Baylor – Keeping HIPAA Compliant in Office 365 Migration

Bound by regulations including the Health Insurance Portability and Accountability Act (HIPAA) for patients and Family Educational Rights and Privacy Act (FERPA) regulations for students, designing and maintaining key systems such as messaging and email records storage is no easy undertaking.

Paul Crow, Manager of Enterprise Messaging and Collaborative Technologies for Baylor, explained the situation presented to his team prior to initiating an email migration project:

“We had been using an on-premises Microsoft Exchange system to provide an email service for our stakeholders. This was supported by safeguards including data loss prevention tools to avoid the transmission of inappropriate information, and also Veritas Enterprise Vault to provide secure email retention services. Due to storage limitations, we were only able to offer 3 years’ worth of archiving capability, and for research staff collaborating on long-term projects, this was unacceptable. Then there were issues with a poor-performing Outlook plugin that was making searching archived email very difficult for people. The final challenge for our email storage infrastructure was a calculation of what it would cost to keep all our data on-premises, given the sheer volume of email traffic. Our estimate ran into multiple millions of dollars!”

Baylor made the decision to migrate its systems to Microsoft’s Office 365 cloud service. This was prompted by a change in key management personnel, who adopted a policy of, in an ideal world, “Keep all emails forever”.

Crow elaborated on this decision, “The Office 365 platform ended the problems we’d been having with storage limitations. Being both HIPAA and FERPA compliant meant it was also a feasible solution to migrate our data. We only had to educate users regarding what would constitute protected email content.”

Baylor used Transvault Migrator for its archive migration, delivered along with services from one of TransVault’s top North American partners, US-Amplify.

While ensuring the required level of security and confidentiality, including complete chain-of-custody and accurate ownership mapping, Transvault Migrator moved the institution’s email data in record time.

Joseph Whitmore, US-Amplify’s Technical Lead for the project, upgraded Transvault Migrator in-situ during the project to get the benefit of Transvault’s CloudStream ingestion technology. “The performance of the legacy email data transfer to Office 365 had been good before the software upgrade, but with this this new version of Transvault Migrator, we saw a huge leap forward in terms of throughout”, explained Whitmore.

“The project was now going so fast that, at points, US-Amplify was waiting on us for input before it could move to the next phase”, added Crow. As illustration of this, the project was running at 3 million messages per week – after the CloudStream upgrade, this improved to 13 million messages per week.”

The two teams were extremely complimentary about their joint project. “Working with such a high caliber IT team at the customer’s site made the whole project flow a lot more easily”, commented Whitmore. In return, Crow said, “We were 110% satisfied with the project delivered by US-Amplify, and the team worked well with us throughout the process. Plus, our end users – at worst – experienced two hours loss of access to their archives as they were being migrated, so they were happy too.”