WAKE FOREST UNIVERSITY BAPTIST MEDICAL CENTER

Major Medical Center Boosts Health of IT Systems, Cuts Update Time by 90 Percent

Automated software updates are great—unless they reboot a computer that’s needed to keep someone alive. Wake Forest University Baptist Medical Center didn’t want that to happen, and so it had to manually update systems used for patient care. Now, Microsoft® System Center Configuration Manager 2007 gives computers the intelligence to know when they can accept an update and when they can’t. The solution also cuts update time by up to 90 percent.

 

Business Needs

Brian J. Uzwiak helps to maintain the health of Wake Forest University Baptist Medical Center—the technological health of the medical center, that is. Wake Forest is one of the nation’s preeminent academic medical centers, serving a 26-county region in northwestern North Carolina and southwestern Virginia.

The medical center’s healthcare providers do an award-winning job of taking care of patients. Uzwiak’s job, as Manager of Network Technology Services, is to give the same careful treatment to the organization’s technology infrastructure.

Thanks to Configuration Manager 2007, we can move our people into positions where they don’t just maintain our systems, but they deliver strategic value. Brian J. Uzwiak Manager of Network Technology Services, Wake Forest Baptist Medical Center

That infrastructure included 10,000 desktop personal computers, 2,000 laptops, 600 Tablet PCs, 2,000 thin-client devices, and 400 computer servers. When malicious software from the Internet became a looming threat a few years ago, Uzwiak made sure that the medical center was properly “vaccinated”—using Microsoft® Systems Management Server (SMS) 2.0 and, later, SMS 2003, to ensure that security updates from Microsoft were deployed within 10 days of issuance.

Systems Management Server automated what had previously been a manual process, one subject to inevitable delays and errors. Now, the medical center could be sure that its computers were safeguarded against potentially devastating threats.

Or, at least that most of its computers were safeguarded. The medical center had hundreds of computers in patient-care environments such as operating rooms, labs, and the intensive care unit and its pharmacy. The medical center couldn’t risk that an automated update package would attempt to download and install itself on one of those machines—taking the machine out of service to reboot—while it was needed for patient care.

Medical center personnel, not the software, would have to control when the updates were implemented. So, administrators continued to update those computers manually—with all the expense, delay, and potential for error that manual operation entailed.

Solution

Until now. The medical center is currently deploying Microsoft System Center Configuration Manager 2007—the successor to the Systems Management Server software it already used—throughout its enterprise.

“System Center Configuration Manager 2007 allows us to address the major problem that we had with automated updates—the need to control when those updates would hit patient-care machines,” says Uzwiak.

It does that through a new feature called “maintenance windows,” a collection-based way to enforce scheduled changes to managed systems. Uzwiak and Vicki Williams, Senior Network Systems Analyst at the medical center, work with medical personnel to identify the specific days and times when reboots of their systems will not interfere with the provision of medical care. They use the System Center Configuration Manager console to create a collection for each maintenance window they want to use, and assign the relevant computers to it.

The collection criteria then are pushed out to the computers. When those computers receive an advertisement for an available update, they check their maintenance windows and only install the update during the specified window.

The medical center is also planning to take advantage of other System Center Configuration Manager 2007 features. The privacy requirements of the federal Health Insurance Portability and Accountability Act require healthcare providers to encrypt the hard drives of laptop computers and other mobile devices that contain patient information. But, as an academic institution with decentralized purchasing policies, the medical center couldn’t ensure that all laptops would be loaded with the approved PointSec encryption software.

Now, it can. The Desired Configuration Management feature in System Center Configuration Manager 2007 can check the configurations of laptops on the network and create a report for the IT Security Department, summarizing compliance and non-compliance. Administrators can then contact laptop users as needed to bring them into compliance with the policy.

Benefits

System Center Configuration Manager 2007 is helping to raise the level of protection for the Wake Forest medical center environment while reducing the time, labor, and expense needed to provide that protection, according to Uzwiak. The maintenance window feature is so popular with administrators, for example, that the organization has accelerated its adoption of System Center Configuration Manager to take broader advantage of it.

The medical center is also operating more effectively. For example, it recently reorganized, moving staff members out of positions responsible for manual update deployment.

“Thanks to Configuration Manager 2007, we can move our people into positions where they don’t just maintain our systems, but they deliver strategic value,” says Uzwiak.

Williams is impressed by the ability to automatically deploy third-party software, including updates to the Citrix and Adobe applications on which the organization depends. System Center Configuration Manager is cutting the time to deploy those third-party packages by 90 percent.

“We save not just the time to write update packages,” says Williams. “We also save the time to test them to make sure they won’t break anything.”

Uzwiak and Williams also see System Center Configuration Manager 2007 ensuring that software updates reach distant parts of the organization that were difficult to reach in the past, including 1,000 server and desktop computers at affiliated hospitals and clinics across two states.

By vastly reducing the amount of bandwidth needed to deploy major updates, System Center Configuration Manager will help to ensure that remote facilities are as safeguarded as systems in the corporate datacenter.

And while System Center Configuration Manager delivers new capabilities, it also delivers new ease of use.

“I’m really excited about the console,” says Williams. “Everything’s grouped sensibly, so you find related information in one place, where you expect to find it. URLs at the bottom of the screens help people get to the links they need even if they don’t know how to navigate to them. Because the console is easier to use, it can be used more often by helpdesk personnel and others without a lot of training in the product.”

The medical center is also conducting pre-production testing with System Center Configuration Manager and the Network Access Protection feature of the Windows Server® 2008 operating system. By integrating these new Microsoft technologies with its existing 802.1x computer authentication solution, the medical center will be able to validate dynamically that machines connected to its network meet security requirements and if not, automatically update those machines.

“Because Configuration Manager is built upon core Microsoft technologies such as Windows® Software Update Services and Network Access Protection, we expect to reap significant benefits in enhanced end-point management and security without increasing ongoing IT training and support costs,” says Uzwiak. “We’re already seeing big benefits with the maintenance windows feature and expect to extend those benefits substantially with the integration with NAP.”