processing unit (CPU) and full disk mirroring, allowing a system component failure with no loss in service or data. The company could also add a co-located, online, fully synchronized secondary server with a router that can redirect the server address of both if the first server becomes unavailable. 

That configuration can manage a full or partial server failure. In that example, if the primary server's disk or CPU fails, the user should be able to continue online with no interruption and no loss of transactional integrity. Should the primary server fail, the user will probably need to log onto the server again.

A reasonable assumption is that the data center has full back-ups for power; internal and external network; heating, ventilating and air-conditioning; and telecom. If additional precautions are necessary, the company might require a second facility. In that case, it is appropriate to locate the secondary transactional server at the second data center and move the network rerouting into the network. As in the previous instance, users will most likely experience an interruption of service and have to log back onto their servers.

In considering the many risk issues associated with a data center and business continuity, a risk-management approach must be comprehensive in both scope and scale. Planning teams must carefully categorize and assess possible risks to ensure appropriate and balanced responses.

An awareness of lifecycle issues requires companies to examine operational issues for their data centers at least once or twice a year. A comprehensive list relating to hardware systems, software applications, and work procedures-as well as a sensitivity to assembling, confirming, and sustaining the required knowledge for ensuring successful recovery and security implementations-is imperative. The presumption that things will take care of themselves or that the design staff will build systems that are secure and easy to maintain leads companies to ignore or underinvest in operations that, by their nature, change constantly.

As companies introduce new systems, people, and procedures into their business, they must assess and integrate them into the overall risk management and investment plan. Similarly, as they retire or change procedures and systems, they should reassess the modified environment as well.

Of the three general risk categories, procedural risk includes some of the more difficult items to maintain, because it is highly dependent on ensuring that people adhere to processes. Security and recovery risks are more visible and tangible and therefore easier to understand, justify investing in, and implement. 

To redress that, management attention, education, investment, and communication should focus on balancing all three risk areas to achieve the desired risk profile. With an explicit and systematic framework, companies can prioritize issues, direct management attention, and highlight resource, capital, and training investment needs to identify, rate, and rank potential threats to business success and operational quality. 

When Disaster Strikes

In the United States, pharma companies spend an average of $240 million a year on clinical trials-and millions more for drugs that never make it through the full trial process. Commercializing the genome gives pharma companies the potential to dramatically improve their clinical development portfolios.

Together, biology, chemistry, and information technology have revolutionized the way new therapies are developed. Companies now rely on a more detailed understanding of the biological and chemical structure of proteins as they test millions of chemical compounds. 

With the increased generation of terabytes of test result information, life sciences companies can now pursue dozens of products to treat a range of diseases. 

A biotech company moving toward proteomics can create up to seven terabytes of data per day once its application is fully implemented. Using such techniques, companies will create more data over the next three years than they did during the previous 40,000 years combined, according to a recent University of California at Berkeley study.

As a first step toward increasing the speed of the drug discovery pipeline, pharma and biotech companies have purchased the largest and fastest computer servers. Although there have been dramatic improvements in high-value servers, the sheer amount of data being calculated has forced companies to move beyond simple CPU (central processing unit) power. 

To meet that information deluge, life sciences companies are building enterprise storage infrastructures to facilitate information sharing across their organizations. Market leadership will come from companies that can do the best job of storing, processing, and distributing complex bioscience, clinical trial, and market research data.

Pharma companies now ac-quire data from their own labs as well as commercial and public databases, and database subscriptions with genetic variation data from other pharma, biotech, diagnostic, and genomic companies. The key differentiator will be the successful integration of data from those disparate sources and the ability to protect, manage, and share that complex data within the context of a highly regulated industry. 

Life sciences companies can leverage information from R&D data acquisition and clinical trials throughout the pharmaceutical value chain by building an infrastructure that promotes research collaboration. The most successful and best-positioned companies will invest in best-of-breed components such as servers, enterprise storage systems, database management systems, and bioinformatics applications. 

Incyte Genomics (incytegeno mics.com) of Palo Alto, California, has such an infrastructure to help researchers explore complex illnesses such as cancer, diabetes, Alzheimer's, and cardiovascular disease. Its research information also is being used to develop powerful new treatments and to advance medicine in new ways. 

Reliable and timely research and analysis provide a vital piece of the genomic puzzle to customers, partners, educational institutions, and the research community worldwide. Incyte's growing demand for increased information storage, and the space to accommodate it, were presenting barriers to future growth. So the company worked with EMC (emc.com) of Hopkinton, Massachusetts, to implement a cost-effective information storage infrastructure that both consolidated its existing computer storage environment and boosted its information storage capacity, performance, availability, and manageability. 

Rebecca Naughton, information systems architect for Incyte Genomics says,"The storage solution we chose is a make-or-break decision with respect to the database part of our business in terms of processing. If we don't do it right, it's extremely difficult to make the commitment we need in deliverables to our customers."

The high-performance information storage infrastructure delivers double the capacity of the previous configuration-from 28 to 56 terabytes-in less than half the physical space.

"The speed and dependability of the system contributes heavily to our ability to complete our processing schedules on time," says Naughton. "We need to process as swiftly and reliably as possible so our data is current. Like any other organization, when we are processing something, we can't afford downtime. Once we deploy, we need to be solid."

The new information storage infrastructure supports the production environment of the LifeSeq Foundation, Incyte's database for functional genomics. Because LifeSeq's  process pipeline combines various operating systems-including SGI Irix, Sun Solaris, and Compaq Tru64-with leading-edge technology, such as Incyte's proprietary genomic analysis applications, the chosen storage infrastructure had to be flexible enough to easily integrate with the whole. 

"Using those new systems, we can reallocate disks more efficiently, which makes operations much more flexible, and scalable on demand," says Greg McGrath, senior director of infrastructure services at Incyte Genomics. 

The storage system's interoperability also gives the company the flexibility to meet the growing and changing IS/IT requirements of LifeSeq Foundation while conserving existing investments. 

"It gives us an easy way to consolidate our storage and use it on various platforms," says McGrath. "With our new software, we'll get the trustworthiness and quickness we need-two major concerns we had with other storage vendors. We'll also gain a competitive advantage because of the ability to back up our databases."

With genomics research expanding to proteomics, the information infrastructure deployed by Incyte Genomics has improved the company's strategic position. As the data explosion continues, the company will be ready to provide its customers with fast, reliable access to the latest research and analytical results.

The Biodata Challenge

Nimble healthcare companies have embraced the internet while others have been disrupted by it. The ability to use the internet as part of a larger strategy in conjunction with offline campaigns is a step toward success. This article offers several tactics for integrating the web into the marketing mix.

The healthcare industry has adopted various e-commerce models including:  

clinical trial recruiting and reporting (centerwatch.com)

health evaluation sites (health grades.com)

consumer medical supplies (mooremedical.com)

online training (clevelandclinicmeded.com)

e-health insurance (ehealthinsurance.com)

provider and insurer connectivity (ehealthinsurance.com)

consumer and physician connectivity (thedailyapple.com).

No one knows if those websites will exist tomorrow, but clearly the internet has added 

an important dimension to customer relationships by providing a new vehicle for biomedical companies to deliver their messages. That new channel has value to everyone involved in business communications. The New York research firm Jupiter Communications reports that 90 percent of pharma companies plan to increase their spending online and 20 percent say they will double their investment.

challenges of strategic integration and tactical implementation. Strategically, they must deliver a common and consistent message that complements their marketing plan. Tactically, they must choose the appropriate communication path from a crowded field of digital channels.

Biomedical companies can use four primary channels to deliver their product message:   

The most common approach is to provide product information through the company's website. There are two methods available, both of which may be used for physician and patient targeting. The first focuses on branded sites such lipitor.com and purplepill. com. The other emphasizes disease-specific information, as in lillydiabetes.com. When the goal is to build brand equity, product focus is appropriate. 

The second approach educates patients about the product's merits in the context of the disease state. Frequently, companies use a combination of both methods, as exemplified by the sites Pfizer.com and Merck.com.

A second major internet channel delivers messages through disease-specific patient groups and foundations such as mydiabetes.com and dystonia-foundation.org. The host's perceived neutrality lends credibility to the site's information. Although biomedical companies have limited influence over the material posted on those websites, the hosts will work with industry experts to ensure that important medical material is used. Pharma companies can work with those sites to encourage proper diagnosis, ensure product compliance, deliver recent clinical updates, and reinforce brand awareness.

A third method for disseminating online information is through medical societies, colleges, and associations such as the American Academy of Family Physicians (AAFP.org), the Fellow American College of Surgeons (FACS.org), and the American College of Radiology (ACR.org). Those outlets are frequently used by physicians seeking online information regarding diagnostic guidelines and common treatment standards. An effective variation to the medical society approach is the use of continuing education to provide new information to physician groups through sites like WorldMedicalLeaders.com.

In addition, a range of third-party hosts, both profit and nonprofit, can be accessed to the company's benefit. General health information websites such as intelihealth.com, eMedicine.com, and DrKoop.com help com-municate patient information. Physician-specific health sites like MyDrugRep.com support direct-to-physician promotion. 

A medical device executive recently commented on lessons learned from nine months spent implementing an internet strategy. She said, "The two most important audiences are physicians and the sales force." That comment demonstrates the strategic importance of knowing how customers use the web. Physicians have been slow to adopt online tools for use in their practice or research. Therefore, companies must give MDs a strong incentive to log on and receive targeted information. They must also show their internal customers-sales reps-the value of implementing an online strategy before reps will direct their customers to the web. In short, biomedical executives cannot take a "build it and they will come" attitude toward developing a web-based promotional strategy. 

Another executive cautions that the sheer number of internet avenues to consumers and physicians causes message distortion. 

To choose the most effective course, marketers would be wise to involve customers in the development of their internet strategy. To best leverage the power of the internet, it's also important to know the level of patient involvement in the decision making process. For example, many patients with chronic conditions such as cancer or Crohn's disease make their own treatment decisions, as opposed to those with an acute illness, such as myocardial infarction, in which the physician  "calls the shots." A greater degree of patient involvement in deciding the course of treatment warrants heavier investments in patient-oriented communication channels.

As with all facets of the marketing strategy, it's critical to ensure that the web-based message is consistent with, and complementary to, the overall marketing message. If product safety is the primary message in the campaign's printed material, developing an online message that emphasizes the product's metabolic speed will confuse patients unless there is a safety tie-in.

The guiding principle for choosing among different promotional vehicles must be profit-ability as measured against return on investment. To assess the potential value of a web-enabled promotional strategy, marketers should undertake a financial analysis. The internet facilitates easy data capture for measuring cost per exposure and can be used to track other metrics such as minutes spent per page and point of origin. 

Companies must also address two practical issues-privacy and copyrights. Many activists are concerned about how internet health sites will use data collected from consumers. Attempting to communicate with patients or physicians who don't want the contact is taking an unnecessary risk. Reach out to those audiences when their interest is piqued. Companies must find a way to deal with copyright issues at the outset. For example, some medical publications want to charge a per-copy fee for clinical reprints sent through the internet. Addressing those issues early in the planning of an online marketing strategy saves time and money.

In an era of internet ubiquity, patients and physicians expect easy access to product information. With thousands of health-related web channels available, companies must be disciplined about evaluating the various outlets. Just as in the print world, the source of information directly affects the credibility of online content.

The biggest challenge is to integrate the chosen web approach with the company's overall communication strategy. The goal must be to implement a focused internet program that is not the core, but a complement to the other facets of the marketing campaign. 

Pharmaceutical Executive-12-01-2001

Connecting the Dotcoms

When Disaster Strikes

The Biodata Challenge

Choosing the Right Communication Channels