Documenting Change

Priority Health Systems, a Grand Rapids, Mich.-based health insurance provider, is privately held and therefore isn't required to comply with Sarbanes-Oxley. But, many of the companies to which Priority Health sells group policies expect it to adhere to similar monitoring controls, according to Jake Roersma, Priority Health's manager of network engineering. To demonstrate those controls, Priority Health needed an automated system to report changes to its HP (Palo Alto, Calif.) storage area network (SAN), he relates.

Many insurers have sought this type of technology since the enactment of Sarbanes-Oxley, but Priority Health began looking for such a solution in 2002 - before SOX was adopted. Regulatory compliance isn't the only reason to implement a tracking solution, Roersma explains. "If something went wrong with the SAN, it was up to one of our engineers to determine what the cause was," he says. "If a change was made to the SAN, we had no way to track it - unless someone remembered what they did."

Initially, Priority Health attempted to record the information on spreadsheets, but that proved to be ineffective. "With the spreadsheets, time tracking was nearly impossible," Roersma says. As a result, untold hours were spent tracing and correcting network problems. So, Roersma recalls, he began searching for a system that would record network changes automatically.

Yet Roersma didn't find what he was looking for until he saw Boston-based Onaro's SANscreen Predictive Change Management software at a storage technology trade show in September 2004. He also considered adding a monitoring module that HP offers for its SAN, but, "It doesn't do what Onaro does," Roersma contends.

Priority Health purchased the Onaro software in November, testing it for a few weeks and going live in December, according to Roersma. The installation took just three hours, he relates, and training took just 30 minutes. The software was added to an existing server - no technology changes were required.

Priority Health spent $40,000 - less than 1 percent of its IT budget - to cover 512 ports with the system, Roersma says. Onaro officials note that Priority Health received early pricing incentives; the solution's list price is $35,000, plus $185 per port, though volume discounts may be available.

Onaro's solution continuously records and monitors all changes to SAN devices, topology and configurations, and it automatically analyzes the impact the changes have on storage service-delivery policy. The software enables Priority Health to see when any changes were made to the SAN, what the changes were, and who made them. It records all changes and storage policies within a database and audits all violations and resolutions for historical tracking and service disruptions.

With the time saved in tracking changes, the investment has provided "incalculable" benefits, says Roersma. For example, "If someone comes to me and says they started having problems with accessing the network last Wednesday, we can go back and see what changes were made to the network that day," he explains.

---

CASE STUDY PROFILE

Company

Priority Health Systems (Grand Rapids, Mich.; $950 million in annual revenue).

Lines Of Business

Group health insurance (HMO).

Vendor/Technology

Onaro's (Boston) SANscreen Predictive Change

Management software.

Challenge

Automatically monitor and record changes to the company's storage area network.