Photo: Health Management Technology
Security and privacy in healthcare are obviously hot topics. So, when Sentillion decided to sponsor HIStalk a few weeks ago, I pressed my luck and asked for an interview with CEO and co-founder Rob Seliger. I knew the company was refocusing a bit and also introducing a new single sign-on application called expreSSO, so I offered as bait the chance to talk about that. When I got on the phone with Rob, he said he’d be happy to talk about anything and that we didn’t have to pitch product. Good answer.
When I hear either “single sign-on” or “CCOW”, I think of Sentillion first because they’ve been doing it for a long time. They’ve introduced some new products I wasn’t fully aware of, including the vThere virtualized client for remote access.
Thanks to Rob for the chat.
Tell me about Sentillion and how you came to create it.
Sentillion was founded in 1998, spun it out of the former HP medical products group. I have the simplest resume on the planet – paper route, HP for 18½ years, then Sentillion. [laughs] I was working on technology that integrated applications not on the back end, like databases and integration engines, but on the front end of care, looking at the user experience of the caregiver, whether using applications from the same or different vendors.
We determined that our technology would serve better as a glue, run as a neutral company. We built a business case, they agreed. We spun the IP out with myself and my co-founder in 1998. We did three rounds of venture capital, the last one in 2001, and have been growing the company every since.
We moved from general integration to specific applications used in identity and access management. What we’ve been able to do is create a whole suite of products that address identity and access management needs for healthcare and, specifically, hospitals.
We sell to provider healthcare organizations. We’re unique in that way. Our competitors sell to finance and banking and retail customers. We said that healthcare has special needs, workflows, idiosyncrasies, and constraints. We wanted to create technology that was purpose-built for healthcare. Fast forward and we have hundreds of thousands of caregivers in hundreds of hospitals in the US, Canada, UK.
Healthcare security, like IT in general, seems to fall well behind that of most other industries, with lack of consistent authentication rules across applications, applications that don’t support LDAP or other centrally managed security, and heavy help desk use for password resets. Is it getting better?
It is getting better, but slowly. There are reasons why stronger security technologies have not been broadly adopted in healthcare. The main reason is that they get in the way of delivering healthcare. I’m not a physician or nurse, but I have a tremendous respect of what those people do for a living, taking care of people as their number one job. Navigating security isn’t what they’re paid to do. Our customer base is some of the smartest, most highly trained people on the planet and they’re adept at finding workarounds to impediments to delivering care, including security.
Part of our process is leveraging the years of experience we have in the care business. How many other security companies can you name that have a chief medical officer? We hired Dr. Jonathan Leviss as our Chief Medical Officer because he had a passion to eliminate the obstacles between caregivers and the productive use of computers.
You’ve heard of the last mile problem, like with DSL, where you can’t get connected if you’re too far from the telephone switch. I refer to our situation as the last inch problem, that inch that’s between the caregivers’ fingertips and the keyboard they don’t use. We provide security solutions that make them more productive instead of less, while instilling better security practices across the organization.
People often say that healthcare is slow to adopt technology, yet you can look at the amazing equipment from imaging systems to robotic surgery that is used. I don’t see a fear of technology in healthcare, just an avoidance of technology that’s an impediment to healthcare delivery. Vendors often miss that. We work really hard to get that right.
What security priorities would you recommend to a hospital CIO?
My favorite thing to do if I’m allowed is to take a walk, particularly in care areas, and watch what people are doing, who they are, where the computers are, what they’re showing, and whether they’re attended or unattended.
UPMC implemented our solution years ago. They started deployment in the ICU. I was with an entourage of UPMC executives and I drifted back from the tour group because they were headed to a workstation that someone was using with single sign-on and single patient selection. I stood back and marveled at all the workstations that were not in use, but were locked. I asked UPMC when the last time was that all those workstations with no one around were actually locked. [laughs]
It’s kind of like the broken window theory of why neighborhoods go downhill. Good security isn’t just the things you do on your network with firewalls and antivirus software. It also has to do with what people can see. Show them that their information is being safeguarded and protected. How would someone feel being wheeled down the hall and seeing other people’s information on display? It could be their information as well. You must show personnel and patients that they’re doing the right thing.
You testified before Congress after the VA’s security breach. How would you grade their progress since?
The hearings were for the right intentions but for the wrong reasons. The breach that occurred with the theft of that laptop was benign. The information was not clinical and the thief who stole it didn’t know it was there. At the end of the day, it was a non-event. They didn’t get Congress to the point of understanding how to practice good security.
The VA has the same challenges as non-VA – security vs. usability, however people who work for the VA can be told what to do, which isn’t always true of community physicians in hospitals. The VA has its act together as well as anyone else. They’re continuing to make investments in practical security practices. They’re extending a pilot we did for deployment of single sign-on, which is the first step in a powerful direction for them.
The participation in that hearing was fascinating for me. It was literally like being in a TV show. Members of Congress were in seats elevated maybe 10 or 12 feet in the air, looking down at myself and my VA colleagues at a table. Each member of Congress took the opportunity to express a passionate opinion, not all of which were germane to the conversation at hand. Despite the hyperbole, they actually listened to what I said and what the VA said. They asked good questions. It was a remarkable discourse.
The hearings were well after 9/11, yet the halls of Congress, with minimal screening, are still very open to the public. It was a wonderfully reassuring about our way of life. It was wide open to people who wanted to come and listen and participate and not be overly encumbered with security.
I’ve done so much public speaking that I’m rarely nervous, but I was nervous. I would not want to be there for a serious transgression or offense.
If I looked at your laptop right now, what security measures would I find?
You’d find our product, Vergence, which is single sign-on and a bunch of other things. Virtually everybody here uses it. What do I like about it the best? I don’t have to remember my passwords for the system that approves expense reports, Webex, salesforce.com … the list goes on and on. What I like best is the sheer convenience factor. The screensaver periodically locks my workstation after about 15 minutes of unattended use. That happens whether I’m using it at home or in the office. We all use high quality passwords, mnemonics based on pass phrases, based on an elaborate sentence I can remember and choose some letters from it to make my password.
Unless you’re sitting in front of it, you wouldn’t see the display because of a 3M privacy protection screen. I was working on board financials on an airplane flight several years ago when the woman next to me leaned over, almost into my seat, and said, “You know how to use a spreadsheet.” I thought, “How long has she been watching me work on board financials?” Anybody who’s a road warrior in the company can have a privacy shield.
Security and privacy get confused. The woman looking over my shoulder wasn’t trying to hack our systems, but she was breaching our privacy as a company by looking at sensitive information. Both security and privacy need proper protection. The recent George Clooney story suggests that the concern is well founded that the biggest data access concern that healthcare organizations should have is what happens within their four walls. Too bad Palisades Medical Center isn’t a Sentillion customer, as this is not a good way to get one’s hospital in the news.
Are you happy with the progress that healthcare software vendors have made in making their products CCOW compliant for improving the user experience?
Interesting question. The general answer is no. We’ve put our heart and soul into the CCOW standard going back to the HP days. Standards in healthcare still have a fickle existence when it comes to vendors adopting standards and applying them thoughtfully and properly to their products and with the same interest as something that is purely proprietary.
Much of the venture capital we raised in the early days was spent giving market visibility to the CCOW standard. That helped to a point, but there are vendors to this day who have not implemented the standard or have done so in an incomplete way just to check off that they’ve done it, or done it in an elitist way, interpreting it in a way that’s good for their business interests but not as useful to the customer as a full implementation.
Often a customer will say to us, “You’re Sentillion, can’t you get Vendor X to do it correctly?” I keep looking for that sheriff’s shield or subpoena power to tell vendors what to do. [laughs] We’re just another vendor.
Our answer was that so much of what was conceived by us and others in the standard is extremely powerful, but if vendors won’t implement it timely or correctly, we need another way. We developed a technology called bridging that allows achieving the standard in a way that’s not invasive to the application.
The A-Ha was that the part of the application we can see and rely on is the user interface, as opposed to trying to inspect the application at a code level and hoping for an undocumented API or secret hook that we could latch on to. The user interface is tangible. Because that translates into a series of calls to the underlying OS, we created programs to watch for those calls. We can watch an application as the user is using it and see that they selected a patient. We can get that and send it to other parts of the application to automate patient selection, but without having the CCOW standards.
I read something where someone said that CCOW is a great standard, but that Sentillion controls it. Boy, did that rile me. I’ve been doing this for over 15 years, originally for non-CCOW work. There are very specific rules of engagement for a standards open development process, from NIST, a standard for being a standard, how you vote, how you achieve a quorum, etc. For an open standard, when you have a final ballot, people can vote Yes, No, or Abstain. You throw out the Abstain votes and 90% of what’s left has to be Yes for the standard to be valid. Imagine trying to get that level of agreement in your own family. [laughs] It’s a tough hurdle with lots of opinions, lot of eyeballs before a ballot passes. There’s no way any one organization can control a standard. They can be a blocker if they have enough votes, but they can’t force something to happen.
If there’s a secret to what we’ve done, it’s two things: show up to the meetings and document them. [laughs] I like to write and most people don’t, so often it is myself or others who volunteer to document the meetings, but that doesn’t mean we’ve done anything more than spending evenings and weekends to pull documents together for the greater good. The idea that an individual or organization can control a standard is unfounded.
When I Google Sentillion, I get ads for ComputerProx and Encentuate. What is the Sentillion value proposition over these and other competitors like Carefx?
The companies we’re most likely to compete with head to head are more often companies like Novell or Computer Associates, We’ll also see Imprivata. We don’t see a lot of some of the other companies that come up with the ad hits, even though they’ve latched onto the keywords. Across the board, for all our competitors, there are really three salient points.
First is the healthcare focus. A CA or Novell, while they have sales and marketing teams that cater to healthcare, have products that are generic that are supposed to work in 9 to 5 office environments and not necessarily healthcare.
Second, we believe strongly that we provide a fabric or glue. The last thing we want our customers to have to do is glue our glue. If we show up and say, “We have one piece of the puzzle and you’ll have to work with these other vendors”, that’s not particularly satisfying. That’s why we’ve invested heavily in developing our own products. All our products were developed by Sentillion so our customers would have a single vendor, a single number to call. Every one of our competitors requires multiple partners to do what we do as a single vendor.
Third is the incredible track record we have in getting customers live and keeping them live. We have hundreds of hospitals and hundreds of thousands of users. We monitor uptime across all customers and report to our board like it was financial information. Five nines. Who’s doing that for a security apparatus like we provide?
I hope you don’t think it’s bravado, it’s just pride. There are still hospitals using monitors that I wrote firmware for, like the HP Clover. I still feel pride when I walk by them in a hospital and know that patients are being cared for with something I wrote.
Why is desktop virtualization important?
Going back to this sense of responsibility to solve problems, for years our customers were asking us to help with people who are not physically in their facility, like community docs or docs working at home. We told them we could help to a point, but they’d have to build a portal or provide remote emulation like Terminal Server or Citrix, which requires an investment in servers and expertise. That’s an OK answer, but not satisfying for customers.
We were developing improvements to our internal testing apparatus. We do massive scalability tests to test response time and failure factors and failover. We were experimenting with the virtualizing of clients, not servers. 99% of what people are doing is on servers, putting multiple virtual servers on one physical server. We thought, “With a bit more work, we could provide a virtualized client to our customers.” That was the birth of our vThere product.
Take the clinical workstation with whatever applications, OS, service packs, etc. for people who are physically in your enterprise. You can make exactly that same environment available to people outside your organization. It’s transparent, no particular software package or OS, or even preventatives or antivirus. You need a host PC of a reasonably contemporary vintage running a reasonably contemporary version of Windows. That’s it.
Fire up Windows and you get a completely virtualized version of the clinical workstation running on the host using the host’s memory and CPU, but no other aspect of the host software, If you use a VPN, we use that. The user clicks on an icon, it runs in a window and looks exactly like the application in a hospital. They provide their logon credentials and everything is identical. Radiologists can manipulate their images exactly like in the office without the remote delays. There’s no training involved, no new portal, and no additional expenses for standing up servers to host WTS or Citrix. It’s all running on native client hardware.
We introduced vThere in the middle of 2006. Use ranges from physician access to their full cadre of clinical applications to medical coders who work at home, who have increasing clout because they stand between the hospital and reimbursement. Hospitals are increasingly willing to accommodate a work-life balance for coders. Customers are doing that with IT, too, allowing them to work from home two or three days a week. How can you provide with them their usual applications? Our vThere product is a practical, elegant, and cost-effective solution.
Proximity-based security and biometrics always seemed ideal for healthcare. Are they, and how well are they selling?
We have extensive implementations of proximity and biometrics, primarily in the US. Less so in Canada and in the UK, which has a different model where NHS has mandated the use of smart cards. The combination of active proximity and biometrics is very powerful. You can achieve touchless logon. You walk up to a workstation, your identity is provided to an active proximity device, and you are then authenticated by fingerprint. With Vergence, our flagship product, we can not only log you on, but automatically launch your applications based on your role, and then single sign you onto those applications. The first thing you need to do is select a patient – we can’t read minds yet. [laughs] It’s very powerful. Customers are using the technologies separately as well.
We introduced in the latest version of Vergence a variation on the strong authentication theme using passive proximity devices and an Enterprise Grace Period. Most healthcare environments are reasonably physically secure. You can have flexibility in how you apply authentication to users during the day. The user, at the beginning of their grace period, swipes a proximity card, authenticates by password, and does their business. The next time they need to log on, during the grace period defined by the organization, they only need to swipe their smart card. Possession of the smart card within the grace period tells us it’s that user. Those seven or eight character strokes done 50 to 100 per day times add up. It allows organizations to find the right balance between strong authentication and caregiver convenience.
How does expreSSO change the single sign-on equation for healthcare customers and for Sentillion?
The biggest challenge that customers have with anybody’s single sign-on always centers around connecting with the application. Often, a vendor walks into a sales situation, tries to impress on the customer how easy their tools make it, and shows a live demo. They’ve thought through the applications to impress how easy it is. For more complicated applications, or those developed in-house with less optimal programming, what seems so easy in the sales call is much harder.
We’ve taken everything we’ve learned to make it easier to deploy. The next generation of tooling accompanies expreSSO. A wizard allows organizations to create incredibly sophisticated connectors without having to write code. If you think about a process of creating a connector for signing on and off and dealing with other sign-on related events, you’re navigating through a series of screens and either inputting information on behalf of the users or accepting information like a password expiration message. The trick is to satisfy the application by putting in the right information at the right time while responding to the information needed.
We looked at metaphors that would be easy for people to understand. We decided to use editing a movie. Movies have frames, they flow in a sequence, and you can insert special affects. We take a movie metaphor and apply it to the process of having a user generate a connector to a target application. We show screens in the order they want them to appear and define inputs based on visual controls that they point and click through — for a logon, logoff, or password expiration message, each representing the application as it appears at a certain point in time.
Anybody that’s used iMovie or Microsoft’s movie maker would instantly get how the expreSSO wizard makes connectors for applications. My wife recently edited videos of my son, who’s a competitive fencer. Colleges wanted 15 minutes of video. My wife went through hours of movies, having a great time with iMovie creating effects. She’s not a movie director, and had never used iMovie before, but she was still able to use a tool to do very powerful things.r That’s what expreSSO is all about.
The press release mentions cost savings.
Vergence does an awfully lot more than single sign-on – patient selection, auditing, and role-based access. Vergence is really a platform for creating a complete clinical workstation. It’s always been that, but in the early days, it was too broad for people to understand that, so we positioned it as a single sign-on solution. It’s like saying a car is an air conditioner when it’s more than that, like an entertainment system and transportation.
expreSSO does one thing really well and cost effectively – signing on and signing off. Customers increasingly want to focus on that to start and that’s what expreSSO is meant to solve really, really, well. When they’re ready for a more comprehensive solution, they can upgrade to Vergence.
You’ve had some recent organizational changes, I’ve heard. What’s going on at Sentillion?
We made some changes back in June that were mainly centered around refocusing the company on healthcare. We had started a process with vThere in broadening our footprint beyond healthcare in a thoughtful way. We created a business unit inside of Sentillion to look at opportunities outside of healthcare so the bulk of the company could stick with healthcare.
It’s difficult for a $30 million company to do as many things as we were trying to do. We were diversifying into the UK, bringing vThere and expreSSO to market, and trying to establish a foothold for vThere outside of healthcare. It was one vector too many. I decided we needed to reconsider expanding outside of healthcare, or at least let it be opportunistic and let companies find us. We had hired people without the healthcare background because we didn’t need that.
We’ve just come off a terrific Q3, the first full quarter since the change. We signed six new customers and sold a bunch of products to existing customers. It was a good thing to do and we did it thoughtfully for our customers and employees.
What do you like most and least about being a CEO?
I thought I would miss writing code. My expertise is in distributed, object-oriented programming. How’s that for a mouthful? [laughs] I really don’t miss it. I find what I really enjoy is the challenge of doing things that others haven’t done before.
People often ask me about what I do other than work. I have a car that I’ve been building for years. I drag race it. It’s a combination of parts that have never been put together, which means I make a lot of mistakes. I fine tune my problem solving skills and persistence. The thing I love most is to see what others here are able to accomplish that I have nothing to do with. It’s intensely satisfying. It happens following ethical principles that we care about and a corporate style that I care about, but I had nothing to do with it.
What I like least is the set of arcane accounting rules that govern software revenue recognition. It’s a set of principles defined by accounting boards that software companies need to follow to book revenue on an annual or quarterly basis. The rules are complex, but accounting rules don’t have that foundation of reason. It’s kind of like laws that evolved over the years. You can spend an inordinate amount of time interpreting the rules so you do the right thing. I’m not always sure that time is effective for the business or customers, other than you want to do the right thing.
Who do you admire in the industry?
The people that I admire most are in the new generation of CIOs, probably in their late 30s or early 40s, who grew up with information technology instead of having it happen around them. They have business savvy as well. The combination of a comfort with IT and business savvy are impressive.
Mark Hopkins at UPMC is one such person. Steve Hess of Christiana Care, Praveen Chophra at Childrens Healthcare of Atlanta, Allana Cummings of Children’s Omaha, and Marianne James of Children’s Cincinnati. All of these are examples of healthcare CIOs who have a comfort with technology and business acumen. They are putting it to formidable use in their organizations.
I gave a lecture at HIMSS about the healthcare tipping point, referencing Malcolm Gladwell’s book. One of the required ingredients is people like this to make it happen. If healthcare IT becomes truly pervasive in the next five years, it will be because of people like this.
Thanks for sponsoring HIStalk, by the way.
What was most fun about sponsoring your blog is that we all reading it already. It was a Homer Simpson Doh! moment. The best endorsement is that we didn’t just hear about it and decided to sponsor. Just like we use our product, we were already reading your blog.
Comments Off on HIStalk Interviews Robert Seliger, CEO and Co-Founder of Sentillion
Oh, I have no doubt it would have been plenty bad enough. My co-workers and I saw the database fields…