Tulane University wanted to upgrade its aging email infrastructure, but its needs were somewhat complex. It wanted leading-edge email, collaboration, and messaging services, but it also wanted a fully redundant email infrastructure to ensure
communications continuity should another major hurricane pummel New Orleans. It wanted a solution that faculty, staff, and students could access from anywhere, at any time, and from any device, but it also needed a solution designed with HIPAA compliance in
mind, since the new email solution it deployed would be supporting the University’s medical school and hospital facilities. Finally, Tulane’s IT team wanted to find a way to meet all these needs without breaking the bank. The solution? Tulane moved into the
cloud, using a HIPAA-compliant, disaster-tolerant solution from Microsoft: Office 365™ for education.
In the years after Hurricane Katrina devastated New Orleans in 2005, the IT organization at Tulane University was busy putting critical university systems back in working order. It was not until late in the decade, though, that the modernization of Tulane’s
email infrastructure finally arrived at the top of the IT organization’s priority list.
In some ways, it was just as well that they had not upgraded from Microsoft® Exchange Server 2003 earlier. When Exchange 2007 became available, the IT organization was too busy rebuilding other systems to focus on upgrading the email system. So, by the time
they began to address the challenge in earnest in 2009, the capital costs associated with a traditional upgrade from Exchange Server 2003 were enough to induce sticker shock. The University would have to:
- Acquire nearly 20,000 user licenses for Exchange Server 2010.
- Acquire new hardware on which to run the email infrastructure.
- Expand its storage systems immensely (for users wanted their inbox storage quotas increased by several orders of magnitude).
And this was just for starters. Because of its experience with Katrina, which knocked out the email system for four weeks, Tulane’s IT officials had been planning to duplicate the new email infrastructure at a remote site to ensure continuity should disaster
strike New Orleans again. Effectively, this plan more than doubled the already significant expense of a traditional upgrade.
As a result of this sticker shock, Tulane’s IT officials reconsidered their options and realized that a traditional upgrade might not be the University’s only—or even best—solution. A cloud-based solution might provide faculty, staff, and students with the
messaging services they needed without incurring the capital expenditures for infrastructure that a traditional upgrade would require. Furthermore, a cloud-based service could ensure the service resilience that Tulane had been planning to ensure with the parallel
email infrastructure in the remote data center—again, without incurring the expense of actually having to build a parallel email infrastructure.
One Dark Spot in a Bright Cloud
Because a cloud-based approach made it so much easier to upgrade its email infrastructure, Tulane decided to migrate its users from Microsoft Exchange 2003 to the Microsoft Live@edu service in 2010. In addition to enabling Tulane to avoid the capital costs
associated with complex hardware roll-out, Live@edu would enable Tulane to avoid the cost of licensing the Microsoft Exchange Server software: Microsoft offered Live@edu at no charge to educational institutions.
||Microsoft knew it needed to have a HIPAA BAA [Business Associates Agreement] to support universities and medical schools with Office 365 for education … and it came out with a BAA that is very good.
| Leo Tran
Assistant Vice President for IT Infrastructure,
Tulane University Technology Services
But soon after reaching its decision to migrate to Live@edu, Tulane’s IT officials discovered a problem. Tulane has a large medical school and hospital complex, and any email system used by the medical school or hospital is subject to the privacy provisions
defined in the Health Information Portability and Accountability Act (HIPAA). To comply with HIPAA regulations, Tulane would need a HIPAA Business Associate Agreement (BAA) from Microsoft, a document verifying that the information residing on its servers and
passing through its infrastructure would be secured in accordance with HIPAA privacy requirements.
Tulane IT officials had no difficulty asking Microsoft for a BAA—the difficulty was that Microsoft could not provide one for the Live@edu service.
Microsoft assured Tulane that its inability to offer a BAA had nothing to do with undisclosed security problems in Live@edu. The difficulties were rooted in legalities.
Given the advantages offered by the cloud—and the fact that neither Google nor any other cloud service provider would agree to provide a HIPAA BAA—Tulane decided to continue with its plan to use Live@edu. However, it decided to migrate only those user accounts
whose data was not subject to HIPAA regulation. Accordingly, late in 2010, Tulane’s IT department worked with Microsoft to move nearly 15,000 student accounts from the University’s on-premises Exchange 2003 system to Live@edu, where they gained access to email
services built around Microsoft Outlook® Live and a Tulane-branded Exchange solution, collaboration services built around Microsoft SkyDrive®, as well as messaging services built around Windows Live Messenger.
Meanwhile, students, faculty, and staff associated with the medical school and hospital would have to remain on the old Exchange 2003 solution until such time as a HIPAA-compliant cloud service became available.
With the announcement of Microsoft Office 365 for education, that time came in early 2012.
Office 365 for Education
Microsoft Office 365 for education takes Live@edu to the next level. It combines the familiar Microsoft Office desktop suite with online versions of next-generation Microsoft communications and collaboration services, including:
- Microsoft Exchange Online for email, shared calendars, and shared address books.
- Microsoft Lync® Online for instant messaging and online video conferencing.
- Microsoft Office Web Apps for online access to Microsoft Office files.
- Microsoft SharePoint® Online for collaboration and resource sharing.
These applications run in data centers owned and operated by Microsoft, and Microsoft maintains the servers and the software on a day-to-day basis. Office 365 for education is, like Live@edu, offered free of charge to educational institutions. Unlike the
Live@edu service, though, Microsoft can offer a HIPAA BAA for institutions that need such an agreement for HIPAA compliance.
As soon as Microsoft introduced Tulane IT officials to Office 365 for education and indicated that a HIPAA BAA would be available, Tulane signed on—and decided to move everyone at the University to Office 365 for education, including the faculty, staff,
and students attached to the medical school and hospital.
For Tulane, Office 365 for education is delivering significant benefits in a number of areas. It has provided faculty, staff, and students with a world-class email and messaging system that can be accessed at any time, from anywhere, and from any device
the user wants to use. It has enabled users at Tulane to take advantage of new communications features quickly and easily because it builds on their familiarity with Microsoft Office Outlook. There was virtually no learning curve for users familiar with Exchange
2003 or Live@edu, so they have been able to be productive from day one. It has also provided users throughout the Tulane community with a huge boost in email storage capacity. Faculty and staff moved from a 300 megabyte inbox quota to a 25 GB quota. Students
gained even more dramatically, moving from a 100 MB inbox quota to the same 25 GB quota that all Office 365 for education users enjoy.
Cost avoidance has also been a huge benefit arising from the adoption of Office 365 for education. In avoiding the need to purchase more software licenses, more high performance servers, and remote facilities to run a standby email infrastructure, Tulane
IT officials calculate that the University has avoided capital expenses totaling more than $1 million—and that figure does not even include implementation costs. At the same time, Tulane has been able to stop subscribing to a disaster recovery system that
it had been using as a stop-gap solution—and by eliminating the cost of subscribing to that system, Tulane is saving another $250,000 annually.
The IT organization has been able to avoid the need to hire additional personnel to support an expanded infrastructure and its existing staff has been able to spend more time focusing on strategically important projects.
But for Tulane, one of the most significant benefits of Office 365 for education is that Microsoft has engineered this solution with HIPAA compliance in mind. The HIPAA BAA that Microsoft offered Tulane reflects discussions that Microsoft had with the Common
Solutions Group, whose members include the CIOs from more than 30 research universities around the United States.
“Microsoft knew it needed to have a HIPAA BAA to support universities and medical schools with Office 365 for education,” says Tran, “and it came out with a BAA that is very good.”
The HIPAA BAA removed the one hurdle that had previously prevented Tulane from fully embracing a cloud-based offering—and once that obstacle was removed, Tulane could complete its move to the cloud and take full advantage of the benefits that the cloud offers—from
leading edge functionality to geographic resource distribution and disaster tolerance.
“I believe that Tulane was the first university to upgrade from Live@edu to Office 365 for education,” says Tran, “and that’s exciting. All our email infrastructure is in the cloud now, and Microsoft is responsible for taking care of it.”
Microsoft Office 365 for Education
Microsoft Office 365 for education brings together cloud versions of our most trusted communications and collaboration products—Microsoft SharePoint Online, Exchange Online, and Lync Online—with the latest version of our Office desktop suite and companion
web applications for educational institutions.
Office 365 for education helps save time and money, and it frees up valued resources. Simple to use and easy to administer, it is financially backed by a service level agreement guaranteeing 99 percent reliability. Office 365 for education features robust
security, IT-level phone support, geo-redundancy, disaster recovery, and the privacy controls and standards that you expect from a world-class service provider.
For more information about Microsoft Office 365 for education, go to:
For More Information
For more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers in the United States and Canada who are deaf or
hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to:www.microsoft.com
For more information about Tulane University, visit the website at:
This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.