Microsoft Office 365 for EducationCustomer Solution Case Study

Tulane University Gains HIPAA-Compliant, Disaster-Tolerant Email Infrastructure

OverviewCountry or Region: United StatesIndustry: Education

Customer ProfileTulane University is one of the nation's most prestigious educational and research institutions. Founded in New Orleans in 1834, Tulane offers degrees in architecture, business, law, liberal arts, medicine, public health and tropical medicine, the sciences, engineering, and

social work.

Business SituationIn the aftermath of Hurricane Katrina, University officials tasked the Tulane IT department with developing a solution that would ensure messaging continuity even in the face of a catastrophe.

SolutionTulane IT officials wanted a cloud-based messaging solution, but considerations such as HIPAA compliance for medical school and hospital emails ruled out all but one cloud-based solution: Office 365 for education.

Benefits Provides leading-edge email services Avoids millions in infrastructure costs Eliminates learning curve Enables HIPAA compliance Ensures disaster tolerance

“Microsoft knew it needed to have a HIPAA BAA [Business Associates Agreement] to support universities and medical schools with Office 365 for education … and it came out with a BAA that is very good."

Leo Tran, Assistant Vice President for IT Infrastructure, Tulane University Technology Services

Tulane University wanted to upgrade its aging email infrastructure, but its needs were somewhat complex. It wanted leading-edge email, collaboration, and messaging services, but it also wanted a fully redundant email infrastructure to ensure communications continuity should another major hurricane pummel New Orleans. It wanted a solution that faculty, staff, and students could access from anywhere, at any time, and from any device, but it also needed a solution designed with HIPAA compliance in mind, since the new email solution it deployed would be supporting the University’s medical school and hospital facilities. Finally, Tulane’s IT team wanted to find a way to meet all these needs without breaking the bank. The solution? Tulane moved into the cloud, using a HIPAA-compliant, disaster-tolerant solution from Microsoft: Office 365™ for education.

SituationIn the years after Hurricane Katrina devastated New Orleans in 2005, the IT organization at Tulane University was busy putting critical university systems back in working order. It was not until late in the decade, though, that the modernization of Tulane’s email infrastructure finally arrived at the top of the IT organization’s priority list.

In some ways, it was just as well that they had not upgraded from Microsoft® Exchange Server 2003 earlier. When Exchange 2007 became available, the IT organization was too busy rebuilding other systems to focus on upgrading the email system. So, by the time they began to address the challenge in earnest in 2009, the capital costs associated with a traditional upgrade from Exchange Server 2003 were enough to induce sticker shock. The University would have to:

Acquire nearly 20,000 user licenses for Exchange Server 2010.

Acquire new hardware on which to run the email infrastructure.

Expand its storage systems immensely (for users wanted their inbox storage quotas increased by several orders of magnitude).

And this was just for starters. Because of its experience with Katrina, which knocked out the email system for four weeks, Tulane’s IT officials had been planning to duplicate the new email infrastructure at a remote site to ensure continuity should disaster strike New Orleans again. Effectively, this plan more than doubled the already significant expense of a traditional upgrade.

SolutionAs a result of this sticker shock, Tulane’s IT officials reconsidered their options and realized that a traditional upgrade might not be the University’s only—or even best—solution. A cloud-based solution might provide faculty, staff, and students with the messaging services they needed without incurring the capital expenditures for infrastructure that a traditional upgrade would require. Furthermore, a cloud-based service could ensure the service resilience that Tulane had been planning to ensure with the parallel email infrastructure in the remote data center—again, without incurring the expense of actually having to build a parallel email infrastructure.

One Dark Spot in a Bright CloudBecause a cloud-based approach made it so much easier to upgrade its email infrastructure, Tulane decided to migrate its users from Microsoft Exchange 2003 to the Microsoft Live@edu service in 2010. In addition to enabling Tulane to avoid the capital costs associated with complex hardware roll-out, Live@edu would enable Tulane to avoid the cost of licensing the Microsoft Exchange Server software: Microsoft offered Live@edu at no charge to educational institutions.

But soon after reaching its decision to migrate to Live@edu, Tulane’s IT officials discovered a problem. Tulane has a large medical school and hospital complex, and any email system used by the medical school or hospital is subject to the privacy provisions defined in the Health Information Portability and Accountability Act (HIPAA). To comply with HIPAA regulations, Tulane would need a HIPAA Business Associate Agreement (BAA) from

25

“All our email infra-structure is in the cloud now, and Microsoft is responsible for taking care of it.”

Leo Tran, Assistant Vice President for IT Infrastructure, Tulane University

Technology Services

Microsoft, a document verifying that the information residing on its servers and passing through its infrastructure would be secured in accordance with HIPAA privacy requirements.

Tulane IT officials had no difficulty asking Microsoft for a BAA—the difficulty was that Microsoft could not provide one for the Live@edu service.

Microsoft assured Tulane that its inability to offer a BAA had nothing to do with undisclosed security problems in Live@edu. The difficulties were rooted in legalities.

Given the advantages offered by the cloud—and the fact that neither Google nor any other cloud service provider would agree to provide a HIPAA BAA—Tulane decided to continue with its plan to use Live@edu. However, it decided to migrate only those user accounts whose data was not subject to HIPAA regulation. Accordingly, late in 2010, Tulane’s IT department worked with Microsoft to move nearly 15,000 student accounts from the University’s on-premises Exchange 2003 system to Live@edu, where they gained access to email services built around Microsoft Outlook® Live and a Tulane-branded Exchange solution, collaboration services built around Microsoft SkyDrive®, as well as messaging services built around Windows Live Messenger.

Meanwhile, students, faculty, and staff associated with the medical school and hospital would have to remain on the old Exchange 2003 solution until such time as a HIPAA-compliant cloud service became available.

With the announcement of Microsoft Office 365 for education, that time came in early 2012.

Office 365 for Education Microsoft Office 365 for education takes Live@edu to the next level. It combines the familiar Microsoft Office desktop suite with online versions of next-generation Microsoft communications and collaboration services, including:

Microsoft Exchange Online for email, shared calendars, and shared address books.

Microsoft Lync® Online for instant messaging and online video conferencing.

Microsoft Office Web Apps for online access to Microsoft Office files.

Microsoft SharePoint® Online for collaboration and resource sharing.

These applications run in data centers owned and operated by Microsoft, and Microsoft maintains the servers and the software on a day-to-day basis. Office 365 for education is, like Live@edu, offered free of charge to educational institutions. Unlike the Live@edu service, though, Microsoft can offer a HIPAA BAA for institutions that need such an agreement for HIPAA compliance.

As soon as Microsoft introduced Tulane IT officials to Office 365 for education and indicated that a HIPAA BAA would be available, Tulane signed on—and decided to move everyone at the University to Office 365 for education, including the faculty, staff, and students attached to the medical school and hospital.

35

“Schools around the country all face the same HIPAA compliance issues and are looking for the same sort of HIPAA BAA”

Leo Tran, Assistant Vice President for IT Infrastructure, Tulane University

Technology Services

BenefitsFor Tulane, Office 365 for education is delivering significant benefits in a number of areas. It has provided faculty, staff, and students with a world-class email and messaging system that can be accessed at any time, from anywhere, and from any device the user wants to use. It has enabled users at Tulane to take advantage of new communications features quickly and easily because it builds on their familiarity with Microsoft Office Outlook. There was virtually no learning curve for users familiar with Exchange 2003 or Live@edu, so they have been able to be productive from day one. It has also provided users throughout the Tulane community with a huge boost in email storage capacity. Faculty and staff moved from a 300 megabyte inbox quota to a 25 GB quota. Students gained even more dramatically, moving from a 100 MB inbox quota to the same 25 GB quota that all Office 365 for education users enjoy.

Cost AvoidanceCost avoidance has also been a huge benefit arising from the adoption of Office 365 for education. In avoiding the need to purchase more software licenses, more high performance servers, and remote facilities to run a standby email infrastructure, Tulane IT officials calculate that the University has avoided capital expenses totaling more than $1 million—and that figure does not even include implementation costs. At the same time, Tulane has been able to stop subscribing to a disaster recovery system that it had been using as a stop-gap solution—and by eliminating the cost of subscribing to that system, Tulane is saving another $250,000 annually.

The IT organization has been able to avoid the need to hire additional personnel to support an expanded infrastructure and its existing staff has been able to spend more time focusing on strategically important projects.

45

"It’s critical for a school that wants to use a cloud-based service to have a HIPAA BAA in place with its service provider."

Leo Tran, Leo Tran, Assistant Vice President for IT Infrastructure, Tulane

University Technology Services

HIPAA ComplianceBut for Tulane, one of the most significant benefits of Office 365 for education is that Microsoft has engineered this solution with HIPAA compliance in mind. The HIPAA BAA that Microsoft offered Tulane reflects discussions that Microsoft had with the Common Solutions Group, whose members include the CIOs from more than 30 research universities around the United States.

“Microsoft knew it needed to have a HIPAA BAA to support universities and medical schools with Office 365 for education,” says Tran, “and it came out with a BAA that is very good.”

Ensured Continuity The HIPAA BAA removed the one hurdle that had previously prevented Tulane from fully embracing a cloud-based offering—and once that obstacle was removed, Tulane could complete its move to the cloud and take full advantage of the benefits that the cloud offers—from leading edge functionality to geographic resource distribution and disaster tolerance.

“I believe that Tulane was the first university to upgrade from Live@edu to Office 365 for education,” says Tran, “and that’s exciting. All our email infrastructure is in the cloud now, and Microsoft is responsible for taking care of it.”Microsoft Office 365 for EducationMicrosoft Office 365 for education brings together cloud versions of our most trusted communications and collaboration products—Microsoft SharePoint Online,

Exchange Online, and Lync Online—with the latest version of our Office desktop suite and companion web applications for educational institutions.

Office 365 for education helps save time and money, and it frees up valued resources. Simple to use and easy to administer, it is financially backed by a service level agreement guaranteeing 99 percent reliability. Office 365 for education features robust security, IT-level phone support, geo-redundancy, disaster recovery, and the privacy controls and standards that you expect from a world-class service provider.

For more information about Microsoft Office 365 for education, go to: http://education.office365.com

55

For More InformationFor more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers in the United States and Canada who are deaf or hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to: www.microsoft.com

For more information about Tulane University, visit the website at: www.tulane.edu

This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.

Document published October 2012

Software and Services Microsoft Office 365 for education